Collaborate Disseminate
I experiment with dynamic forking, and I decided to disable “Address Space Layout Randomization” (ASLR) from the Visual Studio linker settings, to see what will happen. Now, this is the C++ code that I use to run the executab… Continue reading Dynamic forking without ASLR
I am training myself for BOF and ASLR in 32Bits. I wrote a program that seems like this :
int main(int argc, char **argv)
{
char buffer[32];
printf(argv[1]);
gets(buffer);
return 0;
}
With a format string … Continue reading BOF – How to determine adress of system() using a leak memory?
How exactly do the exploit pieces connect when bypassing ASLR and DEP using ROP?
It seems like there could be a number of ways. E.g. a full ROP based payload or a ROP payload that modifies a memory location to be executable … Continue reading Full ASLR and ROP
While doing binary exploitation and studying the case when ASLR is enabled, I noticed I could make a reliable exploit by leaking an address of a function in the binary and finding the address of system in libc by adding a con… Continue reading Is the difference between a loaded elf and libc a constant value?
I am reading the paper “Spectre Attacks: Exploiting Speculative Execution∗”, but I am very confused about the following statements. So can anyone explain them to me?
Thread(s) were launched to mistrain the branch pre-dict… Continue reading A question for the spectre windows example
In the meltdown official paper released the authors broke the KASLR with 128 steps at worse. Unable to understand how did they come down to that number
Paper for reference
I’ve been trying for some time to write an exploit to a very simple program which has a format string and a buffer overflow vulnerability.
This program has NX, SSP and ASLR.
#include <stdio.h>
int main(int argc, char … Continue reading How to leak libc base address using format string exploit
Immediate concern is for Intel chips, but everyone is at risk. Continue reading “Meltdown” and “Spectre”: Every modern processor has unfixable security flaws
ASLR randomizes the addresses of the process executable code, stack, heap and libraries. This is to make the life of an attacker difficult as they cannot hardcode addresses in the code across multiple instantiations.
But ho… Continue reading How does ASLR protect libc entry points?
It’s one of the oldest debates in software: is it a bug or a feature?
The post Microsoft defends Windows 10 against ASLR criticism appeared first on Security Boulevard.
Continue reading Microsoft defends Windows 10 against ASLR criticism