Everybody and welcome to the next video about the internal operating systems.
Now we're going to be talking about something called SLR in this video.
Now what is SLR SLR is address space layout randomization.
This randomize is the offsets of the memory locations for core applications.
So they are not used in the same or they're not present in the same spot every single time.
Now this includes the heap the stack shared library such as any of the any of the the Cisco libraries
the locations where they are in memory when they're loaded up is different every single time SLR happens
on reboots.
So when an application or the OS restarts it gets a different offset.
This is done to prevent exploits on its own now.
Why is this important.
This this is important to you around and building exploits because if you build an exploit that has
an offset for example of 10 bytes or are a thousand bytes it might be a thousand now but if someone
restarts the machine or you point that exploit to a different machine the offset might be fifteen hundred
might be a thousand thirty seven might be nine hundred might be fifty.
So if if you're working on an exploit and then you issue a reboot and it stops working.
This may be your issue.
It's very important to understand this.
It's this can this can be the difference between you spending five hours smacking your head against
the keyboard or looking up a bypass method.
Which brings me to this.
Can it be bypassed.
Yes it can.
It's not trivial to bypass depending on restrictions that might be in place for the exploit that you're
doing.
But here's the.
Here are a few.
So Rob chains partial IP overrides abusing non SLR binaries or libraries which is probably the most
common and then a single byte overwrite again as is the second most common.
Now what I want you to do is briefly look into each one of these four.
Now each one of them could be a course on their own understanding a single bit rights and abusing none
SLR libraries is probably the two you want to focus on at least at first.
Don't worry if it looks like it's too much information it's going to be pretty deep when you start looking
into this stuff.
If you want to skip actually looking into this and just writing it down and noticed and noticing that
it's there for when we get into the future modules or the exploitation course.
That's perfectly fine as well.
This will put you down an entirely different path of learning the internal workings on exploit development
and a lot of these are not basic.
But I wanted you to understand what SLR was and what some of the overrides are possible or bypass techniques
are possible at the current moment.
Feel free to look in them if you have questions grown over to the Facebook group.
Everybody is more than happy to help you.
I'm more than happy to help you.