Sumário
OSED Notes by Joas Antonio and Alex ..................................................................................... 1
Laboratory ..................................................................................................................................... 3
X86 Architecture ........................................................................................................................... 3
CPU Register ............................................................................................................................... 10
General Purpose Registers .......................................................................................... 15
eax ...................................................................................................................................... 15
ebx ...................................................................................................................................... 15
ecx....................................................................................................................................... 15
edx ...................................................................................................................................... 16
esi ........................................................................................................................................ 16
edi ....................................................................................................................................... 16
ebp ...................................................................................................................................... 16
esp ...................................................................................................................................... 16
Special Purpose Registers ............................................................................................ 16
eip ....................................................................................................................................... 16
flags .................................................................................................................................... 17
Introduction Windows Debugger ............................................................................................... 17
Windows Register ....................................................................................................................... 32
Controlling Execution with Windbg ........................................................................................... 38
Stack Based Buffer Overflow ...................................................................................................... 40
Data Execution Prevention ................................................................................................... 112
Address Space Layout Randomization ................................................................................. 113
Control Flow Guard .............................................................................................................. 115
Stack Buffer Overflow - Jumping Shellcode ............................................................................. 120
SEH Buffer Overflow ................................................................................................................. 160
Finding Bad Characters ......................................................................................................... 205
IDA Pro ...................................................................................................................................... 238
Windows ASLR Bypass .............................................................................................................. 256
Egg Hunters ............................................................................................................................... 265
Introduction to the Win32 Egghunter .................................................................................. 290
SEH Buffer Overflow EggHunter ........................................................................................... 308
Shellcode ................................................................................................................................... 335
Shellcode Encode and Decode ............................................................................................. 406
Creating Shellcode Encoded ................................................................................................. 418
DEP Bypass ................................................................................................................................ 429
