All right, everybody, welcome back to Advance Exploit Development.
Now, the computer finally unfroze itself.
Let's just walk back through what we went through before.
So we need to copy this, which is where I click copy on Clipboard Holding.
And it says it's an offset of five hundred thirty six.
That's one that was written of original Unicode pattern.
So we need to validate that it actually worked.
So let's go back.
Let's add this for comments.
And now we need to overwrite our structured exception handler, hopefully with something that we can
project so we're on a tight equal string equals Capital Times 536.
Plus, Toobs, remember, these were Occupy for bias because they will be pended with a nawabi in front
of each letter.
So just use tubes then C to make sure that we don't see any CS in the record.
So we're spot on target then.
D maybe three thousand.
So let's just restart our you again Python we tried up by.
Go back, control F to restart your application.
Pressplay.
Click on the list on MP three player.
And low top 40, again, which is the father wrote.
And notice how we have to Unicode encoded A's in our IP register, I mean, we just pull this one to
the left of it.
They're.
Let's look at our structural exception handler.
We cleanly overwrote it with two Unicode encoded BS zero zero 42, zero zero 42.
And let's go back Savu CPU shift F nine.
And let's take another look at our situation again.
So now we verify that we can possibly control the structured exception handler, so what we're gonna
do is we're going to validate this by.
See?
Want to validate this by making sure that our seats are turned into Knopf's.
So let's just control copy this, put it down here again.
Let's change our seas and turn up.
Remember, these will be Unicode and coded, so we prepared it with two zeros.
Let's see you run the Python file again.
Restart.
Play.
Click on list.
Load the top 40 again and let's look at our situation before and after.
So you see, we have to unico Knopf's zero zero nine zero zero ninety in the structure except a handler
before the address where we we're over all of these go back to CPU shift F nine, and you should see
IP pointing to our unit code.
These are when I say Unico Knopf's, I mean that it's prepend it with zero zero nine zero zero zero
nine zero.
Now, what we need to do to seize control of the structure exception handler is look for any exceptions.
So Mona.
S.H. Dash DKP for compatibility unico, we need a Unicode compatible popup return instruction, so press
enter.
Put on.
Let's restart immediately after.
We have to do this on a clean on a clean program, so right click when I was administrator file logic.
Yes.
Pressplay.
Then exclamation point, Mona S.H. Dash, Sepi Unicode, because we're looking for Unicode compatible
popup return instructions if you don't know what's going on right now.
We tried adding just quote a log.
And as long as it's not tender with no bites or sore unico compatible format as they are right here,
then you can use them.
So we're going to use this one.
So.
Right.
Click on that.
Copy the clipboard, whole line.
Let's put another note.
That was my phone and let's change this.
And and our pop pop reconstruction, remember, we need a little Indiana, is it so that means that
we're going to reverse the F two in the four one.
So let's replace our knob's.
With hats off to Hex 41 and it will change back into this format once we load it through a debugger,
but let's just try that out to see that we can actually control the structure exception handler chain.
So I want you to restart.
So control F two.
Yes.
Play.
Now, right quick go to expression.
And we're going to enter the the memory address for pop up return.
So we're in the press.
OK, we're at a break point, double click, yes.
Pressplay again.
Oh, if you have to right to file.
Let's see if we can hijack this structured exception handling process, if that would execute our pop
up return instructions, click open.
Remember, we have to now pass the exception and let the structure and the handler handle it.
So shift F nine and we land in our pop up return instruction further stepping in through.
We need to find a way to overwrite this in such a manner that we can Hillard's the lively.
But that is going to be on our next episode.