[原创]Free CD to MP3 Converter v3.1 栈溢出漏洞分析与利用
弱弱的问一下 当计算到偏移量重新构造文件之后,即构造4156个A,4个B,4个C,然后再用windbg加载的时候为什么出现了下面这样的情况:
(a24.934): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 ebx=41414141 ecx=0000103c edx=0000103c esi=41414141 edi=41414141
eip=41414141 esp=0012fab0 ebp=41414141 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206
41414141 ?? ???
0:000> !exchain
0012fad8: *** WARNING: Unable to verify checksum for image00400000
*** ERROR: Module load completed but symbols could not be loaded for image00400000
image00400000+b05bb (004b05bb)
0012fae4: image00400000+3cfd (00403cfd)
0012fdf8: image00400000+6c4df (0046c4df)
0012fe04: image00400000+6c4f0 (0046c4f0)
0012febc: user32!_except_handler3+0 (77d4048f)
CRT scope 0, func: user32!UserCallWinProcCheckWow+155 (77d4ac6b)
0012ff1c: user32!_except_handler3+0 (77d4048f)
0012ff80: image00400000+88b79 (00488b79)
0012ff8c: image00400000+88bb2 (00488bb2)
0012ffb4: image00400000+4364 (00404364)
0012ffe0: kernel32!_except_handler3+0 (7c839ad8)
CRT scope 0, filter: kernel32!BaseProcessStart+29 (7c8438ea)
func: kernel32!BaseProcessStart+3a (7c843900)
百思不得其解啊,应该是:
0:000> !exchain
0012fad8: 43434343
Invalid exception stack at 42424242
才对啊,这里是不是说明SEH结构没有被覆盖呢。。。求大牛指点一下啊