209 reputation
25
bio website
location
age
visits member for 1 year, 10 months
seen Apr 10 '13 at 18:31

Oct
29
comment SafeSEH and x64
Ah now I got it, thank you!
Oct
23
comment Do I always have to overwrite EIP to get to write on the stack in a buffer overflow?
Why do I see something like "EIP: 0c0c0c0c" when the debugger get fired up? Is the debugger alerting me that EIP was trying to jump to 0c0c0c0c ?
Oct
22
comment How “leaking pointers” to bypass DEP/ASLR works
I agree with you, but the "being able to read" part is a bit mysterious to me.. let's suppose that I overflowed a buffer, that I know that there's a reliable pointer location on the stack... how do I read it or even reach it with a RET? I don't know any RET address nor can I rely on one because of ASLR
Oct
22
comment How “leaking pointers” to bypass DEP/ASLR works
I got the pwn2own one, nice. But I still can't figure out how to use these "dangling pointers".. how am I supposed to "read" the address where that pointer points to know the offset from the base and build my rop gadgets?