1

I am trying to teach myself some ROP programming. And I have tried to do some training exploits from different sites. So, right now, I have this little application where GS, safeSEH ALSR and DEP are enabled (on application level not on OS). So, when I make an attempt to exploit this application it works pretty well ( http://pastebin.com/TdDR3W0y). It just pops calc.exe.

But, on the other side, when I enable OS level DEP, then my exploit generates a segfault and crashes the application.

So, my question is what is the difference between application level DEP and OS level DEP ? Do, I have to make other/different function calls (instead to VirtualProc) when I try to circumvent DEP ?

Improve this question
1
  • Okay i was not shure if this is the right place. Could some OP move the question? Or i have to delete this and create a new one on SO. Thanks
    – Dirk
    Oct 21, 2014 at 13:06

1 Answer 1

Reset to default
2

Based on the hard-coded values in your code, you are not defeating ASLR at all (0x7c801ad4, 0x0012fbd0, 0x0012fbd0), and perhaps the application does not support it either (0x1003c898, 0x10086d6a), because none of those values should be constant when ASLR is working properly. The likely reason why you are seeing segfaults is because the 0x7c801ad4 for VirtualAllocEx() probably moved between reboots, as a result of ASLR, but which is visible as a side-effect of enabling DEP and then rebooting.

Improve this answer
1
  • I Guess you are right, i have checked again the app in my debugger. And the modules are just DEP/ALSR compatible but it is not enabled at run time. I think a i have to read more about how to defeat ALSR. But anyway thanks
    – Dirk
    Oct 22, 2014 at 6:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.