Skip to main content
51 votes
Accepted

I feel like it's impossible to learn reverse engineering

So let me preface this with "I'm not implying you're a child" Often when I teach kids about CIS and they hear what I do for a living, the first question is "How do I hack?" I'll tell you the same ...
DotNetRussell's user avatar
34 votes
Accepted

What does EIP stand for?

EIP is a register in x86 architectures (32bit). It holds the "Extended Instruction Pointer" for the stack. In other words, it tells the computer where to go next to execute the next command and ...
HashHazard's user avatar
  • 5,185
24 votes
Accepted

How are code-branch side channel attacks mitigated on Java?

While you can make some attempt towards constant-time code in general purpose JITed languages like Java, you generally run into some problems: The runtime implementation is, generally, intended to be ...
Polynomial's user avatar
  • 135k
20 votes

What does EIP stand for?

One of the basic things that a computer needs to keep track of is where in memory are located the instructions currently being executed. This is normally done by the CPU using what is often known as ...
user's user avatar
  • 7,805
12 votes

I feel like it's impossible to learn reverse engineering

Reverse engineering is fun. I use IDA once every other week, so I am not an expert in the field but do it often enough. If you want to understand reverse engineering you need to know how to engineer ...
Joe M's user avatar
  • 3,012
7 votes
Accepted

How can Malware authors be determined?

Mainstream media reporting is not the place to go for this kind of stuff. If you look up Symantec's report you'll get a lot more detail. They claim that WannaCry is probably authored by an outfit ...
David's user avatar
  • 1,416
7 votes

What assembly should I learn?

My advice would be to first learn MIPS to wrap your head around how exactly heap and stack and OS calls work and then move on to x86 since you want to focus on developing malware for Windows. EDIT: ...
Gillian's user avatar
  • 512
7 votes

Why does my stack contain the return address to __libc_csu_init after main is initialised?

Your main function contains pointer to __libc_csu_init just before its return pointer, because that's how stack frame works; before entering a function, caller pushes a stack frame pointer and a ...
Daniel 0xdbeef Zalega's user avatar
6 votes
Accepted

Why would legitimate programs have a `jmp esp` instruction?

The instruction jmp esp is encoded as FF E4. It’s not necessary to find an actual jmp instruction, just those bytes in the middle of any other code or data. This is the basis for return oriented ...
David's user avatar
  • 744
5 votes
Accepted

Buffer overflow: Why does the ESP Register change its value after access violation

As you correctly pointed out ESP always points at the top of the stack. Also stack overflows occur due to an overflow of a buffer on the stack (not due to an overflow of lets say a malloc-allocated ...
game0ver's user avatar
  • 615
5 votes
Accepted

How to detect suspicious content in a TrueType Font (.ttf) font file

This is an interesting question. Font files are like other media files which might be abused by malware or within exploiting attempts. Detecting malicious blocks in such media files would follow a ...
Marc Ruef's user avatar
  • 1,130
4 votes
Accepted

What lies behind this complicated shellcode on linux?

If you have tried shellcode before which relies on absolute addresses, then that could explain the crashes. This shellcode survives because it uses call to obtain the absolute stack pointer address ...
Lekensteyn's user avatar
  • 6,088
4 votes

How to bypass ASLR with ROP

I agree it is very poorly explained in the article. It took me several reads to understand what on earth was going on. The key part is here: Our aim now is to build a chained ROP to execute execve(). ...
Polynomial's user avatar
  • 135k
4 votes
Accepted

Mov byte to addres inside a register

rdi points to rri_shellcode+1. This is located in the .text segment which is not writable by default, thus causing the segmentation fault. You can link it using the ld -N option if you really need ....
rhodeo's user avatar
  • 544
4 votes
Accepted

Segmentation fault error when calling user defined function in shellcode

As Joshua said, just mov(e) the address of the target function into a register and call that regsiter. Assemble that and use its opcodes, because you need a shellcode(opcodes) that would be executed, ...
Rahul Maini's user avatar
4 votes

Buffer Overflow doesn't have enough space for exploit after being crashed

Assuming that you're talking about a vanilla EIP overwrite and not something like SEH, you have two options available to you. Neither of these are what I would consider to be "beginner" techniques as ...
DKNUCKLES's user avatar
  • 9,217
4 votes

I feel like it's impossible to learn reverse engineering

Stop wasting your time with books and videos. Get some program you want to reverse (like a game you want to hack), get your tools for static/dynamic analysis (cheat engine is great for starting if you'...
Icaro10100's user avatar
4 votes

is it possible to craft exploits for non-open source C/C++ software without fuzzing?

Yes, it's completely possible. You can read through all of the assembly, determine what conditions are not accounted for, and then exploit them. In fact, even when using fuzzing, you will need to ...
Dan Landberg's user avatar
  • 3,322
4 votes
Accepted

Running a brief asm script inline for dynamic analysis

Is there a reason you can't just study the code? 30 lines of ASM should be easy to understand. Just add comments explaining what each line does, and you'll understand it in no time. This will be even ...
forest's user avatar
  • 67k
4 votes
Accepted

How does this simple buffer overflow work?

That's due to an alignment to 16 bytes, which compilers do on x86(_64) for compatibility with SIMD instructions that operate on 128 bits (16 bytes). Due to that there is some "padding" between the ...
ecdsa's user avatar
  • 1,444
4 votes

Problem with overwriting the return address (buffer overflow)

It is not rbp what you have to control, but the instruction pointer rip. When the function returns, ret instruction will take whatever is at the top of the stack and send execution there. So, notice ...
user25972's user avatar
  • 153
4 votes
Accepted

Memory address problem in GNU Debugger

This is because your program was compiled as a position independant executable (PIE). Instead of the addresses being hardcoded into the binary, they are only stored as offsets from 0, which explains ...
multithr3at3d's user avatar
3 votes
Accepted

C - Simple Buffer Overflow Exploitation, how is the EIP overwritten in different type calling functions?

My guess is that you overwrote other local variables (i or sending_str) and thus caused premature crash. You will have to look at the generated code to see what’s going on. Depending on settings the ...
manduca's user avatar
  • 1,111
3 votes
Accepted

Curious about Microsoft "Buffer Security Check" implementation

The goal of the stack canary is to protect the program from a buffer overflow. The canary is made dynamic, a new one is used on each execution, and, an attacker will only have one attempt for guessing ...
Ángel's user avatar
  • 19k
3 votes

Can anyone explain what Ret2plt means and how it works?

In short, jump to the address of the PLT entry for the function = call the function. Ret2plt is a similar concept to Ret2libc regarding DEP. DEP/Data Execution Protection works by making some memory ...
flerb's user avatar
  • 460
3 votes

Is it "normal" to find procedures in the middle of a .mov file with a disassembler?

It is kind of cool because the code is way too organized to just be random data. The only thing that makes this credible is the large amount of x86 jump-like 'opcodes' in the video (7a-7f). What ...
J.A.K.'s user avatar
  • 4,853
3 votes

How are code-branch side channel attacks mitigated on Java?

The best way to mitigate branch side-channel attacks in Java is to completely eliminate branches that depend on secret data. Do all your work using simple arithmetic (=, +, -, *, <<, >>, &...
Nayuki's user avatar
  • 263
3 votes

Linux x86_64 Assembly works standalone, but Segfaults when ran as shellcode in C

This line seems to describe what actually killed it. --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0xfffffffffffffffc} --- It's attempting to access something at 0xfffffffffffffffc, and ...
David A's user avatar
  • 226
2 votes

Shellcode doesn't execute despite correct address on EIP

The stack is probably non-executable. Compile the vulnerable program like this to disable the protection: gcc -z execstack -o program program.c
rhodeo's user avatar
  • 544
2 votes
Accepted

ROP Programming/Exploitation on ARM - Gadget chain

I didn't glance long, but using the 1 + 0x59554 : pop {r0, r1, r2, r6} result from xrop, and the 0x00042d00 : pop {r3, pc} result from ROPgadget, have you tried fitting this in your ROP stack? page +=...
dreamist's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible