2
votes
Reverse engineering POST request body
It appears to me that the payload contains no instructions but just addresses of the existing ROP gadgets in the DLLs specific to the system being exploited. Try looking up the addresses in the ...
- 36.2k
2
votes
How to reverse engineer a Black Box?
First I believe loading it with IDA (or r2) could be helpful. But I don't know how to set up a raw dump in IDA, do i have to load it manually? am i missing something?
IDA directly handles raw image, ...
- 1,124
2
votes
Accepted
What is this protection that seems to prevent ROP when ASLR in ON?
This is not a protection but juste a prologue / epilogue that your compiler will produce.
You can check the produced assembly with different versions of gcc right there: https://gcc.godbolt.org/
And ...
- 36
1
vote
How does PIE mitigate exploits?
The PIE abbreviation means "Position Independent Executable". Such an executable may ask or not ask the OS for the Address Space Layout Randomization (ASLR), when the OS loader loads the ...
- 1,120
1
vote
BufferOverflow - Cannot push a specific return address on the stack
By the looks of it, 0xee is a bad character if its getting truncated like that. What you should do first is look for bad characters and when youre done, you have an idea of what gadget you can and ...
- 101
1
vote
ROP chain: Buffer Overflow Return Pointer
The zero in the address that you are passing is causing the string to be terminated and the following values to not be stored. You won't be able to return directly to libc that way. Instead, you'll ...
- 4,691
1
vote
Can't trace MIPS embedded device remotely
You should be able to use IDA to debug MIPS binaries. It's been a while for me, but I seem to recall IDA sometimes getting confused by the branch delay slot (the instruction following a jump/branch). ...
- 106
1
vote
Can't trace MIPS embedded device remotely
What wersion gdbserver are you use? You make this gdbserver or download in repository. Please check file output for mips file (big or little endian) and also check output gdbserver -v
Try connect gdb ...
1
vote
What is this protection that seems to prevent ROP when ASLR in ON?
While not a part of the official 386 SysV ABI, there is a de-facto requirement that the stack pointer is aligned to 16 bytes at all times when calling system functions (enforced by the de-facto ...
- 36.2k
Only top scored, non community-wiki answers of a minimum length are eligible