📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  Brainstorms - General  >>  Vista Buffer Overflow Protections

Topic created on: May 15, 2007 10:31 CDT by djnemo .

Hi every One i'm talking about exploiting about vista security .Some Like Stack Randomization .

i need a way to bypass this type of Protection ?
( i was heared i little about stack BruteForce and ... )
**
on the other hand aWay to Detect and Find this Protection            and there ByPass .

TanX aLote -

  MohammadHosein     May 15, 2007 12:53.55 CDT
dj , before flooding forums with basic questions :

1- you must obtain and read well known related books , Exploiting Software and the shellcoders handbook will be your firsts , take a look at openrce's bookstore too
2- you should be familiar with a not-very-recent term called "google" , and you must use it to gather very beginning info

  jms     May 15, 2007 22:32.36 CDT
ASLR is what you are referring to, and yes you should become intimate with ASM, WinXP internals, RE'ing the various binary types (PE, ELF, etc.) before attempting to take on Vista :)

  gera     May 16, 2007 07:45.21 CDT
> djnemo: Hi every One i\'m talking about exploiting about vista security .Some Like Stack Randomization .

you are talking about what's known as ASLR (so you google a little more for it)

if you can't bruteforce (try several times until you hit the right address), for example because the program just dies on the first missed shot, like the most common case in windows, then you are only left with jumping to known locations.

three basic ideas come to mind:

. reuse code already present known to be fixed in memory. basically, is everything randomized? you sure? can you reuse part of the return address that you are overwriting (known as partial overwrite)

. learn the address. for example, because some DCERPC traffic leaks pointers (I think this is not the case in Windows anymore since 2k3 and XPsp2). Force a way to make the program leak pointers

. be able to put something in a known location, and then jump there.

good luck, and share you experience!

  djnemo     May 17, 2007 04:01.47 CDT
it's no problem in Compiler Protection ,But no idea to detect Operation System Protection .
Without any document Just Reversing

  sapheal     May 24, 2007 07:57.38 CDT
djnemo: read the following text, it might come in handy:
http://sapheal.hack.pl/arts/Introduction2Exploitation.pdf

talking about ASLR, read about heap spraying and LSB-overwriting


Hope I could help a bit,

Michal Bucko

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit