Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [x86]

The processor architecture of most PCs and servers, including the 386/486/Pentium/… (IA-32) 32-bit family and the amd64 64-bit family. Most x86 processors are made by Intel or AMD.

-2
votes
0answers
45 views

How to execute x86 meterpreter shell?

In my local environment, I have downloaded 32 bit windows 7 machine x86 arch which is vulnerable to ms15-051 exploit in Metasploit, And I want meterpreter shell but I didn't find a way to get it, ...
7
votes
1answer
1k views

Why does my x86 shellcode test program segfault?

I am trying to learn how to create shellcode, my goal is to call execve(). I wrote the code in assembly and it works perfectly, there are no null-bytes or absolute addressing methods. The code works ...
0
votes
0answers
188 views

Overwriting return address — why not just save a copy?

In order to prevent stack buffer overflow attacks that overwrite the return address, why not just save a copy of the return address at the start of a function, and then load it back at the end? push ...
5
votes
2answers
426 views

Linux Kernel ROP - Returning to userland from kernel context?

I have a vulnerable Linux Kernel module (32-bit), which I can successfully exploit, and have gained privileges out of it. Basically, my exploit uses an ROP chain to disable SMEP, and directly jumps to ...
9
votes
1answer
3k views

Why are AMD processors not/less vulnerable to Meltdown and Spectre?

I’ve read up on Meltdown and Spectre and it’s not obvious to me why AMD would be less vulnerable. Do AMD processors simply not have speculative execution? Or do they have some way of not exploding the ...
3
votes
0answers
156 views

What is known about the latest vulnerability related to Linux Page Table Isolation patches? [duplicate]

Recently, on Hacker News front page, there was a post mentioning a new vulnerability that seems to affect Intel processors. The post is mostly speculation and there is no PoC or an exploit that I'm ...
4
votes
2answers
1k views

How to exploit variable's value

I'm trying to exploit a binary file which I have access to the source code. int flag = 0; int main() { char buf[0x50]; puts("Who are you? "); printf("> "); fgets(buf, 0x50, stdin);...
2
votes
2answers
2k views

Buffer Overflow doesn't have enough space for exploit after being crashed

So I'm trying to write a buffer overflow for a knowingly vulnerable server application, I want to learn how to do this on my own and just want some direction. I'm watching it in immunity debugger on ...
0
votes
1answer
845 views

BufferOverflow : ESP and access violation

The context : I have a small question regarding ESP and access violation. I just exploited a buffer overflow, with little space after ESP. So i did this : part 1 : NOP SLED part 2 : my shellcode : ...
2
votes
1answer
152 views

C library functions in statically linked ELF32 binary no longer use int 0x80

I've been practicing shell coding on Linux for a while. I used a VM to develop and test my shell code. The VM ran inside VMware workstation 12 pro, on Windows 10. Everything was fine and I could use ...
0
votes
0answers
434 views

Help with overflow return address

I'm trying to work through the modern binary exploitation course that was posted by RPI. I'm working on the shellcode lab and trying to understand something that's happening in the example code here (...
2
votes
1answer
99 views

ROP payload layout confusion

I was reading an article (exploitresearch.wordpress.com) about using ROP to bypass DEP/ASLR. Near the end he lays out the 33 steps for his payload. These are layed out in the order that the shellcode ...
4
votes
2answers
701 views

What lies behind this complicated shellcode on linux?

It's pretty much my first time playing around with a buffer overflow exploit. I've written a simple C program that is vulnerable to buffer overflows: #include <stdio.h> #include <stdlib.h>...
10
votes
2answers
579 views

Are memcpy() based race conditions exploitable for causing remote code execution?

Let’s say I have the following pseudocode in the trusted part of a sandbox which prevent untrusted code calling mprotect() and mmap() and ptrace() directly (mutext isn’t accessible from sandboxed ...
4
votes
1answer
1k views

Do fTPM implementations protect against physical attacks?

I see that there is an increasing number of PCs shipped with firmware based TPM (fTPM), e.g. the Intel NUC. As far as I understand, these solutions practically emulate a TPM chip using the CPUs ...
20
votes
2answers
6k views

What is known about the capabilities of AMD's Secure Processor?

I've found a fair amount of research about what Intel's ME does, including the "Intel x86 considered harmful (Chapter 4 is about ME)" survey paper by Joanna Rutkowska, but I'm having a much harder ...
4
votes
2answers
159 views

Is dereferencing a null pointer in C a security risk if the program isn’t a daemon, but a small script lauched as a separate process for each request?

The following code is part of a program that is spawned at every request by the nginx’s ruby on rails script : static void time_t_to_dos_time(time_t user_supplied_time_t, int *dos_date, int *dos_time)...
3
votes
2answers
1k views

Exploit a buffer overflow without SIGSEGV

For my studies I try to create a payload so that it overflows the buffer and calls a "secret" function called "target" This is the code I use for testing on an i686 #include "stdio.h" #include "...
2
votes
1answer
675 views

Is using IsBadReadPtr and IsBadWritePtr considered to be insecure?

I am auditing (reverse engineering) an x86 C++ application without source code. Static analysis revealed that the application is using the IsBadReadPtr and IsBadWritePtr Win32 functions in almost ALL ...
3
votes
1answer
207 views

Defeating ROP attacks in x86

Most defense techniques against ROP revolves around randomization, such as ASLR. If I mark all regions of memory, other than the code segment, non-executable, will this defeat ROP?
2
votes
1answer
214 views

Defeating code injection attacks in x86

In x86 systems, there are three requirements for a code injection attack to work: write attack payload to memory attack payload to be executable divert control-flow to payload How can we prevent 2) ...
7
votes
1answer
1k views

Return oriented programming without int 0x80

I have a program with a stack based buffer overflow. It is running PIE with ASLR and DEP, however there is a section of executable code that is at a fixed location. However, this region does not ...
0
votes
0answers
438 views

Stack buffer overflow: Is compiler changing variables order, preventing me to overwrite EIP properly?

I am learning about stack buffer overflow. A little info about my target: A x86 little endian intel-based computer, with a target compiled with TCC Compiler with no protections of any kind running on ...
3
votes
3answers
5k views

Program exiting after executing int 0x80 instruction when running shellcode

In school I was given an assignment to perform a buffer overflow, which would execute some shellcode and open a new shell. After a bit of fiddling the buffer overflow succeeded, and when I ran the ...
13
votes
4answers
2k views

Adding 65K buffer to protect from buffer overflows?

If you had a very complex and important function in C that you wanted to protect, would it be worth it to put a 65K buffer at the top of the stack to protect from buffer overflows? You would put your ...
16
votes
1answer
6k views

Return-oriented programming: how to find a stack pivot

I have a program with a heap overflow. It contains some code that is not randomized (is not using ASLR). I want to do a return-oriented programming exploit. Since this is a heap overflow, the first ...
4
votes
1answer
1k views

Occurence of ROP gadget

I'm researching various buffer overflow techniques, one I encounter and is pretty interested in the moment is Return Oriented Programming (ROP), and the use of small groups of instructions known as ...
9
votes
1answer
1k views

Better way to import Win32 APIs from injected shellcode

I'm injecting native x86 code into a .NET application, via a TLS callback in the binary image. Unfortunately, .NET executables only import mscorlib.dll within the PE, and have kernel32.dll mapped ...
6
votes
1answer
884 views

Hardware enforced DEP on different CPUs

Are there any differences how hardware DEP is implemented on CPUs from different manufacturers (Intel, AMD, nVidia, Texas,...)? Are there any significant differences how hardware DEP works on x86 ...
3
votes
2answers
1k views

Where can I find information about how to implement Intel embedded AES256 encryption?

I heard this can really speed up encryption performance, but I can't find any good information about how to implement it.