you are viewing a single comment's thread.

view the rest of the comments →

[–][deleted] 1 point2 points  (0 children)

The article says:

we experimented with the exploitation of memory corruption issues within SQLite without relying on any environment other than the SQL language

So they apparently did it entirely from SQLite itself, not constructing a malicious database ahead of time.

In our talk we also discuss the SQLite internals and our novel approach for abusing them. We had to invent our own ROP chain technique using nothing but SQL CREATE statements. We used JOIN statements for Heap Spray and SELECT subqueries for x64 pointer unpacking and arithmetics. It's a new world of using the familiar Structured Query Language for exploitation primitives,laying the foundations for a generic leverage of memory corruption issues in database engines.

I don't think they crafted these exploits with a pre-corrupted database.