I comprehend Zen in the question of writing shellcoding and faced with the problem:
There is a vulnerable application with the usual BoF, but the place for shellcode in it is very limited - only 140 bytes.
I would like to cram a working runpe method there (running an application from memory)
Obviously, it will not fit in its pure form, egghunt is not an option (data> 140 bytes irretrievably go and you can’t do a jump on it)
I decided to do this: the second stage is in the file, using createfile + mapview, etc. stage mapping to memory and jmp is done there
The size of the file name is 10 bytes (i.e. there are only 130 bytes of space left). Functions and functions are dynamically searched through peb.
Question: Is it possible to fit in this size? (I ask the question because I am a newbie at shellcoding, and my own went for 200 bytes)
I would be very grateful for living examples, perhaps variants of very compressed search or hashing algorithms (function search or hash)
There is a vulnerable application with the usual BoF, but the place for shellcode in it is very limited - only 140 bytes.
I would like to cram a working runpe method there (running an application from memory)
Obviously, it will not fit in its pure form, egghunt is not an option (data> 140 bytes irretrievably go and you can’t do a jump on it)
I decided to do this: the second stage is in the file, using createfile + mapview, etc. stage mapping to memory and jmp is done there
The size of the file name is 10 bytes (i.e. there are only 130 bytes of space left). Functions and functions are dynamically searched through peb.
Question: Is it possible to fit in this size? (I ask the question because I am a newbie at shellcoding, and my own went for 200 bytes)
I would be very grateful for living examples, perhaps variants of very compressed search or hashing algorithms (function search or hash)