Hypothetically, If I'm hijacking a DLL but user space is in a sandbox; upon debugging, sandbox initiates at 0x345678 and I want to move to the space before it initiates: Can I call a jmp function like "xyz-volatile(jmp 0x1100000);" to jump to the space before the sandbox initiates?

  • How does this sandbox work? I am pretty sure its not based on just IP value, rather making some syscalls, dropping privileges or some other feature provided by OS.
    – sudhackar
    Jan 12, 2021 at 12:07
  • Ofcourse not, for a moment just consider I am working within ollydbg tool with in windows , lets say win 10
    – muhammad
    Jan 18, 2021 at 11:15


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.