[原创]CVE-2010-3333栈溢出漏洞分析-二进制漏洞-看雪-安全社区|安全招聘|kanxue.com

[原创]CVE-2010-3333栈溢出漏洞分析
发表于: 2025-3-18 15:55 3688
[原创]CVE-2010-3333栈溢出漏洞分析

Cik-
2025-3-18 15:55
3688
Windows 10
Office 2003
Windbg
msf
现在就可以看到windbg报出如下错误
既然异常发生在将ESI复制到EDI时，那就尝试查看ESI和EDI的详细信息
在这里可以发现，EDI是只读权限的，而操作却是复制ESI到EDI（其中包含
了写权限），因此造成c0000005错误。
再回看 !address edi 结果，EDI的区域只有16K，而ESI却足足214.047M!程
序将214.07M的内容要复制到只有16K的EDI中，这本身就很可疑!!!这种情况
说明程序在复制数据前没有对目标缓冲区 [edi] 的大小进行必要的检查，从
而导致了缓冲区溢出问题。
重新附加程序，在30e9eb88（EIP）处下断点。然后g
程序在30e9eb88处触发了断点，然后使用kb查看栈信息(此时并未发生异
常，栈内信息一切正常)
第一个是当前函数栈帧,所以应该从前一个函数栈开始看。
使用ub命令查看mso!Ordinal753+0x306e之前的汇编代码
（ub命令是从指定地址向低地址方向显示机器码对应的汇编指令）
这里可以看到，在 30f4cdb8 e8a0feffff call mso!Ordinal753+0x2f0e
(30f4cc5d) 又调用了 mso!Ordinal753+0x2f0e ,因此需要再次重新载入程序打
下断点。
重新载入断点触发后
漏洞触发地址：30e9eb88
当前地址：30f4cc5d
接下来一直单步步过调试，直到找到下一个函数调用，然后判断该函数调用
是否离漏洞地址近，选出最近的那个，一般就是漏洞函数调用地址了。
应该这里就是函数的漏洞调用了(再单步一下就看到触发了异常)，跟入漏洞调用查看一下
需要注意esi、edi、ecx这三个寄存器的值，因为它们直接决定了数据复制的
来源、目标和长度。如果这些值没有经过正确的校验，就可能导致缓冲区溢
出或非法访问错误。
以下为单步调试
拷贝大小为0xc8ac，因为是dword拷贝，所以拷贝0xc8ac / 4 = 0x322b
次。
拷贝次数 = 总字节数 ÷ 每次拷贝的大小（DWORD 大小）
十六进制打开样本文件，可以看到ecx 0xc8ac属于样本数据，位于
pFragements的第三个字段，偏移8个字符后的4个字符（勾选的字符）即为复制的数据大小
 
而0xc8ac后面的数据就是实际内存复制的数据，复制内存源地址esi就指向这里
复制内存的目标地址刚好偏移栈底ebp共0x10字节，加上ebp本身占用的4字节，刚好14字节，再覆盖下去就是函数的返回地址了
由于POC文件中的复制的内存数据较大，导致复制的过程中覆盖到不可写的内存地址而触发异常，因此没有去执行覆盖到的返回地址或者seh异常处理函数。
总结上面的分析过程，由于word中的rtf分析器在解析pFragments属性时，没有正确计算属性值所占用的空间大小，只要复制的数据大小超过0x10+0x4即可覆盖到返回地址，若继续覆盖下去还可覆盖到seh结构，进而控制程序的执行流程，用于执行任意代码！！
msfconsole
search cve-2010-3333
use exploit/windows/fileformat/ms10_087_rtf_pfragments_bof
info 查看漏洞信息
选择用于调试的模板
Crash Target for Debugging
然后run一下生成即可生成cve-21-010-3333的POC
这个脚本只能造成系统内存奔溃，不会执行命令
msfconsole
search cve-2010-3333
use exploit/windows/fileformat/ms10_087_rtf_pfragments_bof
info 查看漏洞信息
选择用于调试的模板
Crash Target for Debugging
然后run一下生成即可生成cve-21-010-3333的POC
这个脚本只能造成系统内存奔溃，不会执行命令
(1660.1680): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=0000c8ac ebx=05000000 ecx=0000017a edx=00000000 esi=0d2dc2d0
edi=001a0000
eip=30e9eb88 esp=00193d14 ebp=00193d4c iopl=0 nv up ei pl
nz na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00210206
mso!Ordinal6426+0x64d:
30e9eb88 f3a5 rep movs dword ptr es:[edi],dword ptr
[esi]
(1660.1680): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=0000c8ac ebx=05000000 ecx=0000017a edx=00000000 esi=0d2dc2d0
edi=001a0000
eip=30e9eb88 esp=00193d14 ebp=00193d4c iopl=0 nv up ei pl
nz na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00210206
mso!Ordinal6426+0x64d:
30e9eb88 f3a5 rep movs dword ptr es:[edi],dword ptr
[esi]
既然异常发生在将ESI复制到EDI时，那就尝试查看ESI和EDI的详细信息
地址30e9eb88处的指令 f3 a5：这条指令是 rep movsd（重复地将一个 dword
从 [ESI] 复制到 [EDI]），复制次数由 ECX（此处为 0x17A，即378）决定。
可能产生此错误的原因：
在执行 rep movsd 时，程序尝试从内存地址 ESI = 0d2dc2d0 读取数据并写入
到地址 EDI = 001a0000。如果其中一个内存区域没有有效映射或不允许访问，
就会触发访问冲突异常。常见原因包括：
源（[ESI]）或目标（[EDI]）地址无效或未分配。
目标地址不可写（例如，指向只读内存）。
内存复制过程中存在数组越界或内存损坏。
既然异常发生在将ESI复制到EDI时，那就尝试查看ESI和EDI的详细信息
地址30e9eb88处的指令 f3 a5：这条指令是 rep movsd（重复地将一个 dword
从 [ESI] 复制到 [EDI]），复制次数由 ECX（此处为 0x17A，即378）决定。
可能产生此错误的原因：
在执行 rep movsd 时，程序尝试从内存地址 ESI = 0d2dc2d0 读取数据并写入
到地址 EDI = 001a0000。如果其中一个内存区域没有有效映射或不允许访问，
就会触发访问冲突异常。常见原因包括：
源（[ESI]）或目标（[EDI]）地址无效或未分配。
目标地址不可写（例如，指向只读内存）。
内存复制过程中存在数组越界或内存损坏。
0:000> !address edi
Usage: Other
Base Address: 001a0000
End Address: 001a4000
Region Size: 00004000 ( 16.000 kB)
State: 00001000 MEM_COMMIT
Protect: 00000002 PAGE_READONLY
Type: 00040000 MEM_MAPPED
Allocation Base: 001a0000
Allocation Protect: 00000002 PAGE_READONLY
Additional info: System Default Activation Context Data
Content source: 1 (target), length: 4000
0:000> !address esi
Usage: <unknown>
Base Address: 0d2d0000
End Address: 1a8dc000
Region Size: 0d60c000 ( 214.047 MB)
State: 00001000 MEM_COMMIT
Protect: 00000004 PAGE_READWRITE
Type: 00020000 MEM_PRIVATE
Allocation Base: 0d2d0000
Allocation Protect: 00000001 PAGE_NOACCESS
Content source: 1 (target), length: d5ffd30
0:000> !address edi
Usage: Other
Base Address: 001a0000
End Address: 001a4000
Region Size: 00004000 ( 16.000 kB)
State: 00001000 MEM_COMMIT
Protect: 00000002 PAGE_READONLY
Type: 00040000 MEM_MAPPED
Allocation Base: 001a0000
Allocation Protect: 00000002 PAGE_READONLY
Additional info: System Default Activation Context Data
Content source: 1 (target), length: 4000
0:000> !address esi
Usage: <unknown>
Base Address: 0d2d0000
End Address: 1a8dc000
Region Size: 0d60c000 ( 214.047 MB)
State: 00001000 MEM_COMMIT
Protect: 00000004 PAGE_READWRITE
Type: 00020000 MEM_PRIVATE
Allocation Base: 0d2d0000
Allocation Protect: 00000001 PAGE_NOACCESS
Content source: 1 (target), length: d5ffd30
Breakpoint 0 hit
eax=0000c8ac ebx=05000000 ecx=0000322b edx=00000000 esi=0cf6000c
edi=00193d3c
eip=30e9eb88 esp=00193d14 ebp=00193d4c iopl=0 nv up ei pl
nz na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200206
mso!Ordinal6426+0x64d:
30e9eb88 f3a5 rep movs dword ptr es:[edi],dword ptr
[esi]
Breakpoint 0 hit
eax=0000c8ac ebx=05000000 ecx=0000322b edx=00000000 esi=0cf6000c
edi=00193d3c
eip=30e9eb88 esp=00193d14 ebp=00193d4c iopl=0 nv up ei pl
nz na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200206
mso!Ordinal6426+0x64d:
30e9eb88 f3a5 rep movs dword ptr es:[edi],dword ptr
[esi]
0:000> kb
# ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames
may be wrong.
00 00193d4c 30f4cdbd 00193eb8 00000000 ffffffff
mso!Ordinal6426+0x64d
01 00193d7c 30f4a597 00193f04 00193eb8 00000000
mso!Ordinal753+0x306e
02 00193fc8 30d4b199 00000000 00194008 00000000
mso!Ordinal753+0x848
03 00193ff0 30d4b148 30d4ae32 03340b04 03340b3c
mso!Ordinal4196+0x61f
0:000> kb
# ChildEBP RetAddr Args to Child
WARNING: Stack unwind information not available. Following frames
may be wrong.
00 00193d4c 30f4cdbd 00193eb8 00000000 ffffffff
mso!Ordinal6426+0x64d
01 00193d7c 30f4a597 00193f04 00193eb8 00000000
mso!Ordinal753+0x306e
02 00193fc8 30d4b199 00000000 00194008 00000000
mso!Ordinal753+0x848
03 00193ff0 30d4b148 30d4ae32 03340b04 03340b3c
mso!Ordinal4196+0x61f
0:000> ub mso!Ordinal753+0x306e
mso!Ordinal753+0x305a:
30f4cda9 23c1 and eax,ecx
30f4cdab 50 push eax
30f4cdac 8d47ff lea eax,[edi-1]
30f4cdaf 50 push eax
30f4cdb0 8b4508 mov eax,dword ptr [ebp+8]
30f4cdb3 6a00 push 0
30f4cdb5 ff750c push dword ptr [ebp+0Ch]
30f4cdb8 e8a0feffff call mso!Ordinal753+0x2f0e (30f4cc5d)
0:000> ub mso!Ordinal753+0x306e
mso!Ordinal753+0x305a:
30f4cda9 23c1 and eax,ecx
30f4cdab 50 push eax
30f4cdac 8d47ff lea eax,[edi-1]
30f4cdaf 50 push eax
30f4cdb0 8b4508 mov eax,dword ptr [ebp+8]
30f4cdb3 6a00 push 0
30f4cdb5 ff750c push dword ptr [ebp+0Ch]
30f4cdb8 e8a0feffff call mso!Ordinal753+0x2f0e (30f4cc5d)
Breakpoint 0 hit
eax=00193f04 ebx=00000000 ecx=00193d78 edx=00000000 esi=00000000
edi=00000000
eip=30f4cc5d esp=00193d50 ebp=00193d7c iopl=0 nv up ei pl
zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200246
mso!Ordinal753+0x2f0e:
30f4cc5d 55 push ebp
Breakpoint 0 hit
eax=00193f04 ebx=00000000 ecx=00193d78 edx=00000000 esi=00000000
edi=00000000
eip=30f4cc5d esp=00193d50 ebp=00193d7c iopl=0 nv up ei pl
zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200246
mso!Ordinal753+0x2f0e:
30f4cc5d 55 push ebp
0:000> p
eax=00193f04 ebx=00000000 ecx=00193d78 edx=00000000 esi=00000000
edi=00000000
eip=30f4cc5e esp=00193d4c ebp=00193d7c iopl=0 nv up ei pl
zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200246
mso!Ordinal753+0x2f0f:
30f4cc5e 8bec mov ebp,esp
0:000> p
eax=00193f04 ebx=00000000 ecx=00193d78 edx=00000000 esi=00000000
edi=00000000
eip=30f4cc60 esp=00193d4c ebp=00193d4c iopl=0 nv up ei pl
zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200246
mso!Ordinal753+0x2f11:
30f4cc60 83ec14 sub esp,14h
0:000> p
eax=00193f04 ebx=00000000 ecx=00193d78 edx=00000000 esi=00000000
edi=00000000
eip=30f4cc63 esp=00193d38 ebp=00193d4c iopl=0 nv up ei pl
nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200202
mso!Ordinal753+0x2f14:
30f4cc63 837d1800 cmp dword ptr [ebp+18h],0
ss:002b:00193d64=02180b1c
0:000> p
eax=00193f04 ebx=00000000 ecx=00193d78 edx=00000000 esi=00000000
edi=00000000
eip=30f4cc67 esp=00193d38 ebp=00193d4c iopl=0 nv up ei pl
nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200202
mso!Ordinal753+0x2f18:
30f4cc67 57 push edi
0:000> p
eax=00193f04 ebx=00000000 ecx=00193d78 edx=00000000 esi=00000000
edi=00000000
eip=30f4cc68 esp=00193d34 ebp=00193d4c iopl=0 nv up ei pl
nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200202
mso!Ordinal753+0x2f19:
30f4cc68 8bf8 mov edi,eax
0:000> p
eax=00193f04 ebx=00000000 ecx=00193d78 edx=00000000 esi=00000000
edi=00193f04
eip=30f4cc6a esp=00193d34 ebp=00193d4c iopl=0 nv up ei pl
nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200202
mso!Ordinal753+0x2f1b:
30f4cc6a 0f84b6291300 je mso!Ordinal1549+0x93fa9 (3107f626)
[br=0]
0:000> p
eax=00193f04 ebx=00000000 ecx=00193d78 edx=00000000 esi=00000000
edi=00193f04
eip=30f4cc70 esp=00193d34 ebp=00193d4c iopl=0 nv up ei pl
nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200202
mso!Ordinal753+0x2f21:
30f4cc70 8b4f08 mov ecx,dword ptr [edi+8]
ds:002b:00193f0c=00194008
0:000> p
eax=00193f04 ebx=00000000 ecx=00194008 edx=00000000 esi=00000000
edi=00193f04
eip=30f4cc73 esp=00193d34 ebp=00193d4c iopl=0 nv up ei pl
nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200202
mso!Ordinal753+0x2f24:
30f4cc73 53 push ebx
0:000> p
eax=00193f04 ebx=00000000 ecx=00194008 edx=00000000 esi=00000000
edi=00193f04
eip=30f4cc74 esp=00193d30 ebp=00193d4c iopl=0 nv up ei pl
nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200202
mso!Ordinal753+0x2f25:
30f4cc74 56 push esi
0:000> p
eax=00193f04 ebx=00000000 ecx=00194008 edx=00000000 esi=00000000
edi=00193f04
eip=30f4cc75 esp=00193d2c ebp=00193d4c iopl=0 nv up ei pl
nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200202
mso!Ordinal753+0x2f26:
30f4cc75 e892b4ddff call mso!Ordinal6594+0x596 (30d2810c)
0:000> p
eax=001940cc ebx=00000000 ecx=00194008 edx=00000000 esi=00000000
edi=00193f04
eip=30f4cc7a esp=00193d2c ebp=00193d4c iopl=0 nv up ei pl
 
nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200202
mso!Ordinal753+0x2f2b:
30f4cc7a ff750c push dword ptr [ebp+0Ch]
ss:002b:00193d58=00000000
0:000> p
eax=001940cc ebx=00000000 ecx=00194008 edx=00000000 esi=00000000
edi=00193f04
eip=30f4cc7d esp=00193d28 ebp=00193d4c iopl=0 nv up ei pl
nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200202
mso!Ordinal753+0x2f2e:
30f4cc7d 8b7064 mov esi,dword ptr [eax+64h]
ds:002b:00194130=021807a4
0:000> p
eax=001940cc ebx=00000000 ecx=00194008 edx=00000000 esi=021807a4
edi=00193f04
eip=30f4cc80 esp=00193d28 ebp=00193d4c iopl=0 nv up ei pl
nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200202
mso!Ordinal753+0x2f31:
30f4cc80 8365f800 and dword ptr [ebp-8],0
ss:002b:00193d44=fa01d4c8
0:000> p
eax=001940cc ebx=00000000 ecx=00194008 edx=00000000 esi=021807a4
edi=00193f04
eip=30f4cc84 esp=00193d28 ebp=00193d4c iopl=0 nv up ei pl
zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200246
mso!Ordinal753+0x2f35:
30f4cc84 8b06 mov eax,dword ptr [esi]
ds:002b:021807a4=30d9ed10
0:000> p
eax=30d9ed10 ebx=00000000 ecx=00194008 edx=00000000 esi=021807a4
edi=00193f04
eip=30f4cc86 esp=00193d28 ebp=00193d4c iopl=0 nv up ei pl
zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200246
mso!Ordinal753+0x2f37:
30f4cc86 8d4df0 lea ecx,[ebp-10h]
0:000> p
eax=30d9ed10 ebx=00000000 ecx=00193d3c edx=00000000 esi=021807a4
edi=00193f04
eip=30f4cc89 esp=00193d28 ebp=00193d4c iopl=0 nv up ei pl
zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200246
mso!Ordinal753+0x2f3a:
30f4cc89 51 push ecx
0:000> p
eax=30d9ed10 ebx=00000000 ecx=00193d3c edx=00000000 esi=021807a4
edi=00193f04
eip=30f4cc8a esp=00193d24 ebp=00193d4c iopl=0 nv up ei pl
zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200246
mso!Ordinal753+0x2f3b:
30f4cc8a bb00000005 mov ebx,5000000h
0:000> p
eax=30d9ed10 ebx=05000000 ecx=00193d3c edx=00000000 esi=021807a4
edi=00193f04
eip=30f4cc8f esp=00193d24 ebp=00193d4c iopl=0 nv up ei pl
zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200246
mso!Ordinal753+0x2f40:
30f4cc8f 56 push esi
0:000> p
eax=30d9ed10 ebx=05000000 ecx=00193d3c edx=00000000 esi=021807a4
edi=00193f04
eip=30f4cc90 esp=00193d20 ebp=00193d4c iopl=0 nv up ei pl
zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200246
mso!Ordinal753+0x2f41:
30f4cc90 895df4 mov dword ptr [ebp-0Ch],ebx
ss:002b:00193d40=b2b6c000
0:000> p
eax=30d9ed10 ebx=05000000 ecx=00193d3c edx=00000000 esi=021807a4
edi=00193f04
eip=30f4cc93 esp=00193d20 ebp=00193d4c iopl=0 nv up ei pl
zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200246
mso!Ordinal753+0x2f44:
30f4cc93 ff501c call dword ptr [eax+1Ch]
ds:002b:30d9ed2c=30e9eb62
0:000> p
eax=00193f04 ebx=00000000 ecx=00193d78 edx=00000000 esi=00000000
edi=00000000
eip=30f4cc5e esp=00193d4c ebp=00193d7c iopl=0 nv up ei pl
zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200246
mso!Ordinal753+0x2f0f:
30f4cc5e 8bec mov ebp,esp
0:000> p
eax=00193f04 ebx=00000000 ecx=00193d78 edx=00000000 esi=00000000
edi=00000000
eip=30f4cc60 esp=00193d4c ebp=00193d4c iopl=0 nv up ei pl
zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200246
mso!Ordinal753+0x2f11:
30f4cc60 83ec14 sub esp,14h
0:000> p
eax=00193f04 ebx=00000000 ecx=00193d78 edx=00000000 esi=00000000
edi=00000000
eip=30f4cc63 esp=00193d38 ebp=00193d4c iopl=0 nv up ei pl
nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200202
mso!Ordinal753+0x2f14:
30f4cc63 837d1800 cmp dword ptr [ebp+18h],0
ss:002b:00193d64=02180b1c
0:000> p
eax=00193f04 ebx=00000000 ecx=00193d78 edx=00000000 esi=00000000
edi=00000000
eip=30f4cc67 esp=00193d38 ebp=00193d4c iopl=0 nv up ei pl
nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200202
mso!Ordinal753+0x2f18:
30f4cc67 57 push edi
0:000> p
eax=00193f04 ebx=00000000 ecx=00193d78 edx=00000000 esi=00000000
edi=00000000
eip=30f4cc68 esp=00193d34 ebp=00193d4c iopl=0 nv up ei pl
nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200202
mso!Ordinal753+0x2f19:
30f4cc68 8bf8 mov edi,eax
0:000> p
eax=00193f04 ebx=00000000 ecx=00193d78 edx=00000000 esi=00000000
edi=00193f04
eip=30f4cc6a esp=00193d34 ebp=00193d4c iopl=0 nv up ei pl
nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200202
mso!Ordinal753+0x2f1b:
30f4cc6a 0f84b6291300 je mso!Ordinal1549+0x93fa9 (3107f626)
[br=0]
0:000> p
eax=00193f04 ebx=00000000 ecx=00193d78 edx=00000000 esi=00000000
edi=00193f04
eip=30f4cc70 esp=00193d34 ebp=00193d4c iopl=0 nv up ei pl
nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200202
mso!Ordinal753+0x2f21:
30f4cc70 8b4f08 mov ecx,dword ptr [edi+8]
ds:002b:00193f0c=00194008
0:000> p
eax=00193f04 ebx=00000000 ecx=00194008 edx=00000000 esi=00000000
edi=00193f04
eip=30f4cc73 esp=00193d34 ebp=00193d4c iopl=0 nv up ei pl
nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200202
mso!Ordinal753+0x2f24:
30f4cc73 53 push ebx
0:000> p
eax=00193f04 ebx=00000000 ecx=00194008 edx=00000000 esi=00000000
edi=00193f04
eip=30f4cc74 esp=00193d30 ebp=00193d4c iopl=0 nv up ei pl
nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200202
mso!Ordinal753+0x2f25:
30f4cc74 56 push esi
0:000> p
eax=00193f04 ebx=00000000 ecx=00194008 edx=00000000 esi=00000000
edi=00193f04
eip=30f4cc75 esp=00193d2c ebp=00193d4c iopl=0 nv up ei pl
nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200202
mso!Ordinal753+0x2f26:
30f4cc75 e892b4ddff call mso!Ordinal6594+0x596 (30d2810c)
0:000> p
eax=001940cc ebx=00000000 ecx=00194008 edx=00000000 esi=00000000
edi=00193f04
eip=30f4cc7a esp=00193d2c ebp=00193d4c iopl=0 nv up ei pl
 
nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200202
mso!Ordinal753+0x2f2b:
30f4cc7a ff750c push dword ptr [ebp+0Ch]
ss:002b:00193d58=00000000
0:000> p
eax=001940cc ebx=00000000 ecx=00194008 edx=00000000 esi=00000000
edi=00193f04
eip=30f4cc7d esp=00193d28 ebp=00193d4c iopl=0 nv up ei pl
nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200202
mso!Ordinal753+0x2f2e:
30f4cc7d 8b7064 mov esi,dword ptr [eax+64h]
ds:002b:00194130=021807a4
0:000> p
eax=001940cc ebx=00000000 ecx=00194008 edx=00000000 esi=021807a4
edi=00193f04
eip=30f4cc80 esp=00193d28 ebp=00193d4c iopl=0 nv up ei pl
nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200202
mso!Ordinal753+0x2f31:
30f4cc80 8365f800 and dword ptr [ebp-8],0
ss:002b:00193d44=fa01d4c8
0:000> p
eax=001940cc ebx=00000000 ecx=00194008 edx=00000000 esi=021807a4
edi=00193f04
eip=30f4cc84 esp=00193d28 ebp=00193d4c iopl=0 nv up ei pl
zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200246
mso!Ordinal753+0x2f35:
30f4cc84 8b06 mov eax,dword ptr [esi]
ds:002b:021807a4=30d9ed10
0:000> p
eax=30d9ed10 ebx=00000000 ecx=00194008 edx=00000000 esi=021807a4
edi=00193f04
eip=30f4cc86 esp=00193d28 ebp=00193d4c iopl=0 nv up ei pl
zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200246
mso!Ordinal753+0x2f37:
30f4cc86 8d4df0 lea ecx,[ebp-10h]
0:000> p
eax=30d9ed10 ebx=00000000 ecx=00193d3c edx=00000000 esi=021807a4
edi=00193f04
eip=30f4cc89 esp=00193d28 ebp=00193d4c iopl=0 nv up ei pl
zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b
efl=00200246
mso!Ordinal753+0x2f3a:
30f4cc89 51 push ecx
0:000> p
eax=30d9ed10 ebx=00000000 ecx=00193d3c edx=00000000 esi=021807a4
edi=00193f04
eip=30f4cc8a esp=00193d24 ebp=00193d4c iopl=0 nv up ei pl
zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b

		
								
				
				登录后可查看完整内容
			
			
				
	

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课

		#Windows
		#漏洞分析
	