Modern binary attacks and defences in the windows environment — Fighting against microsoft EMET in seven rounds

Abstract

In this paper some basic elements of the “Eternal war in the memory” [1] are investigated from a practical perspective. While that article provides an excellent theoretical overview and surveys the contemporary attacks and defences, here some concrete examples of binary exploitation are presented as a case study. As a running example we take a recent buffer overflow vulnerability of the TestDisk application [2], and offer an easy-to-follow walkthrough of some exploitation techniques and tricks against Microsoft Enhanced Mitigation Experience Toolkit (EMET).