Hypothetically, If I'm hijacking a DLL but user space is in a sandbox; upon debugging, sandbox initiates at 0x345678 and I want to move to the space before it initiates: Can I call a jmp function like "xyz-volatile(jmp 0x1100000);" to jump to the space before the sandbox initiates?

  • How does this sandbox work? I am pretty sure its not based on just IP value, rather making some syscalls, dropping privileges or some other feature provided by OS. – sudhackar Jan 12 at 12:07
  • Ofcourse not, for a moment just consider I am working within ollydbg tool with in windows , lets say win 10 – muhammad Jan 18 at 11:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.