Hypothetically, If I'm hijacking a DLL but user space is in a sandbox; upon debugging, sandbox initiates at 0x345678 and I want to move to the space before it initiates: Can I call a jmp function like "xyz-volatile(jmp 0x1100000);" to jump to the space before the sandbox initiates?

  • How does this sandbox work? I am pretty sure its not based on just IP value, rather making some syscalls, dropping privileges or some other feature provided by OS.
    – sudhackar
    Jan 12, 2021 at 12:07
  • Ofcourse not, for a moment just consider I am working within ollydbg tool with in windows , lets say win 10
    – muhammad
    Jan 18, 2021 at 11:15


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.