forensicsProeasy
Forenser Canary
spbctf
Task: given a raw stack memory dump of a Linux x86_64 process (0x21000 bytes matching a VA range), recover the glibc stack canary. Solution: scan the dump for 8-byte aligned qwords with low byte 0x00 and non-zero upper 7 bytes (terminator canary pattern) and pick the most frequent clustered value.
$ ls tags/ techniques/
frequency_analysisstack_memory_analysisqword_alignment_scanglibc_canary_structure
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [forensics][Pro]Forenser Retaddr— spbctf
- [pwn][Pro]stackgift— spbctf
- [pwn][Pro]Canary leak + ret2win (string_leak)— spbctf
- [pwn][free]Scanner— hackthebox
- [forensics][Pro]Forenser RBP— spbctf