Skip to main content
2 votes

Reverse engineering POST request body

It appears to me that the payload contains no instructions but just addresses of the existing ROP gadgets in the DLLs specific to the system being exploited. Try looking up the addresses in the ...
Igor Skochinsky's user avatar
  • 36.8k
2 votes

How to reverse engineer a Black Box?

First I believe loading it with IDA (or r2) could be helpful. But I don't know how to set up a raw dump in IDA, do i have to load it manually? am i missing something? IDA directly handles raw image, ...
wisk's user avatar
  • 1,164
2 votes
Accepted

What is this protection that seems to prevent ROP when ASLR in ON?

This is not a protection but juste a prologue / epilogue that your compiler will produce. You can check the produced assembly with different versions of gcc right there: https://gcc.godbolt.org/ And ...
laxa's user avatar
  • 36
1 vote

How does PIE mitigate exploits?

The PIE abbreviation means "Position Independent Executable". Such an executable may ask or not ask the OS for the Address Space Layout Randomization (ASLR), when the OS loader loads the ...
MarianD's user avatar
  • 1,130
1 vote

BufferOverflow - Cannot push a specific return address on the stack

By the looks of it, 0xee is a bad character if its getting truncated like that. What you should do first is look for bad characters and when youre done, you have an idea of what gadget you can and ...
Jon's user avatar
  • 101
1 vote

ROP chain: Buffer Overflow Return Pointer

The zero in the address that you are passing is causing the string to be terminated and the following values to not be stored. You won't be able to return directly to libc that way. Instead, you'll ...
peter ferrie's user avatar
  • 4,709
1 vote

Can't trace MIPS embedded device remotely

You should be able to use IDA to debug MIPS binaries. It's been a while for me, but I seem to recall IDA sometimes getting confused by the branch delay slot (the instruction following a jump/branch). ...
zcutlip's user avatar
  • 106
1 vote

Can't trace MIPS embedded device remotely

What wersion gdbserver are you use? You make this gdbserver or download in repository. Please check file output for mips file (big or little endian) and also check output gdbserver -v Try connect gdb ...
Vasiliy Kuramshin's user avatar
1 vote

What is this protection that seems to prevent ROP when ASLR in ON?

While not a part of the official 386 SysV ABI, there is a de-facto requirement that the stack pointer is aligned to 16 bytes at all times when calling system functions (enforced by the de-facto ...
Igor Skochinsky's user avatar
  • 36.8k

Only top scored, non community-wiki answers of a minimum length are eligible