3 ms·
Because you don't know how to call the functions, as explained in the article. To call a function, you need to know its address among other things. And you don'
by robotresearcher 9y ago
Because you don't know how to call the functions, as explained in the article. To call a function, you need to know its address among other things. And you don't, since the address was decided at random at build time (or even boot time in some systems).
- notacoward 9y agoThere are other ways to find functions besides knowing their addresses a priori.
- robotresearcher 9y agoHow is this done? I think kernels try not to leak the address of system calls at run time, and if they are scattered around in a 64bit address space they are tough to search for. Educate me!
- xorcist 9y agoI have no idea, but couldn't you use some part of the software you just compromised that makes syscalls?
- robotresearcher 9y agoThere are no syscalls as the fine article explains.
- robotresearcher 9y agoAh, wait, I mis-read your comment and it's too late to edit mine. Yes, that sounds plausible, and particularly if you have the source code, which you do for many common servers.