Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am new to structured exception handling based exploits.

Why don't we put our return address directly in SE handler to jump to our shellcode? (with no safe SEH)

Can anybody explain the reason of using pop pop ret?

I read something that said SEH bypasses ASLR and DEP, but how?

Our shellcode will be located on the stack and since the stack will be still non-executable, how is DEP bypassed?

share|improve this question
I have strong suspicion that you're talking about ROP (Return-Oriented-Programming) rather than SEH. SEH is just a way to pass control without being detected by static approaches. And yes, you're correct DEP would still trigger if you pass control to stack-located exploit by SEH. ROP bypasses DEP because it doesn't have any code to put on stack. Dangling pointers based attacks can defeat ASLR. SEH could be combined with either of them independently as an additional measure. – Van Jone Oct 5 '13 at 23:48

Using SEH to achieve exploitation defeats neither DEP nor ASLR.

In particular, DEP will mitigate execution of shellcode off the stack memory page which, ultimately, it was what an SEH based exploit is trying to achieve.

Without a non-ASLR module in the process spacing being used to locate the SEH exploits key POP POP RET, ASLR remains to further impede exploitation.

As Van Jone suggested in his comment, ROP (and an info leak for module base address discovery) are necessary for DEP and ASLR defeat.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.