ROPs_are_for_the_99_CanSecWest_2014

Recommendations

Info

Agenda Who am I Background “Vital Point Strike” “Interdimensional Execution”
Who am I Researcher at NSFOCUS Security Lab since 2002 http://twitter.com/tombkeeper Focus on: APT/0-Day detection Vulnerability & Exploit Wireless & Mobile Many o<strong>the</strong>r geek things Be<strong>for</strong>e 2002, I am…
Page 1: ROPs are for the 99% Yang Yu at NSF
Page 5 and 6: Now
Page 7 and 8: This is my original presentation pl
Page 9 and 10: Background
Page 11 and 12: var str = “AAAAAAAA”; Corrupt B
Page 13 and 14: JScript 9 replaced JScript 5.8 sinc
Page 15 and 16: Seems we’ve already done: Summon
Page 17 and 18: About JScript 9 I don’t have enou
Page 19 and 20: Array data: JScript 9 “BSTR” va
Page 21 and 22: writeByVul(0x0d0d0018 , 0x30000000)
Page 23 and 24: Noteworthy new “interesting” ob
Page 25 and 26: “Rewriting UAFs” is not rare: C
Page 27 and 28: “Vital Point Strike”
Page 37 and 38: “Interdimensional Execution”
Page 39 and 40: function GetModuleFromImport() We c
Page 41 and 42: Now, we can do this in JS just like
Page 43 and 44: struct _CONTEXT #define CONTEXT_i38
Page 45 and 46: One stone, two birds 0:019> dd 1416
Page 47 and 48: “Interdimensional” ebp FF5504
Page 49 and 50: Native dimention _ShellCode: 000000
Page 51: • I call this technique “Interd
Page 54 and 55:
Off topic How to defend against unk
Page 56:
Q & A
show all

ROPs_are_for_the_99_CanSecWest_2014

Create successful ePaper yourself

Delete template?

Save as template?