はてなブックマーク

Exploit writing tutorial part 10 : Chaining DEP with ROP – the Rubik’s[TM] Cube Table of Contents Introduction Hardware DEP in the Win32 world Bypassing DEP – Building blocks What are our options ? The gadget Windows function calls to bypass DEP Choose your weapon Function parameters & usage tips ROP Exploit transportability From EIP to ROP Direct RET SEH based Before we begin Direct RET – The ROP

Introduction Ok, I have a confession to make, I have always been somewhat intrigued by egghunters. That doesn’t mean that I like to use (or abuse) an egghunter just because I fancy what it does. In fact, I believe it’s a good practise to try to avoid egghunters if you can, as they tend to […]