blasty / ssh_rape

38 stars 14 forks source link

Added alternative privsep load search for movs. #9

Closed rsjrs closed 9 years ago

rsjrs commented 9 years ago

Sometimes the lea use_privsep instruction is compiled as a mov use_privsep_ptr; mov eax, [rax] This is a pointer in the .got. This patch tries to first find the direct lea instruction, and only if that cannot be found searches the got for this pointer and then continues to search for a similar mov instruction.