4 ms·
How do you scan the executable when the memory layout is randomised? EDIT: https://news.ycombinator.com/item?id=11789653 https://news.ycombinator.com/item?id=1
by cosarara97 10y ago
How do you scan the executable when the memory layout is randomised?
EDIT: https://news.ycombinator.com/item?id=11789653 https://news.ycombinator.com/item?id=11789653
- tptacek 10y agoWith any program behavior or bug that leaks memory layout. They're common.
- monocasa 10y agoVia what's known as an "information disclosure vulnerability". Basically the program somehow leaks what address something ended up at.
- cyphar 10y agoYou need to have a memory disclosure bug (they're very common). You don't even need to be able to read all of memory, you just need to know the start offset of where the library is loaded (if the library is from a distribution you can download it and figure out the ROP offsets using the library -- though apparently OpenBSD has defences against that too).