New answers tagged dep
1
Yes, absolutely, of course it is possible to use gadgets that are from the executable itself. You can use any code that is mapped into the address space of the program in executable form (i.e., where it's possible to execute the code -- if the system is using DEP, this excludes anything that has the non-executable bit set). That includes the original ...
1
I believe the reason is "it's easiest to use instruction sequences from the libraries, because the libraries are so common and they've already been scanned."
There are just a handful of Microsoft-provided C-runtime library files. If they provide a complete enough instruction set, why work harder?
Top 50 recent answers are included
