Open mschaefers opened 4 years ago
first i would test the vulnerability itself and would try to exploit it without aslr. you can do it by telnetting to the device and attaching gdb to Sofia. if it works, you can identify the memory region, and you can try to implement the magical guess. look for the remote gdb section here if you need hints: https://github.com/tothi/pwn-hisilicon-dvr#remote-gdb
when I run your exploit on my old Xiongmai cam, it can not guess the correct stack section base, because all my 8188 byte long entries have an Rss size of at least 8k:
Any idea on how to adapt the guessing algorithm to this model? (more model infos below)
More Model Infos:
Hardware is detected as
50H10L