<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Vreugdenhil Research &#187; Uncategorized</title>
	<atom:link href="http://vreugdenhilresearch.nl/topics/uncategorized/feed/" rel="self" type="application/rss+xml" />
	<link>http://vreugdenhilresearch.nl</link>
	<description>Research, Vulnerabilities and Exploits</description>
	<lastBuildDate>Fri, 17 Jun 2011 16:59:01 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.1</generator>
		<item>
		<title>WinDBG Scripting, finding ROP gadgets</title>
		<link>http://vreugdenhilresearch.nl/windbg-scripting-finding-rop-gadgets/</link>
		<comments>http://vreugdenhilresearch.nl/windbg-scripting-finding-rop-gadgets/#comments</comments>
		<pubDate>Fri, 17 Jun 2011 16:58:36 +0000</pubDate>
		<dc:creator>Peter</dc:creator>
				<category><![CDATA[research]]></category>
		<category><![CDATA[Uncategorized]]></category>
		<category><![CDATA[WinDBG]]></category>

		<guid isPermaLink="false">http://vreugdenhilresearch.nl/?p=221</guid>
		<description><![CDATA[Finding all ROP gadgets with windbg using only windbg scripting? It can be done. !for_each_module ".if(not(wo(dwo(${@#Base}+0x3c)+${@#Base}+46+18) &#038; 0x40)) {r @$t3 = @#End - @#Base;.foreach /s (retn \"C2 C3\") {.foreach (f {s -[1]b @#Base L@$t3 ${retn}}) {.for(r @$t0 = 1; @$t0 < 4; r @$t0 = @$t0 + 1) {r @$t1 = 0;.foreach (g {.catch {u [...]]]></description>
		<wfw:commentRss>http://vreugdenhilresearch.nl/windbg-scripting-finding-rop-gadgets/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>MS11-002 Pwn2Own heap overflow</title>
		<link>http://vreugdenhilresearch.nl/ms11-002-pwn2own-heap-overflow/</link>
		<comments>http://vreugdenhilresearch.nl/ms11-002-pwn2own-heap-overflow/#comments</comments>
		<pubDate>Wed, 12 Jan 2011 15:19:51 +0000</pubDate>
		<dc:creator>Peter</dc:creator>
				<category><![CDATA[Uncategorized]]></category>

		<guid isPermaLink="false">http://vreugdenhilresearch.nl/?p=197</guid>
		<description><![CDATA[Today Microsoft patched the heap overflow I used in pwn2own 2010. The vulnerability was a int wrap during heap allocation. The small allocation was later used to store a bit more information then would fit in there. More specifically: &#60;XML ID=&#34;xmlid1&#34;&#62; &#60;Devices&#62; &#60;Device&#62; &#60;AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA /&#62; &#60;/Device&#62; &#60;/Devices&#62; &#60;/XML&#62;&#60;/pre&#62; Inside an HTML file would give you [...]]]></description>
		<wfw:commentRss>http://vreugdenhilresearch.nl/ms11-002-pwn2own-heap-overflow/feed/</wfw:commentRss>
		<slash:comments>8</slash:comments>
		</item>
		<item>
		<title>IDAPython script to copy cursor location to clipboard</title>
		<link>http://vreugdenhilresearch.nl/idapython-script-to-copy-cursor-location-to-clipboard/</link>
		<comments>http://vreugdenhilresearch.nl/idapython-script-to-copy-cursor-location-to-clipboard/#comments</comments>
		<pubDate>Fri, 15 Oct 2010 14:47:21 +0000</pubDate>
		<dc:creator>Peter</dc:creator>
				<category><![CDATA[Uncategorized]]></category>

		<guid isPermaLink="false">http://vreugdenhilresearch.nl/?p=182</guid>
		<description><![CDATA[Below is a small IDAPython script that will copy the location of the current address you are looking at to your windows clipboard. I use it to copy paste from IDA to WinDBG which is why it currently uses &#8216;module + offset&#8217;, for example &#8216;ntdll + 0&#215;1234&#8242;. This way it doesn&#8217;t matter if the module [...]]]></description>
		<wfw:commentRss>http://vreugdenhilresearch.nl/idapython-script-to-copy-cursor-location-to-clipboard/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>How it began</title>
		<link>http://vreugdenhilresearch.nl/in-the-beginning/</link>
		<comments>http://vreugdenhilresearch.nl/in-the-beginning/#comments</comments>
		<pubDate>Tue, 30 Jun 2009 19:09:57 +0000</pubDate>
		<dc:creator>Peter</dc:creator>
				<category><![CDATA[Uncategorized]]></category>
		<category><![CDATA[research]]></category>
		<category><![CDATA[vulnerabilities]]></category>
		<category><![CDATA[welcome]]></category>

		<guid isPermaLink="false">http://vreugdenhilresearch.nl/?p=3</guid>
		<description><![CDATA[Although this is my first post I have been searching for vulnerabilities since 1998. Back then it was mostly unsafe php includes and evals,  and there were a lot them. I can remember them all, but funnily enough some still show up in google searches. But I doubt anyone will be interrested in those anymore so I'll try to write more about my recent work. Most of my research I sell to either ZDI or iDefense so I wont be able to disclose much of them untill they are published. But since Im not a strong believer in fulldisclosure anyway I have no problem with that :) For some of my work I will post POC and detailed analyses when I have the time, others I wont even mention.

]]></description>
		<wfw:commentRss>http://vreugdenhilresearch.nl/in-the-beginning/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
	</channel>
</rss>

