Amy B @nyanbox.stackchk.fail · Jan 12 We can place Controlled-Data after the Array, which Splice will read Out-Of-Bounds This gives us the Rite Of The Type Forgery, allowing us to Forge an arbitrary Object if we know a Memory Address (to bypass ASLR)
0 likes 1 replies
?
Replies
Leaking a Memory Address was the most difficult part! Eventually I realized I could read the Uninitialized padding inside heap allocations. Through heap manipulation this value could be a Pointer By overwriting the lowest byte with 00000101 the Pointer would be read as a Float