209 reputation
25
bio website
location
age
visits member for 1 year, 10 months
seen Apr 10 '13 at 18:31

Jul
27
awarded  Yearling
Jul
6
awarded  Nice Question
Apr
16
awarded  Notable Question
Jun
7
awarded  Popular Question
Oct
29
comment SafeSEH and x64
Ah now I got it, thank you!
Oct
29
accepted SafeSEH and x64
Oct
28
asked SafeSEH and x64
Oct
24
accepted Stack canaries protection and ROP
Oct
24
accepted How “leaking pointers” to bypass DEP/ASLR works
Oct
24
asked Stack canaries protection and ROP
Oct
23
awarded  Scholar
Oct
23
awarded  Supporter
Oct
23
accepted Do I always have to overwrite EIP to get to write on the stack in a buffer overflow?
Oct
23
comment Do I always have to overwrite EIP to get to write on the stack in a buffer overflow?
Why do I see something like "EIP: 0c0c0c0c" when the debugger get fired up? Is the debugger alerting me that EIP was trying to jump to 0c0c0c0c ?
Oct
23
asked Do I always have to overwrite EIP to get to write on the stack in a buffer overflow?
Oct
22
comment How “leaking pointers” to bypass DEP/ASLR works
I agree with you, but the "being able to read" part is a bit mysterious to me.. let's suppose that I overflowed a buffer, that I know that there's a reliable pointer location on the stack... how do I read it or even reach it with a RET? I don't know any RET address nor can I rely on one because of ASLR
Oct
22
comment How “leaking pointers” to bypass DEP/ASLR works
I got the pwn2own one, nice. But I still can't figure out how to use these "dangling pointers".. how am I supposed to "read" the address where that pointer points to know the offset from the base and build my rop gadgets?
Oct
22
awarded  Student
Oct
22
asked How “leaking pointers” to bypass DEP/ASLR works