I am curious as to why heap spraying consists of allocating repeated chunks of NOP + Shellcode? Why is the format not repeating NOP and then just Shellcode at the end; when the stack pivot occurs wouldn't EIP just slide down the sled until it hits the shellcode? In addition, in a Heap Spray a predictable address seems to always be chosen to pivot too, so the repetition of chunks seems unnecessary.

  • 2
    I don't actually think there is much difference or up-side. They both accomplish the same thing (provide a point to jump from code to memory to execute code.) so it might just be a matter of preference? – sethmlarson Jan 21 '16 at 13:22

The point of a spray is that you don't always know exactly which block your object was allocated to. I believe it's because how volatile the heap can be. At any given time a block of memory could be allocated, and your NOP sled/shellcode could be interrupted.

You see examples with predictable addresses because it makes it easier to learn the concept, but in the wild ASLR will randomize where the heap is laid out. So you need to be as robust as possible.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.