And finally, we need to align our registers using nation shall code, there's a sample on fuzzy security.
I have it right here.
Am I already completed exploit or basically what's doing is that is trying to align the register that
is closest to our buffer to ensure that we can inject the code in there.
So notice how the line code is interweave with HEX 71, HEX 31 is also known as a Unicode compatible
knob.
It doesn't actually do anything, but when we pad them, we can actually have Unicode compatible exploits.
So at the end of this code.
Let's copying code.
At the end of this, we need to figure out the distance.
So let's go down, let's see, plus online.
At the end of the day, we need to figure out the distance between where.
PBX is located.
And our bluffer.
So let's go run this through the debugger again, remember, a shortcut is control F two to restart
the application.
OK, Pressplay.
Don't forget about our break point.
Control G.
Double click, add breakpoint.
Yes.
And let's run our Python file again.
Let's make sure I save this.
So we generated the file click on list.
Top 40 open, remember to pass the exception and let's step through this.
Pop, pop return, if you keep incrementing down the stack using the step through.
You eventually see the X register.
Contain this memory address.
So what we need to do is we need to find the difference.
Between the start of our days right here and the value that's stored in the register, so to my amusement,
one of the most basic programs you have in.
In Windows, the calculator app is actually very, very useful for calculating this feature.
So we do the value of the register, which is 12 E to.
C0.
Subtract.
12 E to four D enter 73 in Hex Fatime decimal, and that's one hundred and fifteen bytes, that's the
distance.
But remember every time that we inject our buffer as being four pended with no bytes as per the Unicode
accounting standards.
Now that means that we divide it by two.
So divide by two.
And it's actually fifty seven point five, so it's either 57 or 58 of our included buffer that would
be translate to Unico to reach the X register.
So let's try 57 first.
Leslie, copy and paste.
And after our line in code, we're going to add a buffer of F to see how many F does it take to push
into the X register.
So at times 57.
Let's see at another marker, about four, five.
Usually when you're dividing a odd number when it comes to exploit development, it's usually the lower
number.
So it's either 57 or 58.
If we see five letter E's in our tax register, that means we know how long it takes for it to reach
the reach the buffer.
So let's save this python, we try.
Control of two to restart, yes, control.
Oops, sorry, you actually have to run the program, otherwise this memory address, you have to load
it in memory.
You see on the bottom of all of this dynamic link, libraries for Control G, go back to our pop operator
instructions.
Yes.
And let's load our proof of concept again.
Access violation for shift F nine to pass the exception where I pop up return, so let's step through
it.
Then we are going to keep on incrementing until we get to push X so as to keep incrementing.
And if you look at our X register, there are five E's.
Which means we correctly guessed the amount of effort that we need are padding to push our shortcode
into the buffer.
So let's just follow the up to.
As you can see, five E's or Hecks, 45 attended with no bites are in our buffer
now.
Missy.
Now it's time for bad character analysis, and I'm going to leave that section to another video.