Re: Win32: Using SEH to search memory

From: Rodney Thayer (rodney_at_tillerman.to)
Date: 09/25/03

  • Next message: Moran Zavdi: "argosoft ftp server buffer overflow." 
    Date: Wed, 24 Sep 2003 18:43:23 -0700
To: vuln-dev@securityfocus.com

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    At 11:06 PM 9/24/2003 +0000, you wrote:
    I'm trying to search through memory using structured exception
    handling

    Can anyone recommend a good reference for implementing seh in
    shellcode?

    I'd grab a copy of the Intel instruction reference:

       <http://www.x86.org/intel.doc/inteldocs.htm>

    and look up how the handlers have to be set up.

    -----BEGIN PGP SIGNATURE-----
    Version: PGP 8.0

    iQEVAwUBP3JILfeU5nJIONUVAQK/EggAsIwlYZl077Xaf6hEag4QDzC11ZZkTH9V
    tCUczQjXeuePJZXWJ8Qyk1DrP7KvFg8icVACaOJkh9o+6rU4dSChMTekN/4M2lzx
    /fRppe3rkymRvE0ALYdaPET7S+yjHTTRuy7vNOf22LUcjwg/0llYycHTrr7ulslI
    VUoxfmle55o2BY+X/vaSLp1rPPRba6W6/GqPwVoHjKwSnuIRpFcNWcBYF4HCrmzw
    MqN3NKETHkWdjze8oi7CgQNaSP+EzWw+HgLQTIP7RaPaWq2/ATjb3bgJU87lnnC7
    oeo4DinoJrOvq/r8MhODXH9DBwG3l/xbCkrypZDyjNWePyOqwOzs4w==
    =nCZX
    -----END PGP SIGNATURE-----

  • Next message: Moran Zavdi: "argosoft ftp server buffer overflow."

    Relevant Pages