Contents

• Foreword
• Introduction
• Locating Temporal Addresses
  • Determining Per-byte Durations
  
  
• Calculating Viable Opcode Windows
• Picking the Time to Strike
  • Determining System Time
    • DCERPC SrvSvc NetrRemoteTOD
    • ICMP Timestamps
    • IP Timestamp Option
    • HTTP Server Date Header
    • IRC CTCP TIME
  
  
• Determining the Return Address
• Case Study: Windows NT SharedUserData
  • The Properties of SharedUserData
  • Locating Temporal Addresses
    • TickCountLow
    • InterruptTime
    • SystemTime
  • Calculating Viable Opcode Windows
  
  
• Case study: Example application
• Conclusion
• Bibliography
• About this document ...