30.07.2014 Views

Attacking the Vista Heap - 2008

Attacking the Vista Heap - 2008

Attacking the Vista Heap - 2008

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

h<strong>Heap</strong> payload<br />

h<strong>Heap</strong> (X)<br />

…<br />

A<br />

…<br />

B<br />

…<br />

C<br />

…<br />

D<br />

E<br />

…<br />

0<br />

68<br />

80<br />

88<br />

184<br />

• D freeEntry, must point to readable<br />

memory such that:<br />

- freeEntry->ent_0 == NULL; (Next pointer)<br />

- freeEntry->ent_18 points to readable memory Y<br />

- Y has known constant value at offset -8<br />

(i.e. *(Y-8) constant)

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!