Hot answers tagged

26 votes
Accepted

Managing inputs for payload injection?

Injecting payload and hexadecimal addresses through program inputs depends on the type of input you get. Here is a list of all the possible inputs and the way to do it with both a pure shell ...
user avatar
  • 18.1k
25 votes

Knowledge about CPU hardware

To extend the answer of perror: Perhaps you should take a look into a recently published whitepaper named Breaking the x86 ISA, by Christopher Domas. It was published on blackhat17 and describes an ...
user avatar
  • 1,227
9 votes

Knowledge about CPU hardware

In fact, the CPU are much more checked and verified than programs. It is very unlikely to find a (significant) bug in a CPU. Even though it happens from time to time. Therefore, it is much more ...
user avatar
  • 18.1k
9 votes
Accepted

Heap Chunk Structure Does Not Contain Previous Section Info

The diagram you linked to seems to be wrong. The size of the previous chunk is stored in the current chunk iff, the previous chunk is free. This image is more appropriate of what an allocated heap ...
user avatar
  • 5,850
7 votes
Accepted

What is the problem with using inner classes in a class enclosing sensitive information?

The problem is that there is no notion of inner classes at the bytecode level. Each inner class is compiled to a separate class with no special privileges compared to any other class in the same ...
user avatar
  • 1,972
7 votes

What do these 2 Ghidra warnings mean?

From Ghidra.re: Sometimes you will see warnings in the decompiler view stating that there are too many branches to recover a jumptable. One reason for this is that there actually is a jump table, but ...
user avatar
6 votes
Accepted

Why shell code only with nop slide working for me?

Let's look up what the "weird instruction" does: Saves the current FPU operating environment at the memory location specified with the destination operand, and then masks all floating-point ...
user avatar
  • 34.7k
5 votes

Why is the value of the ESP register the same every time, when we turnoff the ASLR?

Because the operating system is initializing ESP always at the same value (and that the execution of the program you look at are deterministic). The way the ASLR (Address-Space Layout Randomization) ...
user avatar
  • 18.1k
5 votes
Accepted

Reading Memory to bypass ASLR

this is how a BSTR represented in memory: Length Data string Terminator so an attacker will try to get an aligned heapspray and then trigger a vulnerability that will modify the Length part of a ...
user avatar
  • 66
5 votes

Are all the code sequences ended with "ret" potential "gadgets" for ROP attack?

This is a continuation of non-return based gadgets. A ROP-gadget in itself is a segment of code that you can use to manipulate data, and get some desired effect, while maintaining control of ...
user avatar
  • 516
5 votes
Accepted

Win7 ASLR bypass

If you can patch the program's image, you don't actually need to hardcode the address. you can simply add another import entry to the already existing import tables and have it patched in ...
user avatar
5 votes
Accepted

Writing an exploit for sample-application

Why is it not working. This example is basically from an older book I'm reading. But theoretically it should work so I think.... It's because you're overwriting the return address on the stack ...
user avatar
5 votes

How does Windows SafeSEH mechanism work?

Regarding your original question: Upon ntdll.dll loading each PE image, the list of exception handler addresses in the PE image is parsed and each address is inserted into a sorted list that ntdll.dll ...
user avatar
  • 51
5 votes
Accepted

How to find the stack and other info in a memory dump? ARM

The only idea I have is to compare the dumps. The places that are same in all dumps are code or read only data. The places that are changing from dump to dump are either stack or section like .bss. ...
user avatar
  • 7,720
4 votes

Exploit Development with python

if you want to develop exploits in Python, this book may help: http://my.safaribooksonline.com/book/-/9781597497299/chapter-9-exploitation-scripting/building_exploits_with_python If you need to ...
user avatar
  • 1,196
4 votes

How exploit writers find bugs in Java Machine?

Lots of Java exploits revolve around bypassing the Java sandbox, the Security Manager in Java parlance. Sami Koivu published a lot of interesting work around Java security and exploits, notably his 3 ...
user avatar
  • 2,168
4 votes

Are all the code sequences ended with "ret" potential "gadgets" for ROP attack?

Yes, all the opcodes ending by a ret can be considered as a gadget. But, consider also the fact that not only legal instructions can be considered as gadget, also 'starting in the middle of an ...
user avatar
  • 18.1k
4 votes

exploit - Why not execute shellcode with the inline assembler?

This execute-from-array method is used to test shellcodes in bytes format, which is often the way shellcodes are provided (see http://shell-storm.org/shellcode/). It also emulates the usual way ...
user avatar
  • 2,168
4 votes
Accepted

How to start learning reverse engineering to eventually help exploiting of modern consoles like Xbox One, PS4?

Some things you will inevitably have to know at some degree to be able to reverse engineer Game Consoles: Learn a lower level language such as C or C++. Most, if not all, Console games, modern and ...
user avatar
  • 158
4 votes

How does Windows SafeSEH mechanism work?

I post my own answer based on my own research. I am not sure about correctness of the parts in bold. Comments correcting my answer or fuller and better answers are welcome. I will edit out the ...
user avatar
  • 201
4 votes
Accepted

Basic Buffer Overflow Help

You're doing well, with a little bit help you can exploit this program. First, let's look at stack layout for Linux (i assume it is Linux because of sudo and it is more common than other Unix-like ...
user avatar
4 votes
Accepted

How to exploit an suid root application

If the program is setuid, you can use the fact that it is calling the command ls -al /tmp through system() from the main() function. Create a file ls which contains: #!/bin/sh /bin/sh Set it as an ...
user avatar
  • 18.1k
4 votes
Accepted

Extract firmware images from COTS embedded devices

As this question is quite general, it'll be difficult to provide a very technical answer. You've asked quite a few questions here, so please let me start with a general overview and then proceed to ...
user avatar
  • 11.4k
4 votes
Accepted

GDB: Could not load shared library symbols

Typically when cross-debugging a remote target with GDB, you do not try to preserve debug symbols in files loaded onto the target, but rather for reasons of space use only stripped binaries there. ...
user avatar
3 votes
Accepted

Using GDB to look at stack

First, you really need to set a breakpoint somewhere if you want gdb to stop before the program end. Then, you should really try to use peda, a set of configuration and Python scripts for gdb ...
user avatar
  • 18.1k
3 votes
Accepted

Use After Free - Example

The first thing that comes to my mind is for you to create a class with a few virtual methods, which will be used as the test subject. Then from your ActiveX control you'd expose methods that ...
user avatar
3 votes

Why is the value of the ESP register the same every time, when we turnoff the ASLR?

Turning ASLR on/off affects the initial value of the stack pointer. Whenever a function is called, it reserves the amount of stack it needs, by subtracting from the stack pointer. When this function ...
user avatar
3 votes

Converting assembly code to c

There's also asm2c that works on assembly source code instead of executables or objects files. Tool to convert DOS Assembly code to C code Edit
user avatar
  • 131
3 votes

Fuzzing Adobe Reader - Exploit Development

There are good answers to your question here. However, I wanted to give you my opinion. Root cause analysis, over all, is best done half-manually. One of the reasons is that techniques like Dynamic ...
user avatar
  • 4,315
3 votes
Accepted

Help with identifying race condition in wargame

Hmm this code will probably not work if optimized because the shared globals are not pointers nor are they marked as volatile. This means that the compiler is free to assume the globals are accessed ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible