5

As far as I know, it is possible to overwrite the unchanged part of the EIP to bypass ASLR protection. Unfortunately, I do not understand how this can help me in order to jump to the location of my exploit. I would need the address of a [JMP ESP] instruction in order to do so, but since the address will always vary, what's the idea behind partially overwriting the EIP?

Furthermore, this answer states that a non-ASLR module is required. How can some parts of the address be fixed and some change in a non-ASLR module?

Improve this question
2

1 Answer 1

Reset to default
1

With ASLR not the full address of instructions will vary but only some higher bytes. So for example Byte 1+2 are static but Byte 3+4 not. So the idea behind partially overwriting the EIP is to overwrite only the static bytes of an address to get a (limited) control of the execution flow.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .