blasty/ssh_rape — pull request #9 by sj0rz (2014-10-24 22:27:15+00:00)
Title: Added alternative privsep load search for movs.

Sometimes the lea use_privsep instruction is compiled as a mov use_privsep_ptr; mov eax, [rax]
This is a pointer in the .got. This patch tries to first find the direct lea instruction, and only if that cannot be found searches the got for this pointer and then continues to search for a similar mov instruction.