5

As far as I know, it is possible to overwrite the unchanged part of the EIP to bypass ASLR protection. Unfortunately, I do not understand how this can help me in order to jump to the location of my exploit. I would need the address of a [JMP ESP] instruction in order to do so, but since the address will always vary, what's the idea behind partially overwriting the EIP?

Furthermore, this answer states that a non-ASLR module is required. How can some parts of the address be fixed and some change in a non-ASLR module?

1

With ASLR not the full address of instructions will vary but only some higher bytes. So for example Byte 1+2 are static but Byte 3+4 not. So the idea behind partially overwriting the EIP is to overwrite only the static bytes of an address to get a (limited) control of the execution flow.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.