10
votes
Accepted
Need advice : Reverse engineering a pdf with shellcode
The shellcode is unicode escaped. You can convert it to its hex representation using a simple python script.
from binascii import unhexlify as unhx
encoded = open('encoded.txt').read() # The ...
- 5,850
7
votes
Accepted
Cannot locate a variable on the stack
The reason the you are unable to locate text1 on the program runtime stack is that during runtime text1 is in the data segment of the process running in virtual memory, not the stack. In order for a ...
- 6,819
6
votes
Accepted
When to use Windbg and Ollydbg?
Even the free version of IDA Pro is worth having. Finding the general structure of an unknown binary is much easier with it than with anything else. If you have an unknown DLL, it will show you which ...
- 12.6k
6
votes
Accepted
How can a format string vulnerability be used to write a specific string into memory?
It's a lot of questions, here are a few answers:
How can we write something in memory with a format string vulnerability ?
For this, you need to know two specific features used in the printf format ...
- 18k
5
votes
Accepted
Reading Memory to bypass ASLR
this is how a BSTR represented in memory:
Length Data string Terminator
so an attacker will try to get an aligned heapspray and then trigger a vulnerability that will modify the Length part of a ...
- 66
5
votes
Accepted
Detecting weaknesses/vulnerabilities (in games). Scientific papers/Tutorials?
The approach to finding security vulnerabilities in games is no different than the approach to finding security vulnerabilities in other applications.
As discussed here, "Most vulnerabilities in ...
- 20.4k
5
votes
Accepted
Analyzing a use-after-free bug (taint analysis?)
I would agree with you in that you need to implement some kind of taint tracing, what is tricky statically. Moreover, you need to know whether there are any constraints applied to your controlled ...
- 991
4
votes
When to use Windbg and Ollydbg?
WinDbg uses debugging information (pdb/symbol files) for debugging. So ,for example say I get a unknown exe (malicious) can I debug it since I'll not be having its .pdb
Yes. Symbols are one of Windbg'...
- 402
4
votes
How exploit writers find bugs in Java Machine?
Lots of Java exploits revolve around bypassing the Java sandbox, the Security Manager in Java parlance. Sami Koivu published a lot of interesting work around Java security and exploits, notably his 3 ...
- 2,158
3
votes
Accepted
someone can help me recognize the vulnerability
The bug is in update_volume.
pglobal_data -> radio_data.speakers_volume[index] = new_volume;
index is an int, it can take negative values too. Ideally you should not be able to access -ve indices ...
- 2,315
3
votes
Fuzzing Adobe Reader - Exploit Development
There are good answers to your question here. However, I wanted to give you my opinion. Root cause analysis, over all, is best done half-manually. One of the reasons is that techniques like Dynamic ...
- 4,305
3
votes
Run multiple instances of same application - Adobe Reader
Adobe Reader uses the following two methods to determine if another instance is running:
CreateSemaphoreW(NULL, 0, 1, L"Acrobat Viewer") followed by
GetLastError() == ERROR_ALREADY_EXISTS
FindWindowW(...
- 20.4k
3
votes
Accepted
Use After Free - Example
The first thing that comes to my mind is for you to create a class with a few virtual methods, which will be used as the test subject. Then from your ActiveX control you'd expose methods that ...
3
votes
Accepted
Help with identifying race condition in wargame
Hmm this code will probably not work if optimized because the shared globals are not pointers nor are they marked as volatile. This means that the compiler is free to assume the globals are accessed ...
- 5,551
2
votes
Accepted
Do you have tips analyzing reported PoC(exploit) files?
First, your platform is very important ( mine is Windows )
In Windows WinDbg + !exploitable is one of fast analyze options.
it is here
Additionally I use WinDbg + !analyze to determine standard name ...
- 281
2
votes
Fuzzing Adobe Reader - Exploit Development
The best thing you can do is to learn how to read assembly. Start at the crash, see what type of memory is being used, values in registers, and previous instructions. Learn how to use windbg. Taint ...
- 21
2
votes
Fuzzing Adobe Reader - Exploit Development
First of all you should write script to lower the difference between your mutated(fuzzed) file and original in order to know the main byte/bytes that make program crash. This would be a byte by byte ...
- 41
2
votes
blackbox vulnerability assessment
Peach Fuzzer performs automated exploitability analysis. Though I haven't used it myself and can't say whether or not it's any better than !exploitable.
If neither Peach Fuzzer nor !exploitable meets ...
- 20.4k
2
votes
How to connect to embedded device via charge-only USB?
The only way to know whether you can or cannot use the USB port to have access to the device is by probing the Data pins and trying to sniff any traffic.
A USB connector is composed of 4 pins : USB ...
- 2,603
2
votes
What kind of fuzzer can i use?
It doesn't work like that.
As you might know, bugs are worth money. The main reason for tgis is at it requires both skill and time to find these bugs.
Clearly you want to learn this skill, so in the ...
- 2,265
2
votes
The Nokia CA-50 cable has a longer USB port. Does it hide any kind of chip?
Older Nokia phones use a serial (db-9) cable so if this cable supports flashing it likely includes a usb to serial converter (eg ftdi chip)
- 2,908
2
votes
Accepted
Decompiler attack
I guess that you won't be happy if, while analyzing a malware, a certain pattern in the executable binary makes Hex-rays connect to an evil server somewhere in the World with your account and download ...
- 18k
2
votes
Why stack canary can be brute-force one byte at a time?
A common mistake, while programming a server, is to use a fork() to start it and respawn it when it crashes.
The problem with a fork() is that is uses a copy of the memory to start over. Of course, ...
- 18k
1
vote
Accepted
MIPS Router Firmware
Start by looking for unsafe functions (e.g. strcat, strcpy, sprintf, etc.) that may result in memory corruption vulnerabilities. This can be done by hand by browsing xrefs to function usages in the ...
- 531
1
vote
Understanding the variables in stack layout
Look at the place where sprintf is called and you should see the arguments being pushed in the correct order.
The variables listed here are local variables of the function manage_request and not its ...
- 34.6k
1
vote
The Nokia CA-50 cable has a longer USB port. Does it hide any kind of chip?
If there is any chip inside the cable, it will use the 5v line as power supply. So, you have to measure resistance from gnd to 5v and compare it with another cable. Usually, the resistance is so high ...
- 21
1
vote
Need advice : Reverse engineering a pdf with shellcode
The answer by extreme coders was wonderful,i wish to share my method too over here:
I convert it to an executable with the tools in REMnux:
remnux@remnux:~$ unicode2hex-escaped < sc.txt > sc2....
Only top scored, non community-wiki answers of a minimum length are eligible