Collaborate Disseminate
I’m practicing Buffer Overflows using Free Float FTP Server 1.0 on Windows 7 SP 1. I have done simple jmp esp examples on Windows XP, where system DLLs are without rebase or Address Space Layout Randomization (ASLR).
I’m now… Continue reading Buffer overflow return address with null byte, workaround
Several software packages on our SOE Windows machines come with DEP and ASLR memory protections off by default. More troubling is that these applications run as SYSTEM and load their own drivers.
Given that these are expecte… Continue reading Is it safe to deploy software without memory protections such as DEP/ASLR?
What technical reasons are preventing ASLR from being randomized to a byte offset? On Linux it’s to a 4kb page and on Windows to a 64kb region.
Continue reading Why is ASLR not performed at less than page granularity?
Most of my questions were answered in this post ASLR bypass with info leak
However, I just want to know the process of getting the memory address from the information leak to then using it in the final exploit.
It seems to … Continue reading Bypassing ASLR using information leaks
Do programs run in Linux in Wine benefit from mitigation techniques DEP and ASLR?
Continue reading Do programs run in Linux in Wine benefit rom DEP and ASLR?
How is shellcode (the payload) added to an executable file? Assume it is close source.
How does the hacker then get the address of where it is? They need this for when they overwrite the return address…
After the above is… Continue reading How is executable shellcode inserted?
I have a question about ASLR which allocates randomized addresses for things. Based on my understanding (which might be wrong), a modern OS has pretty complicated memory management mechanisms and it seems REALLY challenging to allocate the… Continue reading Why would modern OS allocate static addresses or why is ASLR still needed?
And if “yes” then how? I was leaning towards yes until I discussed it with my classmate just now (doing a module on software security, is my first encounter with these sorts of thing ever)
Continue reading Does ASLR prevent insecure deserialization vulnerabilities?
As far as I remember,
most Debian Wheezy packages were not compiled with those useful security flags (ASLR, PIE, SSP, and more).
Did the situation improve with Debian Squeeze or the upcoming Debian Buster ?
By comparison, … Continue reading the state of ASLR, PIE, SSP on Debian in 2018?
mingw-w64 produces a executable Windows files without a relocations table by default,which breaks compatibility with ASLR. Continue reading VU#307144: mingw-w64 by default produces executables that opt in to ASLR, but are not compatible with ASLR