You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
h<strong>Heap</strong> overflows III<br />
• Goal 1: get overflow chunk positioned<br />
before some h<strong>Heap</strong> HANDLE<br />
• Goal 2: Craft payload to overwrite<br />
commitHook…<br />
• Encoded function pointer located in h<strong>Heap</strong><br />
HANDLE, called when heap extended<br />
• Result: arbitrary code execution on next<br />
<strong>Heap</strong>Alloc