22
Have a look at the var_4 definition at the start of the function:
var_4 = dword ptr -4
So it's actually negative as expected.
For a more complete picture, use Ctrl+K or double-click/Enter on the stack var to see the stack frame layout:
-00000018 ; Two special fields " r" and " s" represent return address and saved registers.
-00000018 ; Frame size: 18; ...
15
I lack 9 reputation points, so sadly I can't comment the great answer by w_s. ;)
Just for completeness, the concept described is known in graph theory as "Tarjan's Algorithm" for finding strongly connected components.
Wikipedia has a nice animation that helps following the steps.
For study, here is another (more formal) Python implementation, it's the ...
12
It is not trivial task. You can do it relatively easy if you not taking in account indirect calls (for example such as virtual functions in C++) and calls from another function like this:
int f() {
g();
}
int g() {
f();
}
It can be much more complicated if one of your functions is in another binary (dll for example). So, there are two ways to do it,...
11
Why does the return address have to point to the shellcode in the same buffer?
It doesn't, but generally, both the shellcode and the return address are delivered at the same time, so they are stuck together for that reason. If your exploit allows you to deliver them separately, then they can be separated. However, they are by necessity both local to the ...
10
The shellcode is unicode escaped. You can convert it to its hex representation using a simple python script.
from binascii import unhexlify as unhx
encoded = open('encoded.txt').read() # The shellcode dump
out = open('shellcode.bin', 'wb')
for s in encoded.split('%'):
if len(s) == 5:
HI_BYTE = s[3:]
LO_BYTE = s[1:3]
out.write(...
9
So, it is totally untested but here is the result of a few Internet browsing.
First the stack base address is present in /proc/<pid>/maps, then it must be accessible from user-space at some point.
I looked at the code of the pstack command which is printing the content of the stack of a running process. This code is getting the base address from a ...
7
Linux
As @Nirlzr correctly mentioned, netstat -ape | grep <proc_name/pid> will show you the active connections of a process. It might be just enough for you but there are some cases where it would not.
netstat has some blind spots -- it only shows connections at a certain point in time. Therefore, connections which closed quickly and every ...
7
Go to the memory window in Ollydbg. Find the code section (usually .text) of the module you want to break on return to. Right click the memory section and set break-on-access or hit F2. You'll break once execution reaches that memory. You can also change the memory access to read only and you'll get an exception when execution hits that memory segment.
You ...
6
I'm on a 64-bit machine.
Your code in function_b() treats pointers as 32-bit values instead of 64-bit values. You should be using uint64_t* instead of uint32_t*.
4
You can write your hooking library (DLL) which will patch the API you are targeting. This patch will just print to file/console the parameters and continue back to the original function. There will be no stops on the way. To actually hook the APIs you will need to inject the DLL into the target application. You can use Detours from Microsoft as and example ...
4
In normal condition alt+f9 execute till user code should get you back to user code
4
If I'm understanding your first question correctly, I think there was a disconnect between you and whoever told you that. There is no restriction based on the buffer(s) being in the same process, at least not with respect to return values. You could absolutely have the return address point to the start of the shellcode. It's entirely up to you.
The better ...
4
I am Not Sure what you are looking for let me try
i have a dump file of a vm too MEMORY.dmp from a vm that ran xp sp3 created using .crash from a kernel debugger attached to it
i loaded it using windbg as below
windbg -z memory.dmp
now i thought i will count how many threads are running so i did some thing like this
kd> r $t0 = 0; !...
3
The stack can be used to hold all kinds of values, including ones that look like return addresses but aren't. If stack-frames are omitted, then it becomes very difficult to trace backwards without disassembling the function to see how it stores preserved values such as registers.
3
Question 1: Why isn't the EBP pointing to 1B05FFFC?
Because 1B05FFFC is not the base address of the stack frame.
The only reason that OllyDbg shows 1B05FFFC as the last address in the stack-view is that it's the address of the last DWORD in the stack's memory page.
Question 2: What do the first 16 bytes on the stack represent?
It depends on the ...
3
The prompt shown is kd> so you are debugging a live kernel.
If memory could not be accessed windbg will show ? Not 0000
maybe you actually have 0000 in the address.
Did you try doing .pagein ?
Did you try viewing the physical address !vtop 0 <virtualaddress> ?
Here is sample of unaccessible memory:
.fnent notepad!
SaveFile (01004eae) notepad!...
2
Regarding the first question, nothing is stopping you to put your shellcode wherever in that process' executable memory. For example, a common practice is(was, to be honest) to put shellcode in some environment variable, as (in absence of ASLR) their address can be perfectly caluclated. In that case you wouldn't have to guess the return address, but ...
2
Olly and WinDbg generate the 'call stack' by parsing the actual stack utilizing function signatures and calling convention. When the disassembler doesn't have the signature (e.g. when the developer didn't disclose the function signatures) it can only take educated guesses based on push- and pop-instructions (thin ice).
The problem is, you actually need this ...
2
dds means dump dwords intrepreting the result as symbols
suppose 0x401234 contains 0x77123456 and
0x77123456 is resolved as kernel32!CreateFileA
dds 0x401234 will yield kernel32!CreateFileA
if you do dds esp it can return bogus symbols as stack can contain address that may be a constant which might resolve to a symbol
edit
dds/dqs/dps are meant to ...
2
x-refs is just a static cross-reference in the binary that can be identified during static-analysis.
So if you main call funcA you could tell that by looking at x-refs on funcA. But you can't be sure that it will be in fact called during runtime - there might be some conditional jumps that only call funcA in a certain state.
Stacktrace presents the actual ...
2
ret instructions are not going to the call stack. When a function executes call, the next instruction address is pushed to the stack and when ret instruction is executed, eip is updated with the next instruction from the stack.
After the next instruction address is popped from the stack by ret, the address at the stack will most likely be overwritten by a ...
1
Actually it was so obvious - I just haven't read the C++ standard and was writing throw() specification thinking it would allow all exceptions - instead it turned out it was the exact opposite.
And yes this throw function specification is what is causing those zero TryBlockMap with more than one Unwind entries. Here is a VC++ 6.0 (and later) compilable ...
1
What I do NOT understand is how all the registers and the call stack fit together with this picture and what each registers is supposed to point to.
It's great that you are competent in C, but there is no way around reading disassembled object code and writing assembly code (practical experience).
The compiler toolchain is responsible for generating object ...
1
Hello you can start with the following approach:
Decompile the apk file with apktool
convert classes.dex to .jar with dex2jar
open the file with some java decompiler. My favorite is Luyten
Find the specific function
$ apktool d app-uat-release.apk -s -o dex
$ cd dex
$ d2j-dex2jar classes.dex
dex2jar classes.dex -> classes-dex2jar.jar
$ java -jar /path/...
1
Since OP's answer was a bit low on details, i'll assume Linux and Dynamic IP.
On most OSes there are tools to list network resources taken by processes. This often includes IP addresses and ports used for existing connections. If you want to list existing connections and their owning processes on linux, running the netstat command.
By providing it some ...
1
you can get system call stack with strace too. you just need to compile strace with libunwind. After that you just need to use -k to get system call stack for each system call.
1
JavaJournal, which was built on top of the pyspresso framework, was designed specifically for tracing method calls in Java.
1
The answer by extreme coders was wonderful,i wish to share my method too over here:
I convert it to an executable with the tools in REMnux:
remnux@remnux:~$ unicode2hex-escaped < sc.txt > sc2.txt
remnux@remnux:~$ shellcode2exe -s sc2.txt
Reading string shellcode from file sc2.txt
Generating executable file
Writing file sc2.exe
Done.
remnux@remnux:~$...
1
The approach you describe is implemented in several profilers, usually under the name sampling profiler. What it usually does is:
periodically (e.g. every 100ms) suspend the application
get the current registers of each thread
perform a quick stack trace using the captured ESP/EIP/EBP
resume the application
after the end of profiling, collate the stack ...
Only top voted, non community-wiki answers of a minimum length are eligible
