[Snort-sigs] More: Question on SID 285

Steven Alexander alexander.s at ...1565...
Thu Jun 12 08:58:14 EDT 2003


Doh!  Nevermind my previous posts on the shellcode for SID 285.  I
simply wasn't considering that the shellcode lcased itself.  I found the
shell code without the original source and didn't consider it since none
of the shellcode I've written changes the case of it's strings.  I
should have disassembled it in the first place.  I was being stupid, my
apologies.

-steven




More information about the Snort-sigs mailing list