diff options
Diffstat (limited to 'haunt/posts/bad-behavior.org')
| -rw-r--r-- | haunt/posts/bad-behavior.org | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/haunt/posts/bad-behavior.org b/haunt/posts/bad-behavior.org index a5c9dbe..a8658ff 100644 --- a/haunt/posts/bad-behavior.org +++ b/haunt/posts/bad-behavior.org @@ -157,7 +157,7 @@ about in a little bit. Let's jump in and craft a BEHAVIOR lump which calls =PUSHBYTE= a bunch of times. #+CAPTION: A screenshot of my terminal showing an abrupt end to the debug prints I added for inspecting the absolute memory addresses of SStack and VStack. -[[./debug-prints.png]] +[[./bad-behavior-debug-prints.png]] We seem to end prematurely, which is because we hit the stack pointer. We will have to modify our exploit to step over it somehow, which we can do by @@ -185,4 +185,4 @@ disclosing this to the development team, we discovered that vanilla Hexen has this same arbitrary code execution vulnerability. No proof-of-concept yet. #+CAPTION: One of my posts in an internal discussion on the GZDoom forums regarding the same exploit existing in the vanilla Hexen code. -[[./vanilla-hexen-vulnerability.png]] +[[./bad-behavior-vanilla-hexen-vulnerability.png]] |