Re: Win32: Using SEH to search memory

From: Rodney Thayer (rodney_at_tillerman.to)
Date: 09/25/03

  • Next message: Moran Zavdi: "argosoft ftp server buffer overflow." 
    Date: Wed, 24 Sep 2003 18:43:23 -0700
To: vuln-dev@securityfocus.com

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    At 11:06 PM 9/24/2003 +0000, you wrote:
    I'm trying to search through memory using structured exception
    handling

    Can anyone recommend a good reference for implementing seh in
    shellcode?

    I'd grab a copy of the Intel instruction reference:

       <http://www.x86.org/intel.doc/inteldocs.htm>

    and look up how the handlers have to be set up.

    -----BEGIN PGP SIGNATURE-----
    Version: PGP 8.0

    iQEVAwUBP3JILfeU5nJIONUVAQK/EggAsIwlYZl077Xaf6hEag4QDzC11ZZkTH9V
    tCUczQjXeuePJZXWJ8Qyk1DrP7KvFg8icVACaOJkh9o+6rU4dSChMTekN/4M2lzx
    /fRppe3rkymRvE0ALYdaPET7S+yjHTTRuy7vNOf22LUcjwg/0llYycHTrr7ulslI
    VUoxfmle55o2BY+X/vaSLp1rPPRba6W6/GqPwVoHjKwSnuIRpFcNWcBYF4HCrmzw
    MqN3NKETHkWdjze8oi7CgQNaSP+EzWw+HgLQTIP7RaPaWq2/ATjb3bgJU87lnnC7
    oeo4DinoJrOvq/r8MhODXH9DBwG3l/xbCkrypZDyjNWePyOqwOzs4w==
    =nCZX
    -----END PGP SIGNATURE-----

  • Next message: Moran Zavdi: "argosoft ftp server buffer overflow."

    Relevant Pages

    • Re: Programming the GS
      ... My recommendation for newcomers to IIgs programming is Complete Pascal ... grab a copy of CP from my site here:http://apple2.sytes.net/TML_Pascal/index.html ... they come with source code to give you some ideas on how things fit ... reference. ...
      (comp.sys.apple2)
    • Re: Question about memory mapping mechanism
      ... One think you could do is grab a reference to the pages upfront. ... and thus preventing them to be swapped out. ...
      (Linux-Kernel)
    • Re: Question about memory mapping mechanism
      ... because then I may loose some data when they are not available in time ... One think you could do is grab a reference to the pages upfront. ...
      (Linux-Kernel)
    • Re: [PATCH] kthread: Spontaneous exit support
      ... Better always grab a reference ... For normal thread ... Please read the kerneldoc documentation for kthread_create ...
      (Linux-Kernel)
    • Sleeping in RCU list traversal
      ... and continue the iteration. ... memory region pointed by "ptr" never be removed. ... Do I need to grab a reference to "ptr"? ...
      (Linux-Kernel)