12.09.2016 Views

ESCAPING THE LUA 5.2 SANDBOX WITH UNTRUSTED BYTECODE

2cp3MRc

2cp3MRc

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

Defeating ASLR: Hard mode<br />

The FORLOOP technique causes<br />

you to end up with a very strange<br />

value in IEEE 754 double precision<br />

Split it into two double-precision<br />

values, each holding 32 bits, and<br />

find the integral representation of<br />

each with some math – doubles<br />

can hold any unique 32-bit value<br />

If we can find a reference to any C<br />

function, we can now defeat ASLR<br />

Original work by @corsix: https://gist.github.com/corsix/6575486

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!