Timeline for How to find buffer offset for Return to Libc Attack
Current License: CC BY-SA 4.0
4 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 8, 2020 at 15:38 | comment | added | multithr3at3d | For the final part of where to put X, Y, and Z, see my other answer: security.stackexchange.com/a/229449/90657 | |
| Apr 8, 2020 at 15:30 | comment | added | multithr3at3d | A better way to implement this is to use a non-repeating sequence, like: en.m.wikipedia.org/wiki/De_Bruijn_sequence. Then, run it with your debugger and see what offset it crashes at. Some exploit dev GDB add-ons provide built-in tools to do this. | |
| Apr 8, 2020 at 15:28 | comment | added | multithr3at3d | Does this work on x64 binaries? On x86_64, the CPU won't actually make the jump unless the address in the stack pointer is a valid program address. | |
| Apr 2, 2020 at 2:58 | history | answered | positron | CC BY-SA 4.0 |