diff options
Diffstat (limited to 'md/writeup/scan_memory_for_variable.md')
| -rw-r--r-- | md/writeup/scan_memory_for_variable.md | 18 |
1 files changed, 9 insertions, 9 deletions
diff --git a/md/writeup/scan_memory_for_variable.md b/md/writeup/scan_memory_for_variable.md index c3903db..f50c229 100644 --- a/md/writeup/scan_memory_for_variable.md +++ b/md/writeup/scan_memory_for_variable.md @@ -43,18 +43,18 @@ find tmp and secret_dw. compile example with -`` +```bash make -`` +``` and run -``` +```bash ./example ``` And in parallel run -``` +```bash $ scanmem `pidof example` scanmem version 0.11 Copyright (C) 2009,2010 Tavis Ormandy, Eli Dupree, WANG Lu @@ -74,12 +74,12 @@ As we searching 4 byte value of uint we defining it by setting up option Now we ready to start our game. At beginning we know our secret_dw value it is 1000 but we will not use it. Type 1 in example -``` +```text secret_dw was 1000 ``` in scanmem -``` +```text 0> 1 info: 01/05 searching 0x8049000 - 0x804a000...........ok info: 02/05 searching 0xb763d000 - 0xb763e000...........ok @@ -96,7 +96,7 @@ secret_dw was 1 in scanmem -``` +```text 58> 1000 ..........info: we currently have 2 matches. ``` @@ -105,7 +105,7 @@ only 2 now scanmem has also many built in commands you can see them when type help. One of them is 'list'. Use it. -``` +```text 2> list [ 0] 0x8049680, 1000, [I32 ] [ 1] 0xbf9f2dd8, 1000, [I32 ] @@ -114,7 +114,7 @@ One of them is 'list'. Use it. Here is list of matched variables. Number,address,value,size. By address we see that our variable is with number 0. -``` +```text 2> set 0=999 info: setting *0x8049680 to 0x3e7... 2> list |