<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
</head>
<body bgcolor="#ffffff" text="#000000">
I was checking out Dino's Usenix paper a couple days ago, and a few
questions stuck in my head.<br>
<a class="moz-txt-link-freetext" href="http://www.usenix.org/events/woot07/tech/full_papers/daizovi/daizovi_html/">http://www.usenix.org/events/woot07/tech/full_papers/daizovi/daizovi_html/</a><br>
<br>
1. It'd be good to see the code for this and get some description of
how they were compiled. Would it have been smaller to use built-in
cryptographic libraries from the host OS? Be good to compare.<br>
<br>
<br>
<img src="cid:part1.00070205.05030404@immunityinc.com"
alt="\begin{figure}\begin{tabular}{\vert l\vert r\vert}
\hline
Function & x86 machine...
...
s\_fp\_sub & 336 \\
\hline
Total & 1283 \\
\hline
\end{tabular}
\end{figure}"
border="0" height="136" width="307"><br>
<br>
Maybe Dino will BSD-license it and we can throw it into CANVAS to
see. :> <br>
<br>
2. "For example, the exploit may
have corrupted the heap metadata and subsequent heap operations may
cause the process to crash. In these cases, the Stage 2 payload have
to repair the heap before attempting to execute more complex
operations that require explicit or implicit heap allocation. Under
Windows XP and later Windows operating systems, the default heap can
be quickly switched to the low-fragmentation heap using
HeapSetInformation(), thus abandoning the use of a potentially
corrupted standard default heap." <br>
<br>
I'd have to defer to Nico/Sinan/Kostya on this one, but I'm not sure
that technique would avoid the problem of a block of memory being
freed from the corrupted heap. In addition I think stage1 would most
likely have already crashed during the Connect() and Send()
operations. <br>
<br>
</body>
</html>