freshlosa.blogg.se

Ollydbg search for assembly sequences
Ollydbg search for assembly sequences





ollydbg search for assembly sequences

The bind system call is the most difficult because it requires a pointer to a structure. When the socket system call is executed, we have to store its return value at a safe place because that value has to be used as the argument of the bind, listen, and accept system calls.

ollydbg search for assembly sequences ollydbg search for assembly sequences

The socket system call (line 14) is very easy because all arguments are integers. In order to bind a shell to a port, we need to execute the socket (line 14), bind(line 15), listen (line 16), accept (line 17), dup2 (lines 18 through 20), and execve (line 21) system calls successfully. Foster, Mike Price, in Sockets, Shellcode, Porting, & Coding, 2005 Analysis







Ollydbg search for assembly sequences