I think all of you will really like this one, a step-by-step tutorial for exploit dev. Be sure to stop by Mark Nicholls security blog, isolated-threat, that focuses on malware, shellcode and exploits. After visiting, if there's any tutorials you'd like to see from Mark, feel free to ask.

Permanent link: [Article]-Tutorial: SEH Based Exploits and the Development Process


Let us know what you think,
Don

Very nice, I will definitely try this soon. Thanks!

n1p, that's a fantastic read!   I skimmed through it once already, and plan to go back and read it again a few times.   The links at the end are priceless on their own.  Thanks!

You could write a tutorial on heap-based overflows.   I haven't touched those at all, and would love to learn more.   

You could also go into fuzzing a bit.  For example, what do you watch for when looking for off by one or format string vulnerabilities?

The article was very informative. I do not have any experience with exploit development but even then was able to understand it  
Looking forward to more stuff from you.

@ketchup perhaps this will be a good starting point 

Article was cool. Corelan (since you linked it) has some very thorough works as does OpenRCE. I'd personally like to see more 'weaponization' articles, e.g. ActiveX anyone. It's surprising I didn't see mention of WinDBG in your article. pusscat has a wicked module (byakugan) that allows you to perform all sorts of stuff: (quoting) Real Time Heap Visualization, Buffer Identification and Hunting, Return Address Hunting...

There are a lot of interesting and cool write-ups (yours included) lurking around, I wish I could find more WinDBG based content though. Olly is fine, Immunity - latest version is buggy - but nevertheless good. I find that WinDBG is a lot more powerful for windows debugging. I've just begun tinkering with Klockwork (Architect, etc.) and I'm definitely impressed and at times confused by a lot of it. I would have made mention in your article to those reading it, they may want to take a brief drive-by of Assembly programming and understand a little more about registers. E.g., you can manipulate other registers to eventually get control of EIP. You don't necessarily have to specifically target it outright.

Thanks for your efforts n1p, really liked your article.