I85PREP
⌘ K
OSED study materials
OSED study resources

OSED: Bypassing DEP and ASLR

OSED · Work through your exam, one topic at a time.

All guide sections

Bypassing DEP and ASLR

Bypassing DEP and ASLR

With DEP the stack and heap are non-executable, so a jmp esp landing faults; with ASLR module bases move, so gadget and API addresses are unknown until leaked. This domain tests building a ROP chain that restores executability and pairing it with a way to learn a base address.

Core rules

  • A ROP chain is data treated as code: each ret pops the next dword into EIP, so the stack layout is the program.
  • The standard target is VirtualProtect(lpAddress, dwSize, flNewProtect, lpflOldProtect). 0x40 is PAGE_EXECUTE_READWRITE; 0x04 is PAGE_READWRITE and will not let you execute. The fourth argument needs a writable dword - reuse a pointer into your own buffer or a .data address.
  • Gadgets you should be able to find quickly: pop reg; ret for each register you need, mov [reg], reg; ret to patch argument slots, and a stack pivot such as xchg eax, esp; ret when the chain must move into a larger buffer.
  • ASLR defeat options, in order of preference: a module linked without /DYNAMICBASE, an information leak turned into a base address, or a partial overwrite of a saved pointer whose high bytes are unchanged.

Worked example

A 512-byte overflow. Lay the chain as: address of VirtualProtect, then the return address to resume at after the call, then lpAddress (start of the buffer), 0x1000, 0x40, and a writable scratch dword. Reasoning: a stdcall callee expects [esp] to be its return address and [esp+4] onward to be the arguments in declared order, so the chain is just a literal frame. When an argument must be computed at runtime, insert pop reg; ret plus mov [mem], reg; ret before the call to patch that slot.

Traps that cost marks

  • Passing 0x04 instead of 0x40, or a zero size, and then wondering why the shellcode still faults.
  • Gadget addresses containing bad characters, silently truncating the whole chain.
  • Forgetting stack cleanup after the API call - an extra padding dword is normal.
  • Assuming system DLLs are ASLR-free on modern Windows; check the application's own modules.