Timeline for Why append an nop sled at the end of the shellcode?
Current License: CC BY-SA 3.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 1, 2018 at 4:37 | comment | added | Filipe Rodrigues | Expanding a bit on the second bullet: I have seen some encoded shellcodes using the stack for some operations, so make sure you know what your shellcode / encoder is doing. | |
| Oct 10, 2016 at 18:13 | comment | added | OrangeDog | If you've written the shellcode then you should know whether it needs some minimum "allocation" of working memory, but you still won't know the size of the buffer you're trying to overflow. | |
| Aug 12, 2016 at 10:23 | comment | added | S7_0 | @DKNUCKLES imagine I have a buffer[100], so if I want to exploit an buffer overflow, I need to overwrite the RBP and save RIP (so 100 + 8 bytes) as follow 58 bytes of nop sled + 50 byte of shellcode + address of the nop sled...So why it doesn't work as above even if I respected the specific size ? Why does it work only if I do something like 26 byte of nop sled + 50 byte of shellcode + 26 byte of another nop sled + addres of the nop sled ? Thanks | |
| Aug 11, 2016 at 19:51 | comment | added | DKNUCKLES |
@S7_0 Because the buffer length of an application might be a specific length in which case you pad to make up for a small shellcode, or you need some space for the shellcode to expand for execution. I always go JUNK (or nops) + RETN ADDRESS + SHELLCODE + NOPS
|
|
| Aug 11, 2016 at 19:20 | comment | added | S7_0 | @DKNUCKLES Thank you for you answer, so if I understand, I just need to append another extra nops instruction at the end of buffer overflow... that's all ? I would like to understand why it doesn't work without the extra nops instruction | |
| Aug 11, 2016 at 18:33 | comment | added | Abhinav Das | I don't know about your second point, but yes, the most common reason I come across is the reason given in your first point. :) | |
| Aug 11, 2016 at 17:20 | history | answered | DKNUCKLES | CC BY-SA 3.0 |