翻译附注：一直在分析关于PDF方面的漏洞，CVE-2009-3459是之前刚爆出来的漏洞，网上有这么一篇分析文章
<<
/ParamX 1073741838 //关键参数(此处是经过替换的，原参数为Colors)
>>
/Length 299
/Filter /FlateDecode
>>
stream
[stream encoded by flate, original stream is: 00 00 20 00 00 00 10]
[流已经用flate编码，原流为00 00 20 00 00 00 10]
endstream
.text:003A7FB4 loc_3A7FB4: ; CODE XREF: sub_3A7ED0+1CDj
.text:003A7FB4 mov edx, [esp+3Ch+var_C] ; loop starts
.text:003A7FB8 mov eax, [esp+3Ch+arg_0]
.text:003A7FBC
.text:003A7FBC loc_3A7FBC: ; CODE XREF: sub_3A7ED0+E2j
.text:003A7FBC cmp eax, ecx ; if v_counter>bits_original_stream,
.text:003A7FBE jge loc_3A80A3 ; break from the loop
.text:003A7FC4 mov ebp, [esi+0Ch] ; [esi+0Ch] is 4000000Eh here
.text:003A7FC7 add eax, edi ; edi is 0
.text:003A7FC9 add eax, edx ; edx is 0
.text:003A7FCB cdq
.text:003A7FCC idiv ebp ; v_counter idiv 4000000Eh
.text:003A7FCE lea eax, [ecx+edi] ; edx became v_counter
.text:003A7FD1 mov ecx, [esi+10h]
.text:003A7FD4 cmp ecx, 3
.text:003A7FD7 lea ebx, [esi+edx*4+44h] ; lpBuff + v_counter*4 + 0x44
...
.text:003A805C loc_3A805C: ; CODE XREF: sub_3A7ED0+168j
.text:003A805C mov edx, [ebx]
.text:003A805E push edx
.text:003A805F mov edx, [esp+40h+var_20]
.text:003A8063 shl eax, cl
.text:003A8065 push edx
.text:003A8066 mov edx, [esp+44h+var_28]
.text:003A806A shl ebp, cl
.text:003A806C push ebp
.text:003A806D push eax
.text:003A806E mov eax, [esp+4Ch+arg_0]
.text:003A8072 add eax, edi
.text:003A8074 shl eax, cl
.text:003A8076 push edx
.text:003A8077 call sub_9D7850 ; will be analyzed later
.text:003A807C add esp, 14h
.text:003A807F
.text:003A807F loc_3A807F: ; CODE XREF: sub_3A7ED0+18Aj
.text:003A807F mov [ebx], eax ; overwrite the DWORD with the return value
.text:003A8081
.text:003A8081 loc_3A8081: ; CODE XREF: sub_3A7ED0+149j
.text:003A8081 ; sub_3A7ED0+163j
.text:003A8081 mov eax, [esp+3Ch+arg_0]
.text:003A8085 add [esp+3Ch+var_18], 2
.text:003A808A add [esp+3Ch+var_1C], 1
.text:003A808F mov ecx, [esp+3Ch+arg_4]
.text:003A8093 add eax, 1 ; v_counter++
.text:003A8096 cmp eax, [esi+0Ch] ; [ESI+0C]=0x4000000E, so keep looping
.text:003A8099 mov [esp+3Ch+arg_0], eax
.text:003A809D jl loc_3A7FB4 ; loop
for(;;) {
if( v_counter > bits_original_stream ) break;
tmp_counter = v_counter % ParamX;
lpCurrent = lpBuff + tmp_counter * 4 + 0x44;
iRetVal = mystery_func( *lpCurrent, variables...);
*lpCurrent = iRetVal;
v_counter++;
if( v_counter >= ParamX ) break;
.text:009D7884 mov esi, edi ; edi is v_counter
.text:009D7886 sar esi, 3 ; v_counter/8
.text:009D7889 add esi, [esp+1Ch+lp_original_stream] ; pass how many bytes
.text:009D788D mov ecx, edi
.text:009D788F movzx edx, byte ptr [esi] ; read next byte
.text:009D7892 and ecx, 7 ; pass how many bits in the next byte
.text:009D7895 mov eax, 8
.text:009D789A sub eax, ecx
.text:009D789C sub eax, ebp ; ebp is always 1
.text:009D789E mov cl, al
.text:009D78A0 shr edx, cl ; set the lowest bit as the corresponding bit
.text:009D78A2 and edx, [esp+1Ch+var_8] ; var_8 is always 1, so corresponding bit is the DWORD value
.text:009D78A6 cmp [esp+1Ch+arg_C], 0 ; arg_C is always 0
.text:009D78AC jz short loc_9D78BC ; jump
�
.text:009D78BC loc_9D78BC: ; CODE XREF: sub_9D7850+5Cj
.text:009D78BC mov ecx, [esp+1Ch+arg_10]; get the old_DWORD
.text:009D78C0 add ecx, edx ; new_DWORD = old_DWORD + corresponding-bit
.text:009D78C2 mov edx, ecx
.text:009D78C4
.text:009D78C4 loc_9D78C4: ; CODE XREF: sub_9D7850+6Aj
.text:009D78C4 and dl, [esp+1Ch+var_9]
.text:009D78C8 add edi, [esp+1Ch+arg_8]
.text:009D78CC mov [esp+1Ch+arg_10], ecx ; save the new_DWORD
�
.text:009D78E5 mov eax, [esp+18h+arg_10] ; return the new_DWORD
Breakpoint 0 hit
eax=02008b1c ebx=00000001 ecx=0012ed54 edx=0438afcb esi=0438af18 edi=0012eea0
eip=009f7868 esp=0012ed3c ebp=0438afcb iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206
AcroRd32!AVAcroALM_IsFeatureEnabled+0x63e09:
009f7868 e863060000 call AcroRd32!AVAcroALM_IsFeatureEnabled+0x64471 (009f7ed0)
0:000> dd esp
0012ed3c 0012ed54 0438af18 02008b1c 00000000
0012ed4c 0210b734 01f2b424 0438afcb 00a8da8e
0:000> dd 02008b1c+80+90
02008c2c <b>0124da40</b> 00000544 0017ee98 ffffffff
02008c3c 00000000 00000000 00000000 00000000
Breakpoint 1 hit
eax=00000000 ebx=00000001 ecx=00000038 edx=00000000 esi=0438af18 edi=0012eea0
eip=009f786d esp=0012ed3c ebp=0438afcb iopl=0 nv up ei pl nz ac po nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000212
AcroRd32!AVAcroALM_IsFeatureEnabled+0x63e0e:
009f786d 83c40c add esp,0Ch
0:000> dd 02008b1c+80+90
02008c2c <b>0124da41</b> 00000544 0017ee98 ffffffff
02008c3c 00000000 00000000 00000000 00000000
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
上传的附件：
.... 好好研究研究
