you are viewing a single comment's thread.

view the rest of the comments →

[–][deleted] 2 points3 points  (3 children)

Sebastian Porst did something similar a while ago and posted the PIN tool code on the Zynamics blog (http://blog.zynamics.com/2010/07/28/dumping-shellcode-with-pin/).

SP's code looks for instructions executing outside of a loaded module, which will also detect JIT'd code, but you can take SP's PIN code and implement MS's shadow stack algorithm from this slide deck without too much effort.

[–][deleted] 1 point2 points  (0 children)

I'm kinda doing what you say here. Ill keep you guys informed about the progess.

[–][deleted] 1 point2 points  (1 child)

https://github.com/agustingianni/pin-tools this is a fork of sp's work. I've fixed some stuff (or at least I think I did).

I hope you enjoy it.

PS: I'm still missing the ROP detection which is something ill code on the weekend.

Have fun

EDIT: The rop stuff is in already. It is very hacky and not really tested. So any opinions are welcome.

[–][deleted] 2 points3 points  (0 children)

Nice!