Breaking Kernel Address Space Layout Randomization (KASLR) With Intel TSX

[@RobertGhidini]

Fortunately for us, we are not limited to just writing static ROP chains. We can use JavaScript to read the module table, which will tell us the base addresses of all loaded modules. Using these bases, we can calculate the addresses of all our gadgets before we trigger the ROP execution, defeating ASLR, it took me 8 years to understand this process

[@offmeds2nite]

This is awesome.

[@danielc8130]

would not be needed on OpenVMS