Tag Info

New answers tagged


Because of my project design, I can't check more than one packet . Can you please advise if just checking client hello like above is ok or not ? If you don't expect the client to circumvent your detection it might be enough to check for typical bytes at the beginning of the client hello inside the first packet you get. But, if you would use this to ...


Instead of: A = 0 and 256*X+Y = 256*B+C+4 should not be: A = 0 and 256*Y+Z = 256*B+C+4 ?


The text segment is not typically randomized in ASLR implementations, and this is why Return-Oriented Programming (ROP) chains work. The idea is that the application's own code should be 'safe', so randomizing this memory space would be a waste of resources. ROP chains are about building a malicious payload using the application's own functionality. A ...

Top 50 recent answers are included