No.
One, welcome back.
This is the part to so, uh, I assume you started debating the application and you also ended up doing
something similar to what I have here.
Let's start restart the application again.
So.
And, uh, this time, uh, let's just go through that a little bit quickly just to make sure and we
look at the values on the stack and all of this kind of stuff.
Uh, just let's do something very quick.
OK, so let's start.
Why we got to this location, AVP, I'm going again, I'm going to do, uh, Star a little bit quicker.
Uh, OK, so.
I'm going to jump I'm going to also jump this one, and now you can see that on the stand.
We have, uh, our A scores written on the stack.
Uh, let's continue.
And then it's going to print that I entered this valley over here, and then if we continue over here,
I believe, and I return and you can see the application actually just continued and it worked successfully
with no problems in there, OK?
And it terminated successful.
So and you can see the zip code is zero means application here.
Return call, which was zero, also means it was successful.
Let's see what's going to happen now with the load application.
But instead of facing only 16, uh, bytes, uh, let's pass this time, um, let's say 20 maybe, uh,
let's say 20.
Uh, so now let's see what's going to happen this time.
Um, to look at, uh, look at everything again.
So let's start.
Next, next, next, I'm going to jump over this, I don't want that next, next, next, we can also
debunk this, by the way.
Let's do it because I think this is for the copy.
Let's do that so we can see everything is God created here.
And then let's look at this one so we can see that this is our destination.
This is our destination.
And we can follow.
And so this is probably where we will be riding the these, uh, I'm going to do if a because I don't
want to jump into the copy so we can see the AIDS God written.
Uh, these are the AIDS, but this time we have or more because we send them or we send 20 instead of
16.
And let's look and continue to see what we have over here.
Over here.
I'm going to jump over this one because it's only going to print.
So I don't want that.
I'm going to jump over it.
We got back to our main and, uh, if we continue.
Here is oh, this is actually OK, this is actually where I am, I am I didn't jump over in my misstep.
So cooperative.
I'm going to jump over the car and just continue to turn.
OK, now I'm going to go back to my, uh, main function, so.
Is and then return, and until we have the jump shot, we got to do that because we finished our hair.
More weeks leave and return, as you can see, nothing and everything was fine.
And if I do, if nine and you will see that same thing happen.
So it seems 20 is still fine, we didn't manage to corrupt the stag and of the application.
Now this is a trial and error, by the way, especially if you don't know how to quote.
Here we have the courts so we know how much we tried to cover up the stack.
But in general, it's trial and error.
So this time we're going to do is I'm going to add four more.
This time we are going to send actually in.
Twenty four, OK, so this time we're going to send 24.
Let's start again.
So we have started the application and go hear this one.
I want to jump over it, preparing this or this one.
OK, the computer is going to happen.
The jump.
I mean, I jump in because it's not going to happen to be solved because we have true values.
And then more than, uh, this one is to the, uh, function.
So let's go to the function one.
We want to do that.
And then we lost all of these iterative Forestier company so we can see there's a real destination.
As you can see, it's not changing, but this time we have a bigger value.
So let's see what's going to happen now.
So if I do have to jump over the if we can see this time we overbroad this is a 16 and these are the
eight modules again.
So overall, uh, twenty four bytes.
OK, let's see, let's continue and see what's going to happen.
So if seven and seven and then I'm going to jump or I don't want to go or the print.
So we are now back into Maine.
Let's continue here.
Wanted to.
I pressed seven by instinct.
OK, so you enter and I'm going to print this, I'm going to jump out of the print.
Uh, let's do that.
So vigilant and trying to find a spine and to look at what's going to happen now.
Look at look at this one.
What does that rotunda.
There's no I'll take the top on the stand, put in the EPA under the sun and what we have on the top
of the state, we have some of our parts than we do here.
What have the application powers?
And if I say if it says I can't continue, why?
Because the system doesn't know where this address is.
41 41, 41 41, which is the ease that you sent.
It doesn't know where this is.
OK, so this is either some location that application does not have access to or it doesn't exist.
So the application pressure.
So what we managed to do is if we go back here, by the way, to our explanation of image to the is
we managed to get The Baffler four by four, by four by four by looking at this very systemize.
And then we overrode EHP.
So that's why AVP also corrected, by the way.
But we also and that means topsides, but we also Ormerod on E IP and that's when we did return it to
those four bytes.
OK, so that's one that return it to the format this time.
That's to.
Let's see, um, um, we will add so we we did twenty, uh, twenty, uh, twenty or that for now let's
see twenty eight.
Let's just to twenty eight and say well we have won the state um my two cents of offers just to double
check.
OK again.
Stand on right once I start.
And again, this distance.
Is, uh, continue, continue, continue through the campaign, because it's my function, one that's
going to my function.
And, uh, so, OK, let's do the estimate.
Copy.
So I don't want to your company.
I mean, so now we can see that this other is is if we're following, um.
And so this time, the road and all of these, OK, so overbroad, more than let's continue and let's
continue.
This is this is shortly before.
Yeah, I want to jump over it, but it's because I have the break point, I keep forgetting that little
did you see this.
There is an event where I'm jumping over it.
We are jumping into it because of the one.
I don't see that.
I'm sorry I forgot about this remoted.
Removed and no longer work on the Hill.
OK, good.
Um, I'm glad it's, uh.
So let's do this again.
You under the valley and then I don't want you to pronounce I'm going to jump over it the next next
tax return.
So now where are we going to return that to the previous function, which is my form one.
Uh, we go back here, uh, do nothing and then will the OK, no.
Return where they want to go back there.
Um, I mean, so now we are at the main function.
Right.
Um, actually we don't uh we weren't able to go back by the way, because what we did is we corrupted
the application.
I'm sure if we did something wrong, we're.
OK.
Now, the certification in.
In the past year, 28.
Look.
Let's say again.
So we need to attach.
And this Mike.
Let's do if nine.
Uh, start, OK.
So if seven.
I'm going to jump over Compre, OK, and that I'm going to jump over it this time.
Now, this is were way to actually to that is this is the copy where the copy will happen.
So here we are now, we have designed this new source and let's see what's in the soil so we can see
in the source in this volume than the were going on copy hill so we can put it over here.
So it is going to be, you know, if I don't if it to jump over it, it got overwritten, as you can
see here.
And now X is pointing to the swallowers.
So now if I continue if I continue, I'm going to jump over.
This time I don't want to.
So we we're not going to integrate, create a play on, then return.
OK, so now when I do the return, we will go back to the main function.
But we didn't.
Why?
Because the app was all for it on eBay.
Was what, overwritten.
So what does it mean.
It means we need uh if we repeat that, um, now we Ormerod APIs.
So if we say we don't know how to return back to the main, uh, the previous function on the previous
screen, so let's start again.
But this time, uh, let's uh the only.
And not 20, not twenty eight.
I'm going to do 24.
20.
Yes, or rather than the difference between so two to four starts now.
Yes.
And that's the second and third execution with a stop at the Port NBP, where our breakpoint is listed
and next next next year, I'm gonna jump over this one.
Afraid so.
Confrere, jumped the shark who will continue, continue, continue.
And now I'm going to take this one.
I want to go the carpet and a all of that.
Now we have this very well.
This nation.
We will be.
So this is where we will be right.
Writing F7, OK, and now if I don't have it, I don't want to do the I'm going into it.
So this nation is here and this is the source is where our code is.
So if we follow this in dump into the Chauvin's.
But I'm gonna uh.
Let's skip that.
OK, just wanted to say, OK, so this is what our source is and this is where this nation is.
So by the way, this is on the site.
So we will be this here, actually here.
This is the one, so now if I do have AIDS there, you can see that what happened is we all were brought
up at the end at the address, the AIDS.
So we overbroad AIDS under that.
And so we have one, two, three, four, which is six imbibes, then, uh, four, which is 20 and
therefore which is 20, 28.
So we ordered all of this.
OK, so if you go back here.
Four for four.
That's 16, then the Ormerod, another for investment, the other form, twenty eight.
So we all rode up here with these four.
Let's check.
That's all we can next.
There's now this one that will take to my function to I don't want to do that.
I'm going to not let nobody return the show they take me.
It should take me back to my function.
And so it took me back to my function and everything is fine here, working on the job, so we easily
return.
Now look at what's, uh, what do we have on the top of what we have is our B..
So what does that mean?
It means me, Manjit.
We needed, uh, we needed, uh, four four four four, which is sixty miles.
We need to six timbers.
And we needed, uh, that other four bytes.
OK, we needed to order for abideth so we did 20 bytes and then 20, 20 fortified by the or the let's
say we need another four votes to override on e IP, which is is going to be ip y because.
No, if I do, if someone said it's going to be uh, when they return, what it will do is gonna pop
into IP and then IP will say, hey, I don't wanna have to execute it, I don't know where it is.
And so the program will be crushed so we can contain anywhere from here.
No, no, what we have here on the steg.
Is you see, this is where this is pointing to, it's pointing to this volume, so and where is this
pointing?
It's going to come is pointing to this location where our code exists.
Again, let's just look at this again so we have control over IP with this volume, so we manage it
and call to control the IP.
We have control over it because I managed to inject our code into it.
And if you look at the ISPs, it's pointing to the top of the stack, definitely.
But it's also pointing to the other causes, some of the characters.
OK, so what we can do it is we can do this now, this is where the assembly world comes into play and
again, we will in every new lesson we will of new skills and new techniques.
So you'll learn different ideas and different methods to the exploration and exploitation.
But for now, you know, what I'm going to do is to pay BASIX, because this is our first example I.
I'm going to search for.
Um, let's go to.
The libraries are the law that is in your memory.
OK, I'm going to, for example, Colonel 32 and we want to search for something which points to the
job E.S.P.
Why?
Because our record is at E.S.P.
If we can jump to the occasion, we can execute our call.
So let's go to Search Chromed and we want to jump ESPN and search.
It seems there is no jumping speed, so let's go back looking somewhere else in the right click search
zone.
Now, I know some of you might say, hey, this is your this is a library will be loaded every time
in a different place.
Forget about that for now.
We will get back to this.
We will get it to sorry later on the course.
For now.
Do we just want to find any jump so we can see that we have these?
Andrea is different.
So let's take this one and the one, the first one and the letter, right, until either we are going
to avoid that, but for now, let's avoid it and has some zeroes in it.
But as you remember, they are not, which terminates strings.
So they're going to avoid that for now.
Now, and let's take this let's go to this one and let's copy this address.
OK, so let's copy let's put a bullet point on it.
Very just.
So let's go back to here and write down this is one, OK?
We need to do that now.
We know what we need to do is an.
Uh, some.
What we need to do, we need to send this bill through the program.
So what I'm going to do is I'm going to start with you here.
What we need to do now is now do some corn, which we will be going in Python.
But I'm going to start this one.
So we will start in fresh water.
We will use some code written in Python, and we will pass this volume with our other string in order
to control the application.
And one thing that's probably due before I start the video on Alastair's I want to do here.
Uh, so probably the, uh, multiplied by, uh, let's say a hundred.
Uh, let's not just what's going to happen.
So.
For assemblyman's.
Uh, again, on the and start the problem that led us to execute, so we are here at seven seven seven,
seven, eight.
We want to jump over this and then continue, continue, continue.
We want to go into it because we want to see the copy.
So let's go there.
So here we have everything.
So we have the source.
And destination is our destination if we follow and this is where the corn is going to be written.
And now if I do jump over because I want to be executed, but I don't want to go into it.
So now we see that we managed to write a lot of A's and onto our stink.
See our got a lot of a spray tan on top of it.
OK, so let's continue now.
Lord, Lord, I want to avoid this because I don't need it anymore, which is fun.
I'm going to just break and I believe will return now when I do to return.
What's going to happen is one of these sort of this one actually and this one is P is pointing to CCB.
It's pointing over the top of the stack.
So now if I put this value into the return, what it will do is we will copy this money into IP and
we will go to execute that.
So if I put the address of Jump XP here, I will be executing.
It is called.
OK, so, again, if I put the address of a jump ESP instruction, OK, so then what will happen is
when we do the return, the return, the carpet is into Eppy and people go to executed what is in their
jumpier space.
So we will come back and execute to court, which is in here.
So now we have control over, uh, our program.