Windows ROP
General
VirtualAlloc Shellcode with RWX
Virtual Alloc can allocate memory or change the permissions on existing one.
The function address in kernel32 can be fetched from a modules IAT at runtime
WriteProcessMemory
WriteProcessMemory will automatically make the target Page writeable - so it is possible to copy to a RX Page and then jump there.
Resources
Last updated