C Hacking Note

note.txt

Strcmp: Compare strings.

Strcmp is used to compare strings, and therefore don't have buffer overflow write.
However, if the first argument string is somehow not null terminated, and the
second string is an attacker controlled one and I have some indicator of this
comparison matching or not (I.e. Crashing and service restarts), I could
theoretically have an arbitrary out-of-bounds read.

It's a complicated attack that would require to bruteforce the memory until it matches,
timing information could be used to further aid into the exploitation with the right
statistical analysis. This idea is derived from Bittau's Blind ROP work.