10 replies to this topic

[nu3lC]

hey guys i missed hackhound becuz i busy with shool stuffs, fuck school

 

anyway i wrote a shellcode yesterday in winxp using masm,,its works fine,

but its not null free,but its working

 

but i got a problem i wrote it in win7 but each reboot  dll  addresses  are changing,,,

 

ex:

messagebox 6273261

 

after reboot its comes  messagebox 5415245

 

sorry i cant explain it well  ,my englsih sucks,hope u guys got some idea

 

can someone tell me how to fix that shit??

 

excuse for my english 

[Tony]

Google "Windows Address Space Randomization" and you will find your problem + solution

[DualCoder]

It is due to ASLR (

Please Login or Register to see this Hidden Content

)

 

Get the loaded modules from PEB (

Please Login or Register to see this Hidden Content

) at FS:[0x30] and get the addresses from the module's export table (EAT).

 

//DualCoder

[sonykuccio]

maybe this example can help you

 

Please Login or Register to see this Hidden Content

[Coldzer0]

see these tut

 

i write it in Arabic 

 

but i put comments in English

 

lesson1 :

Please Login or Register to see this Hidden Content

lesson2 : 

Please Login or Register to see this Hidden Content

lesson3 : 

Please Login or Register to see this Hidden Content

lesson4 : 

Please Login or Register to see this Hidden Content

 

  i think it 'll help alot 

[nu3lC]

Thank you all u guys

i'll try  

[nu3lC]

Coldzer0, on 25 Sept 2013 - 7:01 PM, said:

see these tut

 

i write it in Arabic 

 

but i put comments in English

 

lesson1 :

Please Login or Register to see this Hidden Content

lesson2 : 

Please Login or Register to see this Hidden Content

lesson3 : 

Please Login or Register to see this Hidden Content

lesson4 : 

Please Login or Register to see this Hidden Content

 

  i think it 'll help alot 

tnx dude,,its in arabic,,but i'll try to understand it by actions 

[nu3lC]

hey plz someone can give a example.???

[steve10120]

Get kernel32 from PEB, walk the EAT of kernel32 to get LoadLibraryA and GetProcAddress, done.

[nu3lC]

Please Login or Register to see this Hidden Content

Please Login or Register to see this Hidden Content

[delphifocus]

nu3lC, on 01 Oct 2013 - 02:30 AM, said:

Please Login or Register to see this Hidden Content

Please Login or Register to see this Hidden Content

 

Did your problem had been solved? If yes, may be this thread should be marked with [Solved] tag. Thank you