2

Say you're fuzzing a Windows x32 application for a file format bug and, say, you found a pattern that causes the application to crash.

My normal steps are:

  • load application into a debugger
  • generate and investigate the crash.

In my actual conditions, I can see my pattern into the stack but, at crash time, I can't find any impacted register nor SEH overwrite but only what's the instruction that causes the crash:

MOV WORD PTR DS:[EDI+2],DX

basically, it can't write because it is an unmapped memory area.

Have to admit that I'm completely lost because I can't proceed to verify the offsets into memory.

4
  • What happens if you pass the exception to the program in the debugger?
    – DKNUCKLES
    Commented Jan 10, 2018 at 23:27
  • Simply an access violation with no register nor seh impacted.
    – Kartone
    Commented Jan 10, 2018 at 23:29
  • Just as a matter of curiosity, are you sure that RCE is possible with this exploit or is it just a DOS? Can you share the application you're referring to?
    – DKNUCKLES
    Commented Jan 11, 2018 at 2:29
  • I'm trying to understand if it's exploitable. Just found this cool article from Corelan but, sadly, I went soon pretty lost...it's way too much for me. :-(
    – Kartone
    Commented Jan 11, 2018 at 19:13

1 Answer 1

3

Your file input has probably affected the value of EDI in some way, or caused control flow to take a path it would not otherwise take. I would normally look a few instructions back and try to determine how EDI came to have that value, or perhaps break at the beginning of the function where the crash occurs and step through it (or a few functions further up the stack).

Another relatively new option would be to use WinDbg's time travel debugging feature! You can let it run in the debugger until the crash, then step backwards in execution to figure out how you arrived at the crash.

Obviously, if you have source, you'll be much better off looking at it that way in parallel to figure out what happened.

1
  • Yeah, I'm trying to analyze it but it's rather complicated for me right now...but anyway, try harder uh ?! :-)
    – Kartone
    Commented Jan 11, 2018 at 19:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .