The DMZ

A serious place where infosec is discussed PS we don't do hard...
Oct 8, 2015 18:10
i actually came up with it as a way to intercept conditional jumps as an alternative to replacing them them with int3,
since `call eax` and the like are all two-byte instructions
Oct 8, 2015 18:04
instead, lets say there's a page allocated at address 0xF000; with the right two trailing-bytes you could use such a jump to target very close to 0x10000
though it is very unusual to have pages in the 0 to 0x10000 region, Windows at least does let you do it
Oct 8, 2015 18:00
if it's a 16-bit jump, it always lands in the first 64k of address space; i tested it @ThomasPornin
Oct 8, 2015 17:58
@RoraΖ i know that much, but i was referring more to the use of a truncated 16-bit jump opcode to target the 64k region,
Oct 8, 2015 17:54
i was wondering if anyone knows if there's a name for this?
Oct 8, 2015 17:53
it sounds like something that could've been used in the wild before, but I don't really know what to search for,
Oct 8, 2015 17:53
I was pondering some, kind of, 'exploitable' properties of x86 today, and came up with this technique that could be used as part of an attack,
Oct 8, 2015 17:33
are they stored securely to prevent unauthorised reading?
Oct 8, 2015 17:32
is there some rules for this room?
Oct 8, 2015 17:18
help yourself!
Oct 8, 2015 17:17
it's not late anymore, it's early
Oct 8, 2015 17:16
>_>