Comments for Didier Stevens http://blog.didierstevens.com (blog 'DidierStevens) Sat, 04 Feb 2012 06:57:23 +0000 hourly 1 http://wordpress.com/ Comment on x64 Windows Shellcode by Didier Stevens http://blog.didierstevens.com/2012/02/02/x64-windows-shellcode/#comment-50350 Sat, 04 Feb 2012 06:57:23 +0000 http://blog.didierstevens.com/?p=2986#comment-50350 yep, same source

]]> Comment on x64 Windows Shellcode by ange http://blog.didierstevens.com/2012/02/02/x64-windows-shellcode/#comment-50334 Fri, 03 Feb 2012 20:44:29 +0000 http://blog.didierstevens.com/?p=2986#comment-50334 I see we have similar ideas – http://code.google.com/p/corkami/source/browse/trunk/asm/ports/mcdermott64.asm?r=959

]]> Comment on Shellcode by x64 Windows Shellcode « Didier Stevens http://blog.didierstevens.com/programs/shellcode/#comment-50305 Thu, 02 Feb 2012 20:00:49 +0000 http://blog.didierstevens.com/?page_id=2001#comment-50305 [...] can get the code from my shellcode page. Look for filenames starting with sc-x64 in the zip file. Like this:LikeBe the first to like this [...]

]]> Comment on LoadDLLViaAppInit with FORCE_INTEGRITY by Didier Stevens http://blog.didierstevens.com/2011/12/09/loaddllviaappinit-with-force_integrity/#comment-50157 Sun, 29 Jan 2012 07:31:41 +0000 http://blog.didierstevens.com/?p=2928#comment-50157 No, it does not. If it doesn’t work on your machine, something else is wrong.

]]> Comment on Escape From PDF by Didier Stevens http://blog.didierstevens.com/2010/03/29/escape-from-pdf/#comment-50155 Sun, 29 Jan 2012 07:30:04 +0000 http://blog.didierstevens.com/?p=2094#comment-50155 No, it does not. Windows does not prevent you from installing vulnerable apps.

]]> Comment on LoadDLLViaAppInit with FORCE_INTEGRITY by xpclient http://blog.didierstevens.com/2011/12/09/loaddllviaappinit-with-force_integrity/#comment-50086 Fri, 27 Jan 2012 07:35:30 +0000 http://blog.didierstevens.com/?p=2928#comment-50086 Windows still only supports short (8.3) file names for AppInit_DLLs right so maybe you should rename it. :)

]]> Comment on Force “ASLR” on Shell Extensions by xpclient http://blog.didierstevens.com/2011/08/10/force-aslr-on-shell-extensions/#comment-50085 Fri, 27 Jan 2012 07:30:35 +0000 http://blog.didierstevens.com/?p=2736#comment-50085 Okay sorry I found the newer blog post with the signed DLL. :)

]]> Comment on Force “ASLR” on Shell Extensions by xpclient http://blog.didierstevens.com/2011/08/10/force-aslr-on-shell-extensions/#comment-50083 Fri, 27 Jan 2012 07:08:51 +0000 http://blog.didierstevens.com/?p=2736#comment-50083 According to http://msdn.microsoft.com/en-us/library/dd744762(v=vs.85).aspx, in Vista and later, value of LoadAppInit_DLLs must be set to 1 to enable AppInit_DLLs and Windows 7 supports loading only digitally signed DLLs so maybe you should sign SE_ASLR.dll.

]]> Comment on Escape From PDF by Anon http://blog.didierstevens.com/2010/03/29/escape-from-pdf/#comment-50081 Fri, 27 Jan 2012 00:48:19 +0000 http://blog.didierstevens.com/?p=2094#comment-50081 I have got Adober Reader 9.3.1 but it wont install, it throws up an error message so does that mean this exploit is now technically impossible because it seems Adobe or Windows wont allow Adobe 9.3.1 to be installed anywhere

]]> Comment on Escape From PDF by Anon http://blog.didierstevens.com/2010/03/29/escape-from-pdf/#comment-50080 Fri, 27 Jan 2012 00:44:56 +0000 http://blog.didierstevens.com/?p=2094#comment-50080 So if I use Adobe Reader 9.3.1 and Windows 7 this will still work?

]]>