Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Vulnerable function
- 017449B0 /$ 81EC 0C010000 SUB ESP,10C
- 017449B6 |. A1 9400AC01 MOV EAX,DWORD PTR DS:[1AC0094]
- 017449BB |. 33C4 XOR EAX,ESP
- 017449BD |. 898424 080100 MOV DWORD PTR SS:[ESP+108],EAX ; Set stack Cookie
- 017449C4 |. 8B8424 180100 MOV EAX,DWORD PTR SS:[ESP+118]
- 017449CB |. 53 PUSH EBX
- 017449CC |. 8B9C24 140100 MOV EBX,DWORD PTR SS:[ESP+114]
- 017449D3 |. 55 PUSH EBP
- 017449D4 |. 56 PUSH ESI
- 017449D5 |. 8BB424 200100 MOV ESI,DWORD PTR SS:[ESP+120]
- 017449DC |. 57 PUSH EDI
- 017449DD |. 68 38709D01 PUSH OFFSET 019D7038
- 017449E2 |. 6A 03 PUSH 3
- 017449E4 |. 894424 18 MOV DWORD PTR SS:[ESP+18],EAX
- 017449E8 |. E8 43F9FEFF CALL 01734330 ; Ignore
- 017449ED |. 8B16 MOV EDX,DWORD PTR DS:[ESI]
- 017449EF |. 8B42 18 MOV EAX,DWORD PTR DS:[EDX+18]
- 017449F2 |. 83C4 08 ADD ESP,8
- 017449F5 |. 6A 04 PUSH 4
- 017449F7 |. 8BCE MOV ECX,ESI
- 017449F9 |. FFD0 CALL EAX ; Read 4 bytes from file
- 017449FB |. 8B16 MOV EDX,DWORD PTR DS:[ESI]
- 017449FD |. 8B42 18 MOV EAX,DWORD PTR DS:[EDX+18]
- 01744A00 |. 6A 02 PUSH 2
- 01744A02 |. 8BCE MOV ECX,ESI
- 01744A04 |. FFD0 CALL EAX ; Read 2 bytes from file
- 01744A06 |. 0FB608 MOVZX ECX,BYTE PTR DS:[EAX]
- 01744A09 |. 66:0FB650 01 MOVZX DX,BYTE PTR DS:[EAX+1]
- 01744A0E |. 8B06 MOV EAX,DWORD PTR DS:[ESI]
- 01744A10 |. 66:C1E1 08 SHL CX,8
- 01744A14 |. 66:03CA ADD CX,DX
- 01744A17 |. 8B50 18 MOV EDX,DWORD PTR DS:[EAX+18]
- 01744A1A |. 0FB7F9 MOVZX EDI,CX
- 01744A1D |. 6A 02 PUSH 2
- 01744A1F |. 8BCE MOV ECX,ESI
- 01744A21 |. FFD2 CALL EDX ; Read 2 bytes from file
- 01744A23 |. 66:0FB608 MOVZX CX,BYTE PTR DS:[EAX]
- 01744A27 |. 66:0FB640 01 MOVZX AX,BYTE PTR DS:[EAX+1]
- 01744A2C |. 66:C1E1 08 SHL CX,8
- 01744A30 |. 66:03C8 ADD CX,AX
- 01744A33 |. 66:83C1 01 ADD CX,1
- 01744A37 |. 66:890B MOV WORD PTR DS:[EBX],CX ; palette size in CX
- 01744A3A |. 0FB7C9 MOVZX ECX,CX
- 01744A3D |. 51 PUSH ECX
- 01744A3E |. 8D5424 1C LEA EDX,[ESP+1C]
- 01744A42 |. 68 24709D01 PUSH OFFSET 019D7024
- 01744A47 |. 52 PUSH EDX
- 01744A48 |. FF15 AC409701 CALL DWORD PTR DS:[<&MSVCR80.sprintf>]
- 01744A4E |. 8D4424 24 LEA EAX,[ESP+24]
- 01744A52 |. 50 PUSH EAX
- 01744A53 |. 6A 02 PUSH 2
- 01744A55 |. E8 D6F8FEFF CALL 01734330 ; Ignore
- 01744A5A |. 68 10709D01 PUSH OFFSET 019D7010
- 01744A5F |. 6A 03 PUSH 3
- 01744A61 |. E8 CAF8FEFF CALL 01734330 ; Ignore
- 01744A66 |. 33ED XOR EBP,EBP
- 01744A68 |. 83C4 1C ADD ESP,1C
- 01744A6B |. 66:392B CMP WORD PTR DS:[EBX],BP
- 01744A6E |. 0F86 B4000000 JBE 01744B28
- 01744A74 |. 81E7 00800000 AND EDI,00008000
- 01744A7A |. 897C24 14 MOV DWORD PTR SS:[ESP+14],EDI
- 01744A7E |. 8BFF MOV EDI,EDI
- 01744A80 |> 8B16 /MOV EDX,DWORD PTR DS:[ESI]
- 01744A82 |. 8B42 18 |MOV EAX,DWORD PTR DS:[EDX+18]
- 01744A85 |. 6A 02 |PUSH 2
- 01744A87 |. 8BCE |MOV ECX,ESI
- 01744A89 |. FFD0 |CALL EAX ; Read 2 bytes from file (index)
- 01744A8B |. 66:0FB608 |MOVZX CX,BYTE PTR DS:[EAX]
- 01744A8F |. 66:0FB650 01 |MOVZX DX,BYTE PTR DS:[EAX+1]
- 01744A94 |. 66:C1E1 08 |SHL CX,8
- 01744A98 |. 66:03CA |ADD CX,DX ; Index is in CX
- 01744A9B |. 66:837C24 14 |CMP WORD PTR SS:[ESP+14],0
- 01744AA1 |. 0FB7F9 |MOVZX EDI,CX
- 01744AA4 |. 74 03 |JE SHORT 01744AA9 ; Check if Size is Zero
- 01744AA6 |. 0FB7FD |MOVZX EDI,BP ; BP,EDI: counter
- 01744AA9 |> 66:3B3B |CMP DI,WORD PTR DS:[EBX] ; Check if counter is less than size
- 01744AAC |. 72 0F |JB SHORT 01744ABD
- 01744AAE |. 68 E46F9D01 |PUSH OFFSET 019D6FE4
- 01744AB3 |. 6A 02 |PUSH 2
- 01744AB5 |. E8 D6F9FEFF |CALL 01734490 ; Ignore
- 01744ABA |. 83C4 08 |ADD ESP,8
- 01744ABD |> 8B06 |MOV EAX,DWORD PTR DS:[ESI]
- 01744ABF |. 8B50 18 |MOV EDX,DWORD PTR DS:[EAX+18]
- 01744AC2 |. 6A 02 |PUSH 2
- 01744AC4 |. 8BCE |MOV ECX,ESI
- 01744AC6 |. FFD2 |CALL EDX ; Read 2 bytes from file (R)
- 01744AC8 |. 8B5424 10 |MOV EDX,DWORD PTR SS:[ESP+10]
- 01744ACC |. 0FB7CF |MOVZX ECX,DI
- 01744ACF |. 8D3C8A |LEA EDI,[ECX*4+EDX] ;Pointer in the palette where to write
- 01744AD2 |. 0FB608 |MOVZX ECX,BYTE PTR DS:[EAX]
- 01744AD5 |. 0FB650 01 |MOVZX EDX,BYTE PTR DS:[EAX+1]
- 01744AD9 |. 66:C1E1 08 |SHL CX,8
- 01744ADD |. 66:03CA |ADD CX,DX
- 01744AE0 |. 886F 02 |MOV BYTE PTR DS:[EDI+2],CH ; Write byte to pointer+2
- 01744AE3 |. 8B06 |MOV EAX,DWORD PTR DS:[ESI]
- 01744AE5 |. 8B50 18 |MOV EDX,DWORD PTR DS:[EAX+18]
- 01744AE8 |. 6A 02 |PUSH 2
- 01744AEA |. 8BCE |MOV ECX,ESI
- 01744AEC |. FFD2 |CALL EDX ; Read 2 bytes from file (G)
- 01744AEE |. 0FB608 |MOVZX ECX,BYTE PTR DS:[EAX]
- 01744AF1 |. 0FB650 01 |MOVZX EDX,BYTE PTR DS:[EAX+1]
- 01744AF5 |. 66:C1E1 08 |SHL CX,8
- 01744AF9 |. 66:03CA |ADD CX,DX
- 01744AFC |. 886F 01 |MOV BYTE PTR DS:[EDI+1],CH ; Write byte to pointer+1
- 01744AFF |. 8B06 |MOV EAX,DWORD PTR DS:[ESI]
- 01744B01 |. 8B50 18 |MOV EDX,DWORD PTR DS:[EAX+18]
- 01744B04 |. 6A 02 |PUSH 2
- 01744B06 |. 8BCE |MOV ECX,ESI
- 01744B08 |. FFD2 |CALL EDX ; Read 2 bytes from file (B)
- 01744B0A |. 0FB608 |MOVZX ECX,BYTE PTR DS:[EAX]
- 01744B0D |. 0FB650 01 |MOVZX EDX,BYTE PTR DS:[EAX+1]
- 01744B11 |. 66:C1E1 08 |SHL CX,8
- 01744B15 |. 66:03CA |ADD CX,DX
- 01744B18 |. 882F |MOV BYTE PTR DS:[EDI],CH ; Write byte to pointer
- 01744B1A |. 0FB703 |MOVZX EAX,WORD PTR DS:[EBX]
- 01744B1D |. 83C5 01 |ADD EBP,1 ; Increment counter
- 01744B20 |. 3BE8 |CMP EBP,EAX ; get out if counter > size
- 01744B22 |.^ 0F8C 58FFFFFF \JL 01744A80
- 01744B28 |> 8B8C24 180100 MOV ECX,DWORD PTR SS:[ESP+118]
- 01744B2F |. 5F POP EDI
- 01744B30 |. 5E POP ESI
- 01744B31 |. 5D POP EBP
- 01744B32 |. 5B POP EBX
- 01744B33 |. 33CC XOR ECX,ESP
- 01744B35 |. E8 C2CD1800 CALL 018D18FC ; Check stack cookie
- 01744B3A |. 81C4 0C010000 ADD ESP,10C
- 01744B40 \. C2 0C00 RETN 0C
- 01744B43 CC INT3
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
