Skip to content

Latest commit

 

History

History
17 lines (13 loc) · 667 Bytes

db_enums.md

File metadata and controls

17 lines (13 loc) · 667 Bytes

What do the numbers that appear in the db tables attackpoint and bug in the type column mean? They are defined in two places, lava.py and lava.hxx.

attackpoint types:

  1. FUNCTION_ARG (an arg to a fn)
  2. POINTER_READ (read via ptr)
  3. POINTER_WRITE (write via ptr)
  4. QUERY_POINT (is this the sentinels ricky puts in after every stmt?)
  5. PRINTF_LEAK (really just a printf)

bug types:

  1. PTR_ADD (corrupt a pointer at attack point)
  2. RET_BUFFER (stack pivot)
  3. REL_WRITE (This was a is a write-what-where but is now a misnomer for a 3-dua variation on a PTR_ADD bug)
  4. PRINTF_LEAK (turn printf into a stack / heap leak)