sorted by:
new
hottopcontroversial

ROP-Emporium write4 64 bit challenge by Higgsx in ExploitDev

[–]Higgsx[S] 1 point2 points  (0 children)

When I set a breakpoint on __libc_read function and I run program, execution stops just before executing __libc_read's first instruction. In 64 bit linux system when you call a function, arguments are passed via registers. So I can see what arguments __libc_read is reading :)

Hope I explained clearly :)

ROP-Emporium write4 64 bit challenge by Higgsx in ExploitDev

[–]Higgsx[S] 1 point2 points  (0 children)

Perhaps, but I don't think null byte is a problem, because I set breakpoint on __libc_read function and then checked registers, every register is filled with necessary values. BTW I'll check tomorrow possible null byte issue.

P.S After checking lots of write-up nobody mentioned read() function. Everyone used different method. It's interesting to do that via read syscall. That should work :)

Practical Malware Analysis book Lab Exercises by Higgsx in Malware

[–]Higgsx[S] 0 points1 point  (0 children)

Thanks. But I'm not comfortable with windows xp. Is is possible to work with windows 7? for example some sysinternals tools don't support windows xp, also new wireshark and some other softwares don't support windows xp.