I was following the CoreLan Exploit writing Tutorial Part 1.

OS used: Windows XP SP3

I tried to use “C:\Program Files\Easy RM to MP3 Converter\MSRMCcodec02.dll” for the instruction “jmp esp” [ff e4] but the address of the dll [and hence the instructions getting executed] changes in each run.

  1. Why is this happening?
  2. Someone suggested that this is caused by Rebasing of DLLs. I'm not sure hire this can be resolved. Can this be solved by changing the base address of the DLL?
  3. How can I continue with the tutorial?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.