Switch on the Symbol Server

We don't want addresses, we want meaningful names, so the first step is to hook up the debugger to the symbol server at http://msdl.microsoft.com/download/symbols. Go to Debug -> Debugging Symbol Options:

Now switch on the checkbox; the URL should already be there:

For the changes to take effect, you need to restart the trace. …

Purpose

To be able to write injectable shellcode to pop a shell.

Popping a Shell

Welcome back shellcode rookie!

Abstract

In order to pop a shell, we would need to write shellcode that effectively executes along the lines of the following bit of C code:

#include <unistd.h>
int main() {
char *shell[2];
shell[0] = "/bin/sh";
shell[1] = NULL;
execve(shell[0], shell,</unistd.h> …

Purpose

The most suitable place to inject and harbour shellcode, is into a buffer, and almost undoubtedly, this will be a character array. This presents a problem which is the focus of this tutorial - character arrays are NULL-terminated, and this means the only the portion of shellcode prior to the very first NULL will succeed in the injection.

To be able to write injectable shellcode, free of the NULL character.

…

Purpose

Getting started with shellcode; to be able to write a trivial exit shellcode, and ensure that it's execution is taking place as expected.

So Yewz Wantz 2 Writez Some Shell Eh?

Abstract

The term "shellcode" here has truly been dumbed down; it is not really shellcode at all (i.e., …

PSIGMATECK Inaugural Mainevent

Purpose

An absolute beginner's guide to understanding asm: Write (and compile) a trivial bit of C code, then make sure you understand the disassembled asm, line by line.

Welcome back! In the previous post, we covered the compilation of a simple C program without stdlib, simply to gain further (very minimal) insight into the compilation process and (a tiny bit about) the role of stdlib. …

お帰り!

Purpose

To cover system call hooks once more, this time however focus on those system calls that can be used to intercept networking traffic; specifically TCP/IP.

Intercepting Network Traffic

To get started, read the FreeBSD Communication Protocols page.

…

Welcome back!

Reversing Game 0x2

Tools

For this wargame, we'll be using the following tools: