In this presentation, we introduce a new exploitation methodology of invalid memory reads and writes, based on dataflow analysis after a memory corruption bug has occured inside a running process. We will expose a methodology which shall help with writing a reliable exploit out of a PoC triggering an invalid memory write, in presence of security defense mechanism such as compiler enhancements (full RELRO, SSP) or kernel anti exploitation features (ASLR, NX). In particular, we will demonstrate how to: - Find all the function pointers inside a running process - How to determine which ones would have been dereferenced after the crash - Which ones are truncable (in particular with 0×00000000). If case all of the above fail, how to test for specific locations overwrites in order to indirectly trigger a second vulnerability allowing greater control and eventually control flow hijacking. All of the above without source code, indeed ;) In the case of invalid memory reads, we will exemplify how to indirectly influence the control flow of execution by reading arbitrary values, how to trace all the unaligned memory access and how to test if an invalid read can be turned into an invalid write or used to infer the mapping of the binary. We will also introduce a new debugging technique which allows for very effective testing of all of the above by forcing the debugged process to fork(). Automatically. And with a rating of the best read/write location based on probabilities of mapping addresses (because of ASLR).