diff options
Diffstat (limited to 'x86_64/ret2csu/gadgets')
| -rw-r--r-- | x86_64/ret2csu/gadgets | 14 |
1 files changed, 8 insertions, 6 deletions
diff --git a/x86_64/ret2csu/gadgets b/x86_64/ret2csu/gadgets index 87a3bb8..f3adc78 100644 --- a/x86_64/ret2csu/gadgets +++ b/x86_64/ret2csu/gadgets @@ -71,16 +71,18 @@ Disassembly of section .fini: calling x86: controlling rdx: -1: 0x00000000004006a3 - rdi : 0xdeadbeefdeadbeef 2: 0x40069a rbx: 0 <-- - rbp: whatever - r12: 0x601020 <-- next location. lets try to make it ret2win - r13: 0xdeadbeef <-- would be nice if we could use a 64 bit value + rbp: 1 + r12: 0xffffffff <-- next location. lets try to make it + r13: whatever I guess <-- would be nice if we could use a 64 bit value r14: 0xcafebabecafebabe r15: 0xd00df00dd00df00d <-- +we can set r12 to [function@plt], and rbx to desired offset. -3: 0x0000000000400510 (ret2win) +0x00000000004004e0 : call rax + +target address: 0x00000000004006a3 +0000000000400510 ret2csu |