Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

As you may know this vulnerability was found a while ago in the wild and the exploit is available too, btw I'm having problem on understanding the obfuscated code. Is it necessary to use obfuscation and why the obfucation was used by the attacker? does attacker had specific reason to do this? the part of exploit I mean is located at line 292 of

share|improve this question
I'm half asleep right now, but this looks interesting. I'll dig around in it tomorrow. In the meantime, take a look at this previous question, in which I explain the hole. – Polynomial Oct 7 '12 at 0:14
I saw it before man. – n1kita Oct 7 '12 at 5:36
still no idea about it? – n1kita Oct 17 '12 at 18:35
Sorry, I've been quite busy recently and haven't got round to digging into it. However, I'm guessing that most of the data is just padding or values designed to pass sanity checks. I'll have a dig into it when I get time. – Polynomial Oct 18 '12 at 5:51

From what I can tell, the string YMjf\\u0c08\\u0c0cKDogjsiIejengNEkoPDjfiJDIWUAzdfghjAAuUFGGBSIPPPUDFJKSOQJGH in question is interesting. However, the use of \u0c08\u0c0c is the value of EDI after during the use after free. As for the rest of the string, it just looks like that is what was used in another person's 0-day before it was translated.

Some information was adapted from

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.