Welcome back to Advanced Exploit Development, the rock shaking capstone.
So there's a few things that we need to get straight about assembly language versus your higher level
language such as C Python Ruby to setting straight.
A lot of the terms in assembly do not mean the actual term in a higher level programming language.
We will merely go through this right after the slide.
I highly recommend reading the book assembly language step by step.
Third Edition by Jeff to so first the pop instruction in higher level languages like Python, the pop
instructor literally pops an element like a string integer or character out of a list, dictionary or
array.
An assembly pop SGX, for example, removes the topmost value of the stack and restores it in the X
register.
Now to the push instruction.
A push instruction pushes a new element, an array in a higher level programming language, but an assembly
push instruction pushes the contents of the specified operand onto the top of the stack.
You can construct a simple stack pivot by using a push in a pop, and then in return, which allows
you to say, for example, push e-bikes, register onto the stack, pop it into X, which allows you
to save the contents of the EB X register into the X register.
This is a convoluted way to get around not having available gadgets such as move or exchange.
The move instruction is actually a misnomer.
Instead of moving the contents of the opera to another opera end, it actually copies copies of the
second opera to the first opera, an assembly.
You can move different objects, not just memory addresses, but also the contents by specifying.
As you can see here, the square brackets.
The return instruction is self George or Rob Cheney as a stance for return or in programming.
After hijacking execution flow, we merely use a return.
So that way the execution points to our next Rob Gadget.
I will show you example of it.
So as you can see, our wrap gadgets are stored as a list and then we are feeding all of it into a structure.
And then each time that it completes one instruction, it would then go on to the next instruction at
this next memory address.
So stark pivoting is crucial to rationing in our example that I just showed you.
It actually had multiple stacks of it.
So a list of common stock, those pop pop return, which means you pop two of the topmost values of
the stack and save them into two different options.
A push pop return could be a good substitute for the move return or exchange return.
And the exchange instruction basically allows you to exchange the contents of two registers.
Zora or exclusive or is useful for zeroing out registers like zero.
I mean.
Yeah.
It would then just zero off the register.
In a later section of our advanced exploit class, we will make our own stack pivoting code.
So you will learn that the automated automatically generated rapture is intended to set up the register
such a manner that by using push or double push, all a general purpose registers virtual protect is
called shut down data execution prevention.
Now to our video.
Welcome back to Advance Exploit Development.
In this section, we're going to do a real walk through of the rock chaining process.
I want to demonstrate how rock chaining works within the debugger as we step through the program.
In the event that you restarted your PC or you re-enable or disable DEP on your Windows seven virtual
machine at any time, you will have to create a new rope chain, unfortunately.
But if you did, don't worry, just go back through the rock chaining creation process, which was the
Mona Rob dash, and you'll see Pino now command and then start back from there.
But if you haven't, go back and then look through your proof of concept code and I want you to put
two breakpoints.
I want you to put a breakpoint at the memory address where your rough chain begins and then where your
rushing ends.
So.
Let's go.
Put our brake lights.
Our first breakpoint is at for me.
Seven, six one.
a306.
And double click to put the breakpoint.
Don't want to put another break point.
At the end of eruption.
Right here.
Remember, your break points in your locations will depend on what?
The eruption that you constructed using Mona.
Now run the program.
And then fire your proof of concept.
We hit our first break point.
So step through.
Pop Pop X in return.
Let's maximize this.
So we have a poppy and their return instruction, so we step through it.
Notice the pointer to virtual protect is right here.
Then we have additional instructions.
Which moves a pointer to virtual protect to somewhere else and then returns.
Pop MVP, the pop extended base pointer and then return.
Pop X register return.
Negative Operation X and a return.
Exchange X and ABC's registers return.
But press play to hit the next breakpoint.
And then not only are we at the bottom of our rock chain, which were about to.
Notice what's located.
Here.
Virtual protect we are about to call virtual protect to set the entire stack is executable.
So.
We step through and the return.
Then press play.
And go back to your machine.
You now open another metrofibre shell right here.
Now because the thread the program has not finished executing press play again.
And you're now your makeup session is fully loaded.
So this is just another, more detailed walk through of rock shading.
And I think that this is what better be a capstone to this chapter.
Thank you for watching.