I'm analyzing a use-after-free bug in IDA Pro by hand. Basically, I control the content of an object (pointed by a register) and I want to force a write at an arbitrary address. For instance, I might find a
mov [ebx], eax, where I can control both
Is there a way to automate this task at least in part?
Here's a simple example. Let's say we control the data pointed by
ecx and we have this code:
mov eax, [ecx] test dword ptr [ecx+8], 8 jz skip mov ebx, [ecx+4] mov [eax], ebx <---- arbitrary write skip:
As you can see, by choosing the values at [ecx], [ecx+4] and [ecx+8] carefully, we can perform an arbitrary write. In reality, the code is much more complex, so it's hard to keep track of what we control and find a suitable instruction.