From my research, I found two more return addresses in the SQLSORT.DLL and
there are much more return addresses in others DDLs. The best way to find
return addresses is launching your preferred disassembler and search for
them, and the easiest way to find a huge list of return address is use
someone’s research. In this case I have found a huge number of possible
return addresses using the great OpcodeDB9, by HD Moore and Matt Miller.
Here is some possible return addresses and respective Microsoft Windows OS
version:
1. Microsoft Windows 2000 SP0:
* 0x750362c3 (“jmp esp” @ ws2_32.dll)
lent code to the framework.
These projects include the METASM pure-ruby assembler developed by
Yoann Guillot and Julien Tinnes, the "Hacking the iPhone" effort
outlined in the Metasploit Blog, the Windows kernel-land payload
staging system developed by Matt Miller, the heapLib browser
exploitation library written by Alexander Sotirov, the Lorcon 802.11
raw transmit library created by Joshua Wright and Mike Kershaw, Scruby,
the Ruby port of Philippe Biondi's Scapy project, developed by Sylvain
Sarmejeanne, and a contextual encoding system for Metasploit payloads.
"Contextual encoding breaks most forms of shellcode analysis by
- Dan Kaminsky, Black Ops 2007: Design Reviewing the Web
- Charles Miller, Fuzzing with Code Coverage by Example
- Remorse, Textella: An Alternative Application of Peer to Peer
Structured Networks
- Matt Miller, Cthulhu: A software analysis framework built on Phoenix
- Scott Moulton, Advanced Hacking Flash/Hard Drive Recoveries
- Jerome Athias, Speeding up the exploits' development process
- Richard Johnson, AutoHacking with Phoenix Enabled Data Flow Analysis
- Travis Goodspeed, Exploiting Wireless Sensor Networks over 802.15.4
- Brandon Enright, Exposing Stormworm
- Dan Kaminsky, Black Ops 2007: Design Reviewing the Web
- Charles Miller, Fuzzing with Code Coverage by Example
- Remorse, Textella: An Alternative Application of Peer to Peer
Structured Networks
- Matt Miller, Cthulhu: A software analysis framework built on Phoenix
- Scott Moulton, Advanced Hacking Flash/Hard Drive Recoveries
- Jerome Athias, Speeding up the exploits' development process
- Richard Johnson, AutoHacking with Phoenix Enabled Data Flow Analysis
- Travis Goodspeed, Exploiting Wireless Sensor Networks over 802.15.4
- Brandon Enright, Exposing Stormworm
