JIT Spraying Never Dies
JIT%20Spraying%20Never%20Dies%20-%20Bypass%20CFG%20By%20Leveraging%20WARP%20Shader%20JIT%20Spraying
JIT%20Spraying%20Never%20Dies%20-%20Bypass%20CFG%20By%20Leveraging%20WARP%20Shader%20JIT%20Spraying
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
The Solution to Challenge III (cont’d)<br />
• Indirect jmp via esi<br />
‒ jmp dword ptr [esi+0fh]<br />
‒ The value in esi must be controllable.<br />
‒ No need for specially crafted Shader.<br />
‒ Need stack pivot.<br />
‒ In terms of the virtual function call format in 32-bit binaries, call<br />
dword ptr [esi+xx] is more difficult to find comparing to call esi/call<br />
edi, therefore more difficult to exploit.
Change language