Introduction to memory exploitation
summary
Claims that heap exploitation stays relevant and practical get demonstrated: coverage-guided fuzzing combined with AddressSanitizer reliably turns latent memory bugs into reproducible crashes; Heartbleed lets attackers dump large chunks of process memory and sometimes the entire virtual address space; a tiny integer‑size bug plus heap spray and careful heap grooming enables remote install of the DoublePulsar backdoor via SMBv1 (EternalBlue), which indeed worked and later powered rapid worming ransomware.
AI-written summary · about
chapters (32)
- 0:00Introduction
- 3:35Information leaks
- 4:50Heartbleed fuzzing
- 5:46Patricia Aas
- 6:39Coverage guided fuzzing
- 11:09Finding memory errors
- 12:39Using AddressSanitizer
- 13:31AddressSanitizer
- 15:46Fuzzing
- 17:50Exploitation
- 18:19The Weird Machine
- 20:26The Programmers Model
- 21:45Shell Code
- 23:44Exploit Components
- 24:25Code Execution
- 25:39Primitives
- 27:44Mitigations
- 29:54Cleaning memory
- 31:19How heap exploitation works
- 33:45How to exploit heap exploitation
- 34:54How it works
- 35:21NoOps sled
- 36:56Heat grooming
- 37:47Shadow Brokers
- 38:46Windows SMBV1
- 40:05Eternal Exploits
- 41:00Kernel Blue
- 41:17Main bug
- 43:58Heap grooming
- 47:13Eternal Blue
- 50:17Bugs
- 51:20QA
