10 votes
Accepted

Need advice : Reverse engineering a pdf with shellcode

The shellcode is unicode escaped. You can convert it to its hex representation using a simple python script. from binascii import unhexlify as unhx encoded = open('encoded.txt').read() # The ...
user avatar
  • 5,850
7 votes
Accepted

Cannot locate a variable on the stack

The reason the you are unable to locate text1 on the program runtime stack is that during runtime text1 is in the data segment of the process running in virtual memory, not the stack. In order for a ...
user avatar
  • 6,819
6 votes
Accepted

When to use Windbg and Ollydbg?

Even the free version of IDA Pro is worth having. Finding the general structure of an unknown binary is much easier with it than with anything else. If you have an unknown DLL, it will show you which ...
user avatar
6 votes
Accepted

How can a format string vulnerability be used to write a specific string into memory?

It's a lot of questions, here are a few answers: How can we write something in memory with a format string vulnerability ? For this, you need to know two specific features used in the printf format ...
user avatar
  • 18k
5 votes
Accepted

Reading Memory to bypass ASLR

this is how a BSTR represented in memory: Length Data string Terminator so an attacker will try to get an aligned heapspray and then trigger a vulnerability that will modify the Length part of a ...
user avatar
  • 66
5 votes
Accepted

Detecting weaknesses/vulnerabilities (in games). Scientific papers/Tutorials?

The approach to finding security vulnerabilities in games is no different than the approach to finding security vulnerabilities in other applications. As discussed here, "Most vulnerabilities in ...
user avatar
5 votes
Accepted

Analyzing a use-after-free bug (taint analysis?)

I would agree with you in that you need to implement some kind of taint tracing, what is tricky statically. Moreover, you need to know whether there are any constraints applied to your controlled ...
user avatar
4 votes

When to use Windbg and Ollydbg?

WinDbg uses debugging information (pdb/symbol files) for debugging. So ,for example say I get a unknown exe (malicious) can I debug it since I'll not be having its .pdb Yes. Symbols are one of Windbg'...
user avatar
  • 402
4 votes

How exploit writers find bugs in Java Machine?

Lots of Java exploits revolve around bypassing the Java sandbox, the Security Manager in Java parlance. Sami Koivu published a lot of interesting work around Java security and exploits, notably his 3 ...
user avatar
  • 2,158
3 votes
Accepted

someone can help me recognize the vulnerability

The bug is in update_volume. pglobal_data -> radio_data.speakers_volume[index] = new_volume; index is an int, it can take negative values too. Ideally you should not be able to access -ve indices ...
user avatar
  • 2,315
3 votes

Fuzzing Adobe Reader - Exploit Development

There are good answers to your question here. However, I wanted to give you my opinion. Root cause analysis, over all, is best done half-manually. One of the reasons is that techniques like Dynamic ...
user avatar
  • 4,305
3 votes

Run multiple instances of same application - Adobe Reader

Adobe Reader uses the following two methods to determine if another instance is running: CreateSemaphoreW(NULL, 0, 1, L"Acrobat Viewer") followed by GetLastError() == ERROR_ALREADY_EXISTS FindWindowW(...
user avatar
3 votes
Accepted

Use After Free - Example

The first thing that comes to my mind is for you to create a class with a few virtual methods, which will be used as the test subject. Then from your ActiveX control you'd expose methods that ...
user avatar
3 votes
Accepted

Help with identifying race condition in wargame

Hmm this code will probably not work if optimized because the shared globals are not pointers nor are they marked as volatile. This means that the compiler is free to assume the globals are accessed ...
user avatar
2 votes
Accepted

Do you have tips analyzing reported PoC(exploit) files?

First, your platform is very important ( mine is Windows ) In Windows WinDbg + !exploitable is one of fast analyze options. it is here Additionally I use WinDbg + !analyze to determine standard name ...
user avatar
  • 281
2 votes

Fuzzing Adobe Reader - Exploit Development

The best thing you can do is to learn how to read assembly. Start at the crash, see what type of memory is being used, values in registers, and previous instructions. Learn how to use windbg. Taint ...
user avatar
2 votes

Fuzzing Adobe Reader - Exploit Development

First of all you should write script to lower the difference between your mutated(fuzzed) file and original in order to know the main byte/bytes that make program crash. This would be a byte by byte ...
user avatar
2 votes

blackbox vulnerability assessment

Peach Fuzzer performs automated exploitability analysis. Though I haven't used it myself and can't say whether or not it's any better than !exploitable. If neither Peach Fuzzer nor !exploitable meets ...
user avatar
2 votes

How to connect to embedded device via charge-only USB?

The only way to know whether you can or cannot use the USB port to have access to the device is by probing the Data pins and trying to sniff any traffic. A USB connector is composed of 4 pins : USB ...
user avatar
  • 2,603
2 votes

What kind of fuzzer can i use?

It doesn't work like that. As you might know, bugs are worth money. The main reason for tgis is at it requires both skill and time to find these bugs. Clearly you want to learn this skill, so in the ...
user avatar
  • 2,265
2 votes

The Nokia CA-50 cable has a longer USB port. Does it hide any kind of chip?

Older Nokia phones use a serial (db-9) cable so if this cable supports flashing it likely includes a usb to serial converter (eg ftdi chip)
user avatar
  • 2,908
2 votes
Accepted

Decompiler attack

I guess that you won't be happy if, while analyzing a malware, a certain pattern in the executable binary makes Hex-rays connect to an evil server somewhere in the World with your account and download ...
user avatar
  • 18k
2 votes

Why stack canary can be brute-force one byte at a time?

A common mistake, while programming a server, is to use a fork() to start it and respawn it when it crashes. The problem with a fork() is that is uses a copy of the memory to start over. Of course, ...
user avatar
  • 18k
1 vote
Accepted

MIPS Router Firmware

Start by looking for unsafe functions (e.g. strcat, strcpy, sprintf, etc.) that may result in memory corruption vulnerabilities. This can be done by hand by browsing xrefs to function usages in the ...
user avatar
1 vote

Understanding the variables in stack layout

Look at the place where sprintf is called and you should see the arguments being pushed in the correct order. The variables listed here are local variables of the function manage_request and not its ...
user avatar
  • 34.6k
1 vote

The Nokia CA-50 cable has a longer USB port. Does it hide any kind of chip?

If there is any chip inside the cable, it will use the 5v line as power supply. So, you have to measure resistance from gnd to 5v and compare it with another cable. Usually, the resistance is so high ...
user avatar
  • 21
1 vote

Need advice : Reverse engineering a pdf with shellcode

The answer by extreme coders was wonderful,i wish to share my method too over here: I convert it to an executable with the tools in REMnux: remnux@remnux:~$ unicode2hex-escaped < sc.txt > sc2....
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible