Windows Exploitation Tricks: Abusing the User-Mode Debugger

tomglynch wrote: post #5

Larrikin wrote: post #3

Earlier quoted context omitted.

Google owns it.

They don't host their 'cloud' blog on blogspot: https://cloud.google.com/blog/topics/inside-google-cloud/an-... So why project zero?

It was probably the easiest route. Instead of setting up a special website for it, they just made a blog with a couple of clicks. Project zero goes back to 2014. Perhaps the infrastructure wasn't there, or it started as a small pilot project.

Re: Windows Exploitation Tricks: Abusing the User-Mode Debugger

#7

Post by drejay » Tue, Jun 04, 2019, 7:04 AM UTC

Should you need the services of a good hacker, talk to darkcracker@protonmail.com, dude is good.

Re: Windows Exploitation Tricks: Abusing the User-Mode Debugger

#8

Post by maxheadroom » Tue, Jun 04, 2019, 7:26 AM UTC

>Windows Exploitation Tricks: Abusing the User-Mode Debugger

...and...

>Nothing I’ve described here is a security vulnerability, but the behavior is interesting and it’s worth looking out for cases where it could be used.

Maybe I'm misunderstanding this newfangled internets but isn't exploitation generally synonymous with security vulnerability?

JFYI, for anyone who's interested, the equivalent debugging API methods in .NET could be found in ClrMd[0] but it's as unyielding a beast as the native methods.

[0] - https://github.com/microsoft/clrmd

Re: Windows Exploitation Tricks: Abusing the User-Mode Debugger

#9

Post by AstralStorm » Tue, Jun 04, 2019, 7:52 AM UTC

tomglynch wrote: post #5

Larrikin wrote: post #3

Earlier quoted context omitted.

Google owns it.

They don't host their 'cloud' blog on blogspot: https://cloud.google.com/blog/topics/inside-google-cloud/an-... So why project zero?

They probably do host Blogspot on their cloud though.

Re: Windows Exploitation Tricks: Abusing the User-Mode Debugger

#10

Post by XMPPwocky » Tue, Jun 04, 2019, 8:02 AM UTC

maxheadroom wrote: post #8

> Windows Exploitation Tricks: Abusing the User-Mode Debugger ...and... > Nothing I’ve described here is a security vulnerability, but the behavior is interesting and it’s worth looking out for cases where it could be used. Maybe I'm misunderstanding this newfangled internets but isn't exploitation generally synonymous with security vulnerability? JFYI, for anyone who's interested, the equivalent debugging API method…

A vulnerability is "this function will write 8 bytes of arbitrary data out of bounds in an edge case". Exploitation is the process of using that vulnerability to, typically, cause the process to execute attacker-controlled code.

Something can make exploitation easier without being a vulnerability. For example, disabling exploit mitigations like ASLR does this.