Hacking Windows CE

More documents

Recommendations

Info

Shellcode(2)Something to attention while writingshellcodeLDR pseudo-instruction"ldr r4, =0xffffc800" => "ldr r4, [pc, #0x108]""ldr r5, =0x324" => "mov r5, #0xC9, 30"r0-r3 used as 1st-4th parameters of API,the other stored in the stack
Shellcode(3)EVC has several bugs that makesdebug difficultEVC will change the stack contents whenthe stack reclaimed in the end of functionThe instruction of breakpoint maybechange to 0xE6000010 in EVCsometimesEVC allows code modify .text segmentwithout error while using breakpoint.(sometimes it's useful)
Page 1 and 2: Hacking Windows CEsan@nsfocus.comsa
Page 4 and 5: Windows CE Overview(2)ARM Architect
Page 6 and 7: Memory Management(2)
Page 8 and 9: Memory Management(4)Slot 0 layout
Page 10 and 11: Processes and Threads(2)When a proc
Page 12 and 13: API Address Search(1)Locate the loa
Page 14 and 15: API Address Search(3)Export Directo
Page 18 and 19: System CallWindows CE APIs implemen
Page 20 and 21: Buffer Overflow Demo(2)The variable
Page 22 and 23: Buffer Overflow Demo(4)A failed exp
Page 24 and 25: About Decoding Shellcode(1)Why need
Page 26 and 27: About Decoding Shellcode(3)A succes
Page 28 and 29: ConclusionThe codes talked above ar
Page 30: Thank You!san@nsfocus.comsan@xfocus

Hacking Windows CE

Create successful ePaper yourself

Delete template?

Save as template?