The Attack Plan
Exploit Strategy
Attack Flow (4 Steps)
1. Break at
printf call
2. Write new
string to SRAM
3. Set r0 to
SRAM addr
4. Continue
execution
printf reads r0, prints "hacky, world"!
Normal Flow
LDR r0, ="hello"
BL printf
Output:
"hello, world"
Prints original string
Hacked Flow
LDR r0, ="hello"
r0 = 0x20040000
BL printf
Output:
"hacky, world"
Prints our string