2

I am trying to exploit a program where I have to reuse a socket.

recv looks like this:

int recv(
_In_  SOCKET s, // socket ID
_Out_ char   *buf,
_In_  int    len,
_In_  int    flags
);

I want to find where the socket ID is on the stack. How do I find this using Immunity Debugger?

Improve this question
1
  • 2
    @DominikAntal please consider making an answer from your comment since it may answer OP's question Commented Nov 12, 2017 at 9:43

1 Answer 1

Reset to default
3

Put a INT3 (F2) breakpoint on the recv function (To jump to that function, hit CTRL+G then type recv to the textbox which just appeared, and then hit enter) within Immunity Debugger, and observe the stack (lower right corner) for the socket ID when the breakpoint is hit.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.