Tag Info

Hot answers tagged

7

The x86-compatible CPU are aptly named: they are compatible with each other. This means that the same OS code will work on all of them. So, from the point of view of the code which runs on the processor (which includes the operating system itself), things do not vary (much) depending on the brand. Things change depending on the generation: the newer systems ...


5

Why would you need a specific FP ? The saved FP is there to be loaded back into the corresponding register by the vuln() function when it exits; but that function does not access it in any way, so it could have any value. The loading back of FP is for the benefit of whatever code will execute immediately afterwards: normally the caller of vuln() (who wants ...


4

Very precise timing information is very helpful when doing side-channel attacks. Some famous example (in lab conditions) include stealing an encryption key used by some other process, on data we do not see (neither cleartext nor ciphertext). This can work on detection of L1 cache misses, or of jump (mis)prediction in the CPU. Forbidding access to the cycle ...


2

You should look at the BlackHat talk ARM Exploitation ROPmap. In short you can find ROP gadgets with any assembler variant, just the rules are a little different for ARM. Before tools like mona we used objdump and grep!


2

If you are having an issue with null bytes, then try to encode the shellcode before using to eliminate the null bytes. I assume you have got metasploit and able to use the encoder. Here is how it works. shell = (" \x77\x... your shellcode") file = open('shellcode.bin','w') file.write(shell) file.close() or you can also use echo -e "shellcode" >> ...



Only top voted, non community-wiki answers of a minimum length are eligible