Register Hijack
Control Flow Attack
Before Hijack
r0 loaded by LDR:
r0 = 0x10001234
Points to flash:
"hello, world\r\n"
printf will read r0
and print that string
The Hijack Command
set $r0 = 0x20040000
Now r0 points to
OUR string in SRAM
instead of flash
After Hijack
r0 now contains:
r0 = 0x20040000
Points to SRAM:
"hacky, world"
Then: continue
printf reads r0
Follows pointer
to 0x20040000
Finds "hacky, world"
Prints it!
Output changed
without touching code