Vulnerability Development mailing list archives
Re: static dll's for windows buffer overflows
From: <foob () return0 net>
Date: Mon, 24 Sep 2001 11:30:53 +0000 (GMT)
Windows buffer overflows almost always require knowledge of offsets in dll's. Even if rva is used, usually one offset is still known, to jmp to where the code is (e.g., let's say the shellcode is pointed to by eax, we need to know the offset of somewhere to jmp eax). Which dll's are the most static? For the jmp instruction, we can use any dll, as long as it has those bytes (i.e., we are not limited to kernel, user, and gdi). Which dll's are the best to use, and why?
Using dll's for the jmp's causes problems when different service packs are encountered. I usually grab a list of all the dlls loaded by a process (dumpbin, pex or msvc will do this), narrow down the to the ones containing a usuable jmp/call instruction, and then pick the one with the oldest date in the newest service pack. This way, the same dll will be used in most (all?) earlier service packs. Also, dll's with addresses that are ascii printable are good for filtered buffer overflows - ie 0x77500000 (clbcatq.dll) == 'gP..' in internet explorer 6. Usually the choices are limited however. - foob
Current thread:
- static dll's for windows buffer overflows Franklin DeMatto (Sep 23)
- Re: static dll's for windows buffer overflows Enrique A. CompaƱ Gzz. (Sep 24)
- Re: static dll's for windows buffer overflows foob (Sep 24)
- Re: static dll's for windows buffer overflows Ryan Permeh (Sep 24)
- Re: static dll's for windows buffer overflows dullien (Sep 24)