50
votes
Accepted
I feel like it's impossible to learn reverse engineering
So let me preface this with "I'm not implying you're a child"
Often when I teach kids about CIS and they hear what I do for a living, the first question is
"How do I hack?"
I'll tell you the same ...
- 1,451
34
votes
Accepted
What does EIP stand for?
EIP is a register in x86 architectures (32bit). It holds the "Extended Instruction Pointer" for the stack. In other words, it tells the computer where to go next to execute the next command and ...
- 5,165
24
votes
Accepted
How are code-branch side channel attacks mitigated on Java?
While you can make some attempt towards constant-time code in general purpose JITed languages like Java, you generally run into some problems:
The runtime implementation is, generally, intended to be ...
- 134k
19
votes
What does EIP stand for?
One of the basic things that a computer needs to keep track of is where in memory are located the instructions currently being executed.
This is normally done by the CPU using what is often known as ...
- 7,755
11
votes
I feel like it's impossible to learn reverse engineering
Reverse engineering is fun. I use IDA once every other week, so I am not an expert in the field but do it often enough. If you want to understand reverse engineering you need to know how to engineer ...
- 3,002
7
votes
Accepted
How can Malware authors be determined?
Mainstream media reporting is not the place to go for this kind of stuff. If you look up Symantec's report you'll get a lot more detail. They claim that WannaCry is probably authored by an outfit ...
- 1,396
7
votes
What assembly should I learn?
My advice would be to first learn MIPS to wrap your head around how exactly heap and stack and OS calls work and then move on to x86 since you want to focus on developing malware for Windows.
EDIT: ...
- 512
6
votes
Accepted
Why would legitimate programs have a `jmp esp` instruction?
The instruction jmp esp is encoded as FF E4. It’s not necessary to find an actual jmp instruction, just those bytes in the middle of any other code or data.
This is the basis for return oriented ...
- 724
6
votes
Why does my stack contain the return address to __libc_csu_init after main is initialised?
Your main function contains pointer to __libc_csu_init just before its return pointer, because that's how stack frame works;
before entering a function, caller pushes a stack frame pointer and a ...
5
votes
Accepted
Buffer overflow: Why does the ESP Register change its value after access violation
As you correctly pointed out ESP always points at the top of the stack. Also stack overflows occur due to an overflow of a buffer on the stack (not due to an overflow of lets say a malloc-allocated ...
- 605
4
votes
How to bypass ASLR with ROP
I agree it is very poorly explained in the article. It took me several reads to understand what on earth was going on.
The key part is here:
Our aim now is to build a chained ROP to execute execve(). ...
- 134k
4
votes
Accepted
Mov byte to addres inside a register
rdi points to rri_shellcode+1. This is located in the .text segment which is not writable by default, thus causing the segmentation fault.
You can link it using the ld -N option if you really need ....
- 534
4
votes
Accepted
Segmentation fault error when calling user defined function in shellcode
As Joshua said, just mov(e) the address of the target function into a register and call that regsiter. Assemble that and use its opcodes, because you need a shellcode(opcodes) that would be executed, ...
- 56
4
votes
Accepted
What lies behind this complicated shellcode on linux?
If you have tried shellcode before which relies on absolute addresses, then that
could explain the crashes. This shellcode survives because it uses call to
obtain the absolute stack pointer address ...
- 6,038
4
votes
Accepted
How to detect suspicious content in a TrueType Font (.ttf) font file
This is an interesting question. Font files are like other media files which might be abused by malware or within exploiting attempts.
Detecting malicious blocks in such media files would follow a ...
- 1,090
4
votes
Buffer Overflow doesn't have enough space for exploit after being crashed
Assuming that you're talking about a vanilla EIP overwrite and not something like SEH, you have two options available to you. Neither of these are what I would consider to be "beginner" techniques as ...
- 9,227
4
votes
is it possible to craft exploits for non-open source C/C++ software without fuzzing?
Yes, it's completely possible. You can read through all of the assembly, determine what conditions are not accounted for, and then exploit them. In fact, even when using fuzzing, you will need to ...
- 3,322
4
votes
Accepted
Running a brief asm script inline for dynamic analysis
Is there a reason you can't just study the code? 30 lines of ASM should be easy to understand. Just add comments explaining what each line does, and you'll understand it in no time. This will be even ...
- 66.3k
4
votes
Accepted
How does this simple buffer overflow work?
That's due to an alignment to 16 bytes, which compilers do on x86(_64) for compatibility with SIMD instructions that operate on 128 bits (16 bytes). Due to that there is some "padding" between the ...
- 1,389
4
votes
Problem with overwriting the return address (buffer overflow)
It is not rbp what you have to control, but the instruction pointer rip. When the function returns, ret instruction will take whatever is at the top of the stack and send execution there. So, notice ...
- 153
3
votes
Accepted
C - Simple Buffer Overflow Exploitation, how is the EIP overwritten in different type calling functions?
My guess is that you overwrote other local variables (i or sending_str) and thus caused premature crash.
You will have to look at the generated code to see what’s going on. Depending on settings the ...
- 1,111
3
votes
Accepted
Curious about Microsoft "Buffer Security Check" implementation
The goal of the stack canary is to protect the program from a buffer overflow. The canary is made dynamic, a new one is used on each execution, and, an attacker will only have one attempt for guessing ...
- 18.6k
3
votes
Is it "normal" to find procedures in the middle of a .mov file with a disassembler?
It is kind of cool because the code is way too organized to just be random data.
The only thing that makes this credible is the large amount of x86 jump-like 'opcodes' in the video (7a-7f). What ...
- 4,803
3
votes
I feel like it's impossible to learn reverse engineering
Stop wasting your time with books and videos. Get some program you want to reverse (like a game you want to hack), get your tools for static/dynamic analysis (cheat engine is great for starting if you'...
- 31
3
votes
How are code-branch side channel attacks mitigated on Java?
The best way to mitigate branch side-channel attacks in Java is to completely eliminate branches that depend on secret data. Do all your work using simple arithmetic (=, +, -, *, <<, >>, &...
- 263
3
votes
Linux x86_64 Assembly works standalone, but Segfaults when ran as shellcode in C
This line seems to describe what actually killed it.
--- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0xfffffffffffffffc} ---
It's attempting to access something at 0xfffffffffffffffc, and ...
- 201
2
votes
Accepted
ROP Programming/Exploitation on ARM - Gadget chain
I didn't glance long, but using the 1 + 0x59554 : pop {r0, r1, r2, r6} result from xrop, and the 0x00042d00 : pop {r3, pc} result from ROPgadget, have you tried fitting this in your ROP stack?
page +=...
- 94
2
votes
Why can't reverse engineering be automated?
I have yet to find a paper or a software that completely automates reverse engineering, but there are some fields that are particularly interested in reverse engineering automation, like forensic ...
- 121
2
votes
Can anyone explain what Ret2plt means and how it works?
In short, jump to the address of the PLT entry for the function = call the function.
Ret2plt is a similar concept to Ret2libc regarding DEP. DEP/Data Execution Protection works by making some memory ...
- 450
2
votes
Shellcode doesn't execute despite correct address on EIP
The stack is probably non-executable. Compile the vulnerable program like this to disable the protection:
gcc -z execstack -o program program.c
- 534
Only top scored, non community-wiki answers of a minimum length are eligible