I'm demonstrating an exploit for an old app.
Windows XP SP3 32bit (EN), the address of
SetProcessDEPPolicy() is usually
0x7C8622A4. I have that version of Windows (in English as well) and I've successfully built a ROP chain that brings me to exactly that place in memory with my return address to my shellcode and a
0 arguments neatly and correctly sitting on the stack.
But when trying to execute at that point I get
debugged program was unable to process exception in my debbuger or a
DEP exception when triggering the exploit outside of the debugger.
I'm wondering if it may be because of my patch level (I have the very latest patches). Has the address of
How can I manually find the address of that API function myself?
If the address of
SetProcessDEPPolicy() hasn't changed, why am I getting an exception?
The screenshot below shows the situation where I get the exception, as far as I can tell I've got everything where it should be and should be able to disable DEP instead of getting an error. There's comments on the screenshot and you can get a better resolution by right-click->view image.