nis simply a sequence where no string of
ncharacters is repeated. This makes finding the offset until EIP much simpler - we can just pass in a De Bruijn sequence, get the value within EIP and find the one possible match within the sequence to calculate the offset. Let's do this on the ret2win binary.
radare2comes with a nice command-line tool (called
ragg2) that can generate it for us. Let's create a sequence of length
-Pspecifies the length while
-rtells it to show ascii bytes rather than hex pairs.
radare2when prompted for input, make it crash and then calculate how far along the sequence the EIP is. Simples.
0x41534141; we can use
wopOcommand to work out the offset.
dr eipis calculated first, before the
wopOis run on the result of it.