vxworks program exception current instruction address

NOP sled is a collection of NOP instructions placed in the memory to delay the execution in the scenarios where the target address is unknown. It is an assembly instruction (x86 programming) which does not perform any operation when placed in the code. A specific size of memory is allocated to JavaScript strings containing NOP sled (also known as NOP ramp) and shellcode (payload) and in most cases the specific address range points to a NOP sled. The heap is allocated in the form of blocks and the JavaScript engine stores the allocated strings to new blocks. The idea is to fill chunks of heap memory with payload before taking control of the Extended Instruction Pointer (EIP). This technique exploits the fact that it is possible to predict heap locations (addresses). Heap spraying is a stage of browser exploitation where a payload is placed in a browser’s heap. In this case, we will use dumpbin for simplicity, since it can quickly tell us what we need. To do this, we could use the depends.exe program that ships with visual studio, or the dumpbin.exe utility that will allow you to examine a program's imports.

To do this effectively, we need to see what DLLs are imported into our attacked program and examine those loaded DLLs for potentially vulnerable pieces of code. Since we have already written findjmp, we'll use that to find an effective place to get our ESP into the EIP. So now we examine the memory space of the attacked program for useful pieces of code that would allow us to get the EIP register to point to the ESP. Also notice how in the function epilogue, the saved EBP was restored, but this time with our 0x90 string instead of its original contents. This means that if we can get the contents of the ESP register into the EIP, we can execute code at that point. Also, control should continue from there. After this ret, the ESP will move up 4 bytes and what is there should be moved to the EIP. We notice that the ESP points right into the stack, right after where the saved EIP should be. Typically, I put a debugging break point at the end of the function that returns, so I can see what the state of the registers are when we are right before the vulnerable functions ret instruction. As mentioned before, there are numerous ways to get the EIP to point to our code. Next, we need to write out where we want the EIP to go. In Hack Proofing Your Network (Second Edition), 2002 Finding a Jump Point

Vxworks program exception current instruction address