Welcome back to explain development in this section, we're going to cover Unicode exploits and structured
exception handler overwrites.
The Unicode problem is that when a program or application uses Unicode encoding, usually for language
compatibility reasons, if we try to inject a buffer into his memory space, it usually gets appended
another byte.
So forty one, which is capital letter A, become forty one zero zero now until 2000 to which this is
20 20.
So it's a long time ago.
Exploiting these applications was considered impossible until Chris Antley published an article creating
arbitrary SharkWater.
Unicode expanded strings that allows exploitation of Unicode and coded applications using what is known
as the Venetian Blinds Technique show code.
Utilizing this method is known as Venetian SQL code.
Now, Chris Ainley did a lot of work at Exploit Development and he actually wrote a book that I highly
recommend is called A Shareholder's Handbook.
You can buy it for about thirty five dollars on Amazon for the second edition.
And this module, Triola logic media player AI, we will repeal use the Venetian blinds technique to
create Unicode compatible exploits, safely overwrite the structure exceptional chain creating our own
Venetian padding to Lynna registers.
Introduce Unical Unicode compatible padding to reach our target register.
Use the Alpha to encoder to create Unicode compatible shortcode.
Now Stack Canary's has been fairly common since the early 2000s, but basically if you use a overwrite,
it can evade the Stack Canaria because we never evaluate the stack canaria that usually is located far
lower compared to the structured exceptional chain.
So basically we abuse the overwrite and usually when we can locate a Pop-Up Return instruction that
is Yancoal compatible, we can avoid the stack area because it never gets evaluated during execution.
But it's not just necessary to overwrite the exception handler.
An actual error must be triggered to exploit it.
So attackers decide to overwrite so far past virtual outerspace for the program to trigger a exception.
Once the structured exception handler, which is pretty much the last line of defense, is overridden,
we can actually insert a pop pop, return an instruction to jump towards our target buffer and shortcode.
In this module, we're going to learn how to perform Unical exploits SRH overwrites register alignment
and payload encoding.