View source for Dynamic memmove() locating

With [[ARM Exception Vector Info Leak]] it is possible to leak 4 bytes of memory. To get more data and more reliable, [[evasi0n]] attempts to dynamically locate the <code>memmove()</code> function within the kernel module. This is done by leaking the first two pages of the kernel text section and following each branch instruction (leaking destination too) until the <code>memmove()</code> signature is found.

With the address of <code>memmove()</code>, it is possible to return data to a buffer that can be read from user-mode and returning more memory this way.

TODO: Explain how [[evasi0n]] does this in detail.

See also [[Patchfinder]].

== References ==
* [http://blog.azimuthsecurity.com/2013/02/from-usr-to-svc-dissecting-evasi0n.html Analysis by kernelpool]

[[Category:Exploits]]