An Egghunter is basically a low size stub that acts as a first stage in a 2 stage exploitation attempt (whereas second stage is usually the malicious payload shellcode). In the first stage, the stub will search through the process VAS (Virtual Address Space) for the second stage payload that is input/injected elsewhere of the same process memory. Once found, transfer control to the second stage of the exploitation.
In an x86 system, the VAS is of size 4294967296 bytes or around 4Gb. It is relatively easier to scan through the entire process VAS of size 4Gb.
Now in an x86_64 system the VAS size is up to 16.8 million Tb (Terabytes). Finding an egg within such memory is indeed trying to find a needle in a haystack.
Does this make the egghunter exploitation technique irrelevant in an x86_64 system? Because it can be proved to be very difficult to find the egg label and execute the payload without actually knowing the exact real time location of the injected egg + payload
Difficulties such as:
- searching through that much memory could take days/weeks
- UB when system calls are repeated for [millions x (Tb)] iterations
- Segfault when #2 occurs
So does an egghunter attack still make sense in a real attack on a 64 bit system, at least without knowing the exact location in memory of the injected second stage payload?