Advertisement
Guest User

WindowsDebugEngine-description

a guest
May 11th, 2015
266
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 8.83 KB | None | 0 0
  1.  
  2. ************* Symbol Path validation summary **************
  3. Response Time (ms) Location
  4. Deferred SRV*http://msdl.microsoft.com/download/symbols
  5.  
  6. Microsoft (R) Windows Debugger Version 6.3.9600.17237 AMD64
  7. Copyright (c) Microsoft Corporation. All rights reserved.
  8.  
  9. CommandLine: C:\\Users\\David\\Downloads\\xmplay38\\xmplay.exe fuzzed.wav
  10.  
  11. ************* Symbol Path validation summary **************
  12. Response Time (ms) Location
  13. Deferred SRV*http://msdl.microsoft.com/download/symbols
  14. Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols
  15. Executable search path is:
  16. ModLoad: 00000000`00400000 00000000`0054b000 image00000000`00400000
  17. ModLoad: 00007ffe`861c0000 00007ffe`8636c000 ntdll.dll
  18. ModLoad: 00000000`77d50000 00000000`77ebe000 ntdll.dll
  19. ModLoad: 00000000`001c0000 00000000`0022c000 C:\Windows\system32\verifier.dll
  20. Page heap: pid 0x1570: page heap enabled with flags 0x3.
  21. ModLoad: 00000000`77d00000 00000000`77d4b000 C:\Windows\SYSTEM32\wow64.dll
  22. ModLoad: 00000000`77c80000 00000000`77ce8000 C:\Windows\system32\wow64win.dll
  23. ModLoad: 00000000`77cf0000 00000000`77cf9000 C:\Windows\system32\wow64cpu.dll
  24. ModLoad: 00000000`00230000 00000000`0036e000 WOW64_IMAGE_SECTION
  25. ModLoad: 00000000`77850000 00000000`77990000 WOW64_IMAGE_SECTION
  26. ModLoad: 00000000`00230000 00000000`0036e000 NOT_AN_IMAGE
  27. ModLoad: 00000000`00230000 00000000`003a7000 NOT_AN_IMAGE
  28. ModLoad: 00000000`54c30000 00000000`54c90000 C:\Windows\syswow64\verifier.dll
  29. Page heap: pid 0x1570: page heap enabled with flags 0x3.
  30. ModLoad: 00000000`77850000 00000000`77990000 C:\Windows\SysWOW64\KERNEL32.DLL
  31. ModLoad: 00000000`75570000 00000000`75647000 C:\Windows\SysWOW64\KERNELBASE.dll
  32. ModLoad: 00000000`776e0000 00000000`77833000 C:\Windows\SysWOW64\USER32.dll
  33. ModLoad: 00000000`72530000 00000000`72553000 C:\Windows\SysWOW64\WINMM.dll
  34. ModLoad: 00000000`76c90000 00000000`76d9e000 C:\Windows\SysWOW64\GDI32.dll
  35. ModLoad: 00000000`77990000 00000000`77a2b000 C:\Windows\SysWOW64\comdlg32.dll
  36. ModLoad: 00000000`756b0000 00000000`7572c000 C:\Windows\SysWOW64\ADVAPI32.dll
  37. ModLoad: 00000000`75890000 00000000`76b3c000 C:\Windows\SysWOW64\SHELL32.dll
  38. ModLoad: 00000000`76f20000 00000000`77048000 C:\Windows\SysWOW64\ole32.dll
  39. ModLoad: 00000000`72350000 00000000`72525000 C:\Windows\SysWOW64\WININET.dll
  40. ModLoad: 00000000`64e70000 00000000`64e87000 C:\Windows\SysWOW64\MSACM32.dll
  41. ModLoad: 00000000`757c0000 00000000`75883000 C:\Windows\SysWOW64\MSVCRT.dll
  42. ModLoad: 00000000`72090000 00000000`720b3000 C:\Windows\SysWOW64\WINMMBASE.dll
  43. ModLoad: 00000000`75770000 00000000`757b5000 C:\Windows\SysWOW64\SHLWAPI.dll
  44. ModLoad: 00000000`6f7b0000 00000000`6f9b6000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17415_none_a9ed7f470139b3c1\COMCTL32.dll
  45. ModLoad: 00000000`76ba0000 00000000`76be1000 C:\Windows\SysWOW64\sechost.dll
  46. ModLoad: 00000000`77a80000 00000000`77b3a000 C:\Windows\SysWOW64\RPCRT4.dll
  47. ModLoad: 00000000`76da0000 00000000`76f1d000 C:\Windows\SysWOW64\combase.dll
  48. ModLoad: 00000000`71e50000 00000000`72082000 C:\Windows\SysWOW64\iertutil.dll
  49. ModLoad: 00000000`72bd0000 00000000`72beb000 C:\Windows\SysWOW64\USERENV.dll
  50. ModLoad: 00000000`75730000 00000000`7576c000 C:\Windows\SysWOW64\cfgmgr32.dll
  51. ModLoad: 00000000`72db0000 00000000`72dd1000 C:\Windows\SysWOW64\DEVOBJ.dll
  52. ModLoad: 00000000`75550000 00000000`7556e000 C:\Windows\SysWOW64\SspiCli.dll
  53. ModLoad: 00000000`72c40000 00000000`72c4f000 C:\Windows\SysWOW64\profapi.dll
  54. ModLoad: 00000000`72c50000 00000000`72cdb000 C:\Windows\SysWOW64\SHCORE.DLL
  55. ModLoad: 00000000`75540000 00000000`7554a000 C:\Windows\SysWOW64\CRYPTBASE.dll
  56. ModLoad: 00000000`754e0000 00000000`75534000 C:\Windows\SysWOW64\bcryptPrimitives.dll
  57. ModLoad: 774f0000 77517000 C:\Windows\SysWOW64\IMM32.DLL
  58. ModLoad: 00000000`77b50000 00000000`77c62000 C:\Windows\SysWOW64\MSCTF.dll
  59. ModLoad: 00000000`75420000 00000000`75429000 C:\Windows\SysWOW64\kernel.appcore.dll
  60. ModLoad: 00000000`718b0000 00000000`7199d000 C:\Windows\SysWOW64\uxtheme.dll
  61. ModLoad: 00000000`76bf0000 00000000`76c85000 C:\Windows\SysWOW64\OLEAUT32.dll
  62. ModLoad: 00000000`77350000 00000000`773dd000 C:\Windows\SysWOW64\clbcatq.dll
  63. ModLoad: 00000000`77520000 00000000`776d1000 C:\Windows\SysWOW64\SETUPAPI.dll
  64. ModLoad: 00000000`71a70000 00000000`71baa000 C:\Windows\SysWOW64\propsys.dll
  65. ModLoad: 00000000`10000000 00000000`1000a000 C:\Users\David\Downloads\xmplay38\xmp-cd.dll
  66. ModLoad: 00000000`05100000 00000000`05107000 C:\Users\David\Downloads\xmplay38\xmp-wadsp.dll
  67. ModLoad: 00000000`06ed0000 00000000`06ed8000 C:\Users\David\Downloads\xmplay38\xmp-wma.dll
  68. ModLoad: 00000000`07de0000 00000000`07dee000 C:\Users\David\Downloads\xmplay38\xmp-zip.dll
  69. ModLoad: 00000000`73b00000 00000000`73b19000 C:\Windows\SysWOW64\CRYPTSP.dll
  70. ModLoad: 00000000`73ad0000 00000000`73b00000 C:\Windows\SysWOW64\rsaenh.dll
  71. ModLoad: 00000000`73ab0000 00000000`73ace000 C:\Windows\SysWOW64\bcrypt.dll
  72. ModLoad: 00000000`6f290000 00000000`6f2aa000 C:\Windows\SysWOW64\dwmapi.dll
  73. (1570.227c): Access violation - code c0000005 (first chance)
  74. r
  75. eax=08b2dc08 ebx=00000000 ecx=071acff8 edx=0000000a esi=071acfe8 edi=00000001
  76. eip=64e808c6 esp=08b2dce0 ebp=08b2dd0c iopl=0 nv up ei pl zr na pe nc
  77. cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246
  78. MSACM32!ValidateReadPointer+0x15:
  79. 64e808c6 8a4411ff mov al,byte ptr [ecx+edx-1] ds:002b:071ad001=??
  80. rF
  81. fpcw=027F: rn 53 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000
  82. fopcode=0000 fpip=0000:004267cd fpdp=0000:004653d0
  83. st0= 0.000000000000000000000e+0000 st1= 0.000000000000000000000e+0000
  84. st2= 0.000000000000000000000e+0000 st3= 0.000000000000000000000e+0000
  85. st4= 0.000000000000000000000e+0000 st5= 1.600000000000000000000e+0001
  86. st6= 0.000000000000000000000e+0000 st7= 0.000000000000000000000e+0000
  87. MSACM32!ValidateReadPointer+0x15:
  88. 64e808c6 8a4411ff mov al,byte ptr [ecx+edx-1] ds:002b:071ad001=??
  89. rX
  90. xmm0=0 0 0 0
  91. xmm1=0 0 0 0
  92. xmm2=0 0 0 0
  93. xmm3=0 0 0 0
  94. xmm4=0 0 0 0
  95. xmm5=0 0 0 0
  96. xmm6=0 0 0 0
  97. xmm7=0 0 0 0
  98. MSACM32!ValidateReadPointer+0x15:
  99. 64e808c6 8a4411ff mov al,byte ptr [ecx+edx-1] ds:002b:071ad001=??
  100.  
  101.  
  102. kb
  103. ChildEBP RetAddr Args to Child
  104. 08b2dd0c 64e80986 00000000 071a2fa4 64e7a4a1 MSACM32!ValidateReadPointer+0x15
  105. 08b2dd18 64e7a4a1 0000000c 071acfe8 071a2f68 MSACM32!ValidateReadWaveFormat+0x45
  106. *** WARNING: Unable to verify checksum for image00000000`00400000
  107. *** ERROR: Module load completed but symbols could not be loaded for image00000000`00400000
  108. 08b2dde8 00419fef 071a2fa4 00000000 071acfe8 MSACM32!acmStreamOpen+0xa1
  109. WARNING: Stack unwind information not available. Following frames may be wrong.
  110. 08b2fe7c 0041aafe 07124fec 004570d0 004570d0 image00000000_00400000+0x19fef
  111. 08b2fe90 00426e9f 071e7fb8 004ab530 00000000 image00000000_00400000+0x1aafe
  112. 08b2fecc 004269d6 004ab530 00000000 0890cff8 image00000000_00400000+0x26e9f
  113. 08b2fef8 00425b5d 757ff4a0 0042585c 76612bf2 image00000000_00400000+0x269d6
  114. 00000000 00000000 00000000 00000000 00000000 image00000000_00400000+0x25b5d
  115.  
  116.  
  117. .load C:\Users\David\Downloads\peach-3.0.202-win-x64-release\Debuggers\DebugEngine\msec64.dll
  118. !exploitable -m
  119. IDENTITY:HostMachine\HostUser
  120. PROCESSOR:X86
  121. CLASS:USER
  122. QUALIFIER:USER_PROCESS
  123. EVENT:DEBUG_EVENT_EXCEPTION
  124. EXCEPTION_FAULTING_ADDRESS:0x71ad001
  125. EXCEPTION_CODE:0xC0000005
  126. EXCEPTION_LEVEL:FIRST_CHANCE
  127. EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION
  128. EXCEPTION_SUBTYPE:READ
  129. FAULTING_INSTRUCTION:64e808c6 mov al,byte ptr [ecx+edx-1]
  130. BASIC_BLOCK_INSTRUCTION_COUNT:6
  131. BASIC_BLOCK_INSTRUCTION:64e808c6 mov al,byte ptr [ecx+edx-1]
  132. BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:ecx
  133. BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:edx
  134. BASIC_BLOCK_INSTRUCTION:64e808ca mov byte ptr [ebp-19h],al
  135. BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:al
  136. BASIC_BLOCK_INSTRUCTION:64e808cd mov dword ptr [ebp-4],0fffffffeh
  137. BASIC_BLOCK_INSTRUCTION:64e808d4 xor eax,eax
  138. BASIC_BLOCK_INSTRUCTION:64e808d6 inc eax
  139. BASIC_BLOCK_INSTRUCTION:64e808d7 jmp msacm32!validatereadpointer+0x38 (64e808e9)
  140. MAJOR_HASH:0x2a444267
  141. MINOR_HASH:0x62035a23
  142. STACK_DEPTH:8
  143. STACK_FRAME:MSACM32!ValidateReadPointer+0x15
  144. STACK_FRAME:MSACM32!ValidateReadWaveFormat+0x45
  145. STACK_FRAME:MSACM32!acmStreamOpen+0xa1
  146. STACK_FRAME:image00000000_00400000+0x19fef
  147. STACK_FRAME:image00000000_00400000+0x1aafe
  148. STACK_FRAME:image00000000_00400000+0x26e9f
  149. STACK_FRAME:image00000000_00400000+0x269d6
  150. STACK_FRAME:image00000000_00400000+0x25b5d
  151. INSTRUCTION_ADDRESS:0x0000000064e808c6
  152. INVOKING_STACK_FRAME:0
  153. DESCRIPTION:Read Access Violation
  154. SHORT_DESCRIPTION:ReadAV
  155. CLASSIFICATION:UNKNOWN
  156. BUG_TITLE:Read Access Violation starting at MSACM32!ValidateReadPointer+0x0000000000000015 (Hash=0x2a444267.0x62035a23)
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement