Being provided a txt file titled "long.txt" with the challenge title of "Count them all", and the description "One important aspect of an inventory is to count all the swords you've got. Count them all." was the premise for a challenge
If you’ve attempt to write an SEH Record exploit, you know that it could be a little time consuming to find a pop pop ret instruction sequence inside a module that has SafeSEH off. This is because first you’d need to find which modules, if any, has SafeSEH
Not all applications on the Android market can be installed by all Android devices. More specifically, each Android device only allows the user to choose from the subset of applications that are considered suitable to be installed on that device. For example, if you visit the Android Market with your
The Key Is superline. (Image taken down; http://blackbox.sibears.ru/uploads/6/school-ctf-2011-files/deadlamps.gif) Hey guys here is a quick writeup on the Deadlamps challenge from SchoolCTF The gif above is a simple leftbound scrolling text across a figurative set of lamps No real context is give for
In this challenge we are tasked to solve a simple sudoku like puzzle and derive the key from the given information By noticing a few key squares such as the 16, 3's and 5, we can put together a solution to the puzzle rather quickly . r1=6 r2=
The challenge "You just love this thing, right?" gives you a GNU/Linux EFL binary called "mazzze" (that's contained within a gzip file called "mazzze.gz"). 'mazzze' is an ASCII game in which you must go through a 'maze&
Continuing from Java Dynamic Instrumentation #1, this post will cover some more advanced features of the Javassist API. In the previous post, we went over the ClassPool, CtClass, and CtMethod classes and how to add code to the beginning and end of a method. In this post, we will cover
Instrumentation is the process of injecting code into a compiled program. In Java, this can be done statically and dynamically. Using static intrumentation, a class' bytecode is modified and saved to disk; permanently modifying the class. With dynamic instrumentation, the class' bytecode is modified in memory right before
This exercise is compiled on Debian 2.6.32 with NX and ASLR enabled. However, those protections do not effect the difficulty of the exercise. Exploiting this challenge could have been performed with or without those protections. ABO #3 source code: {% highlight c %} /* abo3.c * * specially crafted to feed your
After my last post, I decided to go straight into the Advance Buffer Overflow (ABO) section and practice more ROP. The first ABO exercise was a straight-forward buffer overflow. ABO #1 source code: {% highlight c %} /* abo1.c * * specially crafted to feed your brain by gera */ /* Dumb example to let you
A lot of programming languages, like C, C++, Java, Python, Ruby, etc, have exception support. In the event of an exception, the program searches back through the stack of function calls until an exception handler is found. Actually, the pointers to the exception handler are stored in the stack frame
While doing a JavaScript exploit I encountered that there isn’t a convenient function in JavaScript to set specific code to a specific offset in a given string. For example: Given the string “1234567890” If you want to change the substring “567” to “756” for it to become “1234765890” you
