All right.
Welcome back to Introductory Exploit Development.
This is a sample section of the class and now we're going to locate where we actually can reach ERP
extended instruction pointer by using a cyclic pattern.
So Mr. Patten, Craig Nash now from the 700, because we know it's somewhere around 2600 or 2600 2700
something AIDS to reach there.
So as you can see, the sideways pattern increments every four characters.
So that way we can always find the location where it was about to overwrite the IP.
And then let's clear this out finishes first and let's restart the process.
On the border while Bashir.
Stop.
Start.
Reckless bugger run as administrator.
Yes.
Attach.
Name.
So now attach.
Press play, and let's see if we can send our buffer again to see what happens.
So now we have the contents is 39, 69, 44, 38.
This is the contents of our as you can see, the site pattern shows up here in ASCII text history on
the back to ASCII.
They just shown up right here.
So.
Oops.
Got.
Put on.
Let's run this again.
Stop.
Star.
Attach.
So now.
Play.
Fire the PRC again.
When I take note that it is 39, 69, 44, 38.
So it's a pattern offset just to.
And we found a jackpot match of access to six or six.
So what we need to do now is validate that actually works.
So coming out this buffer buffer equals eight times to six or six plus.
B times four plus C times.
3500 last year.
Total six minus four.
All right.
Go back to when those.
I said this.
Stop this.
Start.
And now we're looking for validation that we correctly predicted the offset.
Press play again.
This to you?
To me?
Just checking to see that this is correct.
Yes, it is.
Pass on to me.
Did I forget to press play?
All right.
So now we have proven that we can overwrite IP, extend instruction pointer before.
Letter is right here.
42, 42, 42, 42.
Well, actually, not for capital letter B.
This is a very good sign that we are actually controlling the buffer space.
If you look at the extended stack, one ESP followed out and up, you'll notice that we now have a buffer
of C's.
Here's our four B's, by the way, with a buffer of scenes.
Or we can put a shelter in.