7 votes
Accepted

Cannot locate a variable on the stack

The reason the you are unable to locate text1 on the program runtime stack is that during runtime text1 is in the data segment of the process running in virtual memory, not the stack. In order for a ...
julian's user avatar
  • 7,078
3 votes
Accepted

does arbitrary kernel read write from usermode count as a vulnerability if it requires admin

Generally this would not be considered a vulnerability, no. You aren't giving details, so I cannot speak for your specific case. You don't even mention the operating system [1]. Why? A hypothetical ...
0xC0000022L's user avatar
  • 10.9k
3 votes
Accepted

someone can help me recognize the vulnerability

The bug is in update_volume. pglobal_data -> radio_data.speakers_volume[index] = new_volume; index is an int, it can take negative values too. Ideally you should not be able to access -ve indices ...
sudhackar's user avatar
  • 2,629
3 votes

Fuzzing Adobe Reader - Exploit Development

There are good answers to your question here. However, I wanted to give you my opinion. Root cause analysis, over all, is best done half-manually. One of the reasons is that techniques like Dynamic ...
joxeankoret's user avatar
  • 4,470
2 votes

What kind of fuzzer can i use?

It doesn't work like that. As you might know, bugs are worth money. The main reason for tgis is at it requires both skill and time to find these bugs. Clearly you want to learn this skill, so in the ...
Stolas's user avatar
  • 2,321
2 votes

The Nokia CA-50 cable has a longer USB port. Does it hide any kind of chip?

Older Nokia phones use a serial (db-9) cable so if this cable supports flashing it likely includes a usb to serial converter (eg ftdi chip)
Remko's user avatar
  • 3,208
2 votes
Accepted

Decompiler attack

I guess that you won't be happy if, while analyzing a malware, a certain pattern in the executable binary makes Hex-rays connect to an evil server somewhere in the World with your account and download ...
perror's user avatar
  • 18.9k
2 votes

Why stack canary can be brute-force one byte at a time?

A common mistake, while programming a server, is to use a fork() to start it and respawn it when it crashes. The problem with a fork() is that is uses a copy of the memory to start over. Of course, ...
perror's user avatar
  • 18.9k
1 vote
Accepted

MIPS Router Firmware

Start by looking for unsafe functions (e.g. strcat, strcpy, sprintf, etc.) that may result in memory corruption vulnerabilities. This can be done by hand by browsing xrefs to function usages in the ...
multithr3at3d's user avatar
1 vote

Understanding the variables in stack layout

Look at the place where sprintf is called and you should see the arguments being pushed in the correct order. The variables listed here are local variables of the function manage_request and not its ...
Igor Skochinsky's user avatar
  • 36.4k
1 vote

The Nokia CA-50 cable has a longer USB port. Does it hide any kind of chip?

If there is any chip inside the cable, it will use the 5v line as power supply. So, you have to measure resistance from gnd to 5v and compare it with another cable. Usually, the resistance is so high ...
Alex's user avatar
  • 21

Only top scored, non community-wiki answers of a minimum length are eligible