2 ms·
Excellent blog post by Mateusz Jurczyk of Google Project Zero on how the ATMFD DLL vulnerability was discovered and how an exploit POC was developed is here - h
by blinkingled 11y ago
Excellent blog post by Mateusz Jurczyk of Google Project Zero on how the ATMFD DLL vulnerability was discovered and how an exploit POC was developed is here - http://j00ru.vexillium.org/?p=2520 http://j00ru.vexillium.org/?p=2520
Especially read the linked PDF if you love pain and misery but enjoy understanding complex stuff :)
- PhantomGremlin 11y agoI've only skimmed the PDF so far. There was one great observation I couldn't resist repeating. The font renderer is performing various checks to validate 'n', the count of arguments passed on the stack, to a particular function. However: Turns out, a negative value of n passes all the checks! Oops. It's possible to use this bug to target memory well beyond the stack. It's game over! The best bugs are the simplest bugs.
- blinkingled 11y agoYeah that's true but as you will find later, it really wasn't anywhere near easy to develop an exploit that results in code execution despite of that simple bug. This one just results in BugCheck - attempted X of NX memory.