Welcome back to Basic Exploit Development.
Egg Hunters Part three.
And I just want to show you something from the last crash.
Now, obviously, we overrode the extend instruction point or to a jump ISP instruction.
But take a look at where your stack was pointing at.
Following up.
We're right here.
Not to mention that the A's which we flooded the program with.
Is about 70 bytes.
That's why I told you to memorize the number for the offset of 70.
We need to hop 70 bytes back so that we can execute the 800 that's going to land in this code.
Okay.
So let's see.
What we're going to do is we're using MSF Nasm Shell to make it jump back 70 bytes.
So MSF now as a show.
Jump.
Dollar sign.
-70.
And it's a short jump.
So what are we going to do is to.
We're going to see if we can do a short job back.
So let's see.
John.
So many back.
He calls.
Flashbacks.
Flashbacks, vague.
And this pirate will tune us.
So our ideas were to rewrite this evil strain, and we're going to add 70.
So this is four by slang.
We need to do the math work.
So -70, minus four.
Minus another four.
And we should be able to land at the start of the eighth.
So as we start this.
Reload it.
Double click play.
Go to our break point for our job instruction.
Double click to add a breakpoint and let's follow this proven concept again suggests the first thing
it's going to do once we jump to ESP is immediately execute instructions to jump back 70 bikes so that
we can plan a counter.
We had our break point.
Just one step for it.
This is our short sharp.
And we land somewhere in the beginning of our eyes.
Perfect.