Conversation

namazso
@namazso
that's no stack spoofing whatsoever, thats an invalid unwind. you can achieve the same with a tweetable piece of code: `*(void**)_AddressOfReturnAddress() = CreateFileW;`
4
15
mgeeky | Mariusz Banach
@mariuszbit
Since the outcome is the same, resulting in a fake call stack - what's the deal whether the implementation is similar to the Nighthawk's one or not? Would you rather call it "Call Stack Spoofing" instead?
1
1
namazso
@namazso
no, yours doesn't do that either. Since frame size in x64 unwinding depends on rip as written in documentation i linked, and not rbp, the whole unwinding gets out of track on the very first frame you "spoof" (corrupt)
1
4
namazso
@namazso
If you'd even just take a look at your own screenshot, you'd see every fake "frame" is 8 bytes - since CreateFileW is a leaf function. Also leafs may never call, your frames are misaligned, and your last frame unwind to an invalid rip, blatantly leaving non-unwound stack remainin
3
Likes