rh0dev / expdev Goto Github PK

Hi! I am learning your vuln realization and have one problen. When we change EIP (in WinDBG) cmd.exe should be start, but processExplorer dont detect it. Can you explain in more detail how to change the EIP register.

hi,
I was exploring your write up for CVE-2016-2819 using CVE-2017-5375 and got stuck at a point where you have introduced fake_objects in the function Exploit.prototype.spray and only those particular index of fake_objects is targeted.

hello , rh0dev！
I read you blog which write about the leak.In the end of article,you say: we call the ActiveX plugin’s Play method inside JavaScript (#256). This executes call [EAX + 0x30] with EAX pointing to the ovewritten field containing the address of our ROP chain.But when I disassemble it in IDA,I can't find the play function.I have to try find string:play in the String Window.I have not find the instruction:call [EAX + 0x30] in the disassemble of search,on the contrary ,found it in the function SetSliderPosition. I don't find that two links,can you give me more detials,thank you very much!