<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Vreugdenhil Research</title>
	<atom:link href="http://vreugdenhilresearch.nl/feed/" rel="self" type="application/rss+xml" />
	<link>http://vreugdenhilresearch.nl</link>
	<description>Research, Vulnerabilities and Exploits</description>
	<lastBuildDate>Fri, 17 Jun 2011 16:59:01 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.1</generator>
		<item>
		<title>WinDBG Scripting, finding ROP gadgets</title>
		<link>http://vreugdenhilresearch.nl/windbg-scripting-finding-rop-gadgets/</link>
		<comments>http://vreugdenhilresearch.nl/windbg-scripting-finding-rop-gadgets/#comments</comments>
		<pubDate>Fri, 17 Jun 2011 16:58:36 +0000</pubDate>
		<dc:creator>Peter</dc:creator>
				<category><![CDATA[research]]></category>
		<category><![CDATA[Uncategorized]]></category>
		<category><![CDATA[WinDBG]]></category>

		<guid isPermaLink="false">http://vreugdenhilresearch.nl/?p=221</guid>
		<description><![CDATA[Finding all ROP gadgets with windbg using only windbg scripting? It can be done. !for_each_module ".if(not(wo(dwo(${@#Base}+0x3c)+${@#Base}+46+18) &#038; 0x40)) {r @$t3 = @#End - @#Base;.foreach /s (retn \"C2 C3\") {.foreach (f {s -[1]b @#Base L@$t3 ${retn}}) {.for(r @$t0 = 1; @$t0 < 4; r @$t0 = @$t0 + 1) {r @$t1 = 0;.foreach (g {.catch {u [...]]]></description>
		<wfw:commentRss>http://vreugdenhilresearch.nl/windbg-scripting-finding-rop-gadgets/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>PoC for MS10-071</title>
		<link>http://vreugdenhilresearch.nl/poc-for-ms10-071/</link>
		<comments>http://vreugdenhilresearch.nl/poc-for-ms10-071/#comments</comments>
		<pubDate>Tue, 26 Apr 2011 16:53:36 +0000</pubDate>
		<dc:creator>Peter</dc:creator>
				<category><![CDATA[exploits]]></category>
		<category><![CDATA[research]]></category>

		<guid isPermaLink="false">http://vreugdenhilresearch.nl/?p=216</guid>
		<description><![CDATA[Here is a PoC for MS10-071 Its nice vulnerability that allows for information disclosure and triggering a use-after-free. The PoC should be able to fetch the address for mshtml.dll and then trigger a use-after-free ending the execution at eip 0&#215;41414141 or referencing a vftable at 0&#215;41414141 I forgot what it did. Anyways, no explanations only [...]]]></description>
		<wfw:commentRss>http://vreugdenhilresearch.nl/poc-for-ms10-071/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>MS11-002 Pwn2Own heap overflow</title>
		<link>http://vreugdenhilresearch.nl/ms11-002-pwn2own-heap-overflow/</link>
		<comments>http://vreugdenhilresearch.nl/ms11-002-pwn2own-heap-overflow/#comments</comments>
		<pubDate>Wed, 12 Jan 2011 15:19:51 +0000</pubDate>
		<dc:creator>Peter</dc:creator>
				<category><![CDATA[Uncategorized]]></category>

		<guid isPermaLink="false">http://vreugdenhilresearch.nl/?p=197</guid>
		<description><![CDATA[Today Microsoft patched the heap overflow I used in pwn2own 2010. The vulnerability was a int wrap during heap allocation. The small allocation was later used to store a bit more information then would fit in there. More specifically: &#60;XML ID=&#34;xmlid1&#34;&#62; &#60;Devices&#62; &#60;Device&#62; &#60;AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA /&#62; &#60;/Device&#62; &#60;/Devices&#62; &#60;/XML&#62;&#60;/pre&#62; Inside an HTML file would give you [...]]]></description>
		<wfw:commentRss>http://vreugdenhilresearch.nl/ms11-002-pwn2own-heap-overflow/feed/</wfw:commentRss>
		<slash:comments>8</slash:comments>
		</item>
		<item>
		<title>IDAPython script to copy cursor location to clipboard</title>
		<link>http://vreugdenhilresearch.nl/idapython-script-to-copy-cursor-location-to-clipboard/</link>
		<comments>http://vreugdenhilresearch.nl/idapython-script-to-copy-cursor-location-to-clipboard/#comments</comments>
		<pubDate>Fri, 15 Oct 2010 14:47:21 +0000</pubDate>
		<dc:creator>Peter</dc:creator>
				<category><![CDATA[Uncategorized]]></category>

		<guid isPermaLink="false">http://vreugdenhilresearch.nl/?p=182</guid>
		<description><![CDATA[Below is a small IDAPython script that will copy the location of the current address you are looking at to your windows clipboard. I use it to copy paste from IDA to WinDBG which is why it currently uses &#8216;module + offset&#8217;, for example &#8216;ntdll + 0&#215;1234&#8242;. This way it doesn&#8217;t matter if the module [...]]]></description>
		<wfw:commentRss>http://vreugdenhilresearch.nl/idapython-script-to-copy-cursor-location-to-clipboard/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Java midi parse vulnerabilities</title>
		<link>http://vreugdenhilresearch.nl/java-midi-parse-vulnerabilities/</link>
		<comments>http://vreugdenhilresearch.nl/java-midi-parse-vulnerabilities/#comments</comments>
		<pubDate>Fri, 21 May 2010 14:09:49 +0000</pubDate>
		<dc:creator>Peter</dc:creator>
				<category><![CDATA[exploits]]></category>
		<category><![CDATA[research]]></category>

		<guid isPermaLink="false">http://vreugdenhilresearch.nl/?p=80</guid>
		<description><![CDATA[Index Introduction Basic information on Java Java and sound files Null byte write to stack User supplied function pointer call Heap overflow Links Introduction A while back I found some vulnerabilities in the way java handles certain audio files. Those problems were fixed in Java update 19, and since anyone who did not yet install [...]]]></description>
		<wfw:commentRss>http://vreugdenhilresearch.nl/java-midi-parse-vulnerabilities/feed/</wfw:commentRss>
		<slash:comments>6</slash:comments>
		</item>
		<item>
		<title>Old bugs: YaBB</title>
		<link>http://vreugdenhilresearch.nl/old-bugs-yabb/</link>
		<comments>http://vreugdenhilresearch.nl/old-bugs-yabb/#comments</comments>
		<pubDate>Mon, 08 Feb 2010 16:41:51 +0000</pubDate>
		<dc:creator>Peter</dc:creator>
				<category><![CDATA[exploits]]></category>
		<category><![CDATA[exploit]]></category>
		<category><![CDATA[POC]]></category>
		<category><![CDATA[research]]></category>
		<category><![CDATA[vulnerabilities]]></category>

		<guid isPermaLink="false">http://vreugdenhilresearch.nl/?p=63</guid>
		<description><![CDATA[I decided to write up on some old and funny bugs I found a while back. Starting today with &#8216;remote&#8217; code execution in YaBB version 2.2 the problem is fixed in 2.4 (or so it seems at first glance) YaBB (yet another bulletin board) is as the name says a bulletin board. Its written in [...]]]></description>
		<wfw:commentRss>http://vreugdenhilresearch.nl/old-bugs-yabb/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>ICQ Exploit CVE-2006-5650</title>
		<link>http://vreugdenhilresearch.nl/icq-exploit-cve-2006-5650/</link>
		<comments>http://vreugdenhilresearch.nl/icq-exploit-cve-2006-5650/#comments</comments>
		<pubDate>Mon, 06 Jul 2009 15:54:02 +0000</pubDate>
		<dc:creator>Peter</dc:creator>
				<category><![CDATA[exploits]]></category>
		<category><![CDATA[research]]></category>
		<category><![CDATA[ActiveX]]></category>
		<category><![CDATA[CVE]]></category>
		<category><![CDATA[CVE-2006-5650]]></category>
		<category><![CDATA[exploit]]></category>
		<category><![CDATA[ICQ]]></category>
		<category><![CDATA[POC]]></category>

		<guid isPermaLink="false">http://vreugdenhilresearch.nl/?p=26</guid>
		<description><![CDATA[I'll kick off with imho one of my more interresting findings. Its not interresting due to the nature of the vulnerability, but due to the possible impact. It was quite some time ago already, back in the summer of 2006 when I was looking into COM objects that came installed with ICQ. If you're unfamiliair with COM objects and how that 'sneak' in with program installations, I suggest you read this article. Anyway, installing ICQ added a few COM objects that were accesible as ActiveX Objects in IE6 without warning. Most of them were a bit boring, but there was a nice design error in one of them]]></description>
		<wfw:commentRss>http://vreugdenhilresearch.nl/icq-exploit-cve-2006-5650/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>How it began</title>
		<link>http://vreugdenhilresearch.nl/in-the-beginning/</link>
		<comments>http://vreugdenhilresearch.nl/in-the-beginning/#comments</comments>
		<pubDate>Tue, 30 Jun 2009 19:09:57 +0000</pubDate>
		<dc:creator>Peter</dc:creator>
				<category><![CDATA[Uncategorized]]></category>
		<category><![CDATA[research]]></category>
		<category><![CDATA[vulnerabilities]]></category>
		<category><![CDATA[welcome]]></category>

		<guid isPermaLink="false">http://vreugdenhilresearch.nl/?p=3</guid>
		<description><![CDATA[Although this is my first post I have been searching for vulnerabilities since 1998. Back then it was mostly unsafe php includes and evals,  and there were a lot them. I can remember them all, but funnily enough some still show up in google searches. But I doubt anyone will be interrested in those anymore so I'll try to write more about my recent work. Most of my research I sell to either ZDI or iDefense so I wont be able to disclose much of them untill they are published. But since Im not a strong believer in fulldisclosure anyway I have no problem with that :) For some of my work I will post POC and detailed analyses when I have the time, others I wont even mention.

]]></description>
		<wfw:commentRss>http://vreugdenhilresearch.nl/in-the-beginning/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
	</channel>
</rss>
