One byte heap overflow

The following code snippet copies the content of source buffer to the destination buffer. Since the source buffer is one-byte-larger than the destination buffer it overflows the heap by one byte.

void main(void)
{
    char* pDest = new char[4];
    char pSrc[] = {"Bytes"};
    memcpy(pDest, pSrc, 5);
    delete pDest;
}

Let's see the source code again matching the blocks to their native counterparts.

void main(void)
{
 push        ebp
 mov         ebp,esp
 sub         esp,8
    char* pDest = new char[4];
 push        4
 call        dword ptr [__imp_operator new (10E209Ch)]
    char pSrc[] = {"Bytes"};
 mov         ecx,dword ptr [string "Bytes" (10E20F4h)]
 mov         dx,word ptr ds:[10E20F8h]
    memcpy(pDest, pSrc, 5);
 mov         dword ptr [eax],ecx ;Copy 4 bytes to destination buffer
 mov         cl,dl
    delete pDest;
 push        eax
 mov         word ptr [ebp-4],dx
 mov         byte ptr [eax+4],cl ;Copy the 5th byte out of destination buffer
 call        dword ptr [__imp_operator delete (10E20A4h)]
 add         esp,8
}
 xor         eax,eax
 mov         esp,ebp
 pop         ebp
 ret

In this example one byte overflow didn't lead to crash on my machine, and in reality, the error would have remained undetected. These errors can be detected by enabling full page heap verification by setting up global flags like below.

gflags /p /enable TestSilentCorrupt.exe /full

When you execute the program it now crashes when delete() is called.

It remains a question for me that the copy of 5th byte why it is associated in the block with delete() rather with memcpy().

Finding the appropriate ReadFile

There are applications reading data from numerous files when they're running. If you want to intercept when the certain file is being read, one possibility is to put breakpoint, let's say, on ReadFile() and wait for the debugger to break in. It happens that the debugger constantly breaks in on ReadFile() that you're not interested in. It can be extremely time consuming to ignore the unwanted debugger breaks until the certain file is being read.

This is a Windbg script that I usually use it as a template to intercept when a certain file is being read. It checks for specified value in the buffer of ReadFile(), and if the vaule matches the debugger can break in.

Fuzzing Control Transfer Instructions

Earlier last year, I wrote about my Flash fuzzer for example here and here.

This weekend I just added a little improvement to it. Since I was able to reach the byte codes of DoABC tag and to parse them, there is a lot of possibility to implement fuzzing opportunities by little changes.

What I did is the ability to alter control transfer instructions for ifeq, iffalse, ifge, ifgt, ifle, iflt, ifnge, ifngt, ifnle, ifnlt, ifne, ifstricteq, ifstrictne, iftrue, jump to change the target address of them. These instructions take only one operand that is fixed-length: 24-bit signed integer that is 3 bytes, so it was very straightforward to parse and change them.

One thing I wanted to pay attention that is the target of jumps should be within the region of the method but it was quick to implement this because the method addresses and sizes are already available from the parser info.

Unexpected Thickness of SplitContainer

I haven't really been involved in C# apart from spent the whole 2011 to reverse engineer MSIL code at work but that wasn't about programming; it was about to debug .NET code without using reference to source code, but in fact, none of real programming experience.

My role has been changed at work, and it's unlikely I will continue with .NET anyhow. This is a great opportunity for me to fill my freetime with C# programming - I find .NET interesting, have the (low-level) basics of the virtual machine after all, and people say it's (very) straightforward to get on with it at development point of view.

Here is the first impression involving SplitContainer.

I needed to split the screen into three panels. SplitContainer divides the display area into two panels, but when you use only one instance, you cannot really use it to divide the display area into three panels. I managed to use two SplitContainers to divide the display area into three panels. There is the main SplitContainer, and there is the secondary SplitContainer put on one panel of the main SplitContainer's. I had three panes and I thought that was it.

I set SplitterWidth to 1 on both of SplitContainers to narrow the thickness of the splitter. Launched the program to check if it looked as expected, but in reality, it didn't. Here is how it looked.

As you can see above that the splitter of the secondary SplitContainer was not as thick as the splitter of the main SplitContainer. It's interesting because, on the design view, it looked good.

I set SplitterWidth to 2 and checked the result but the thickness of the splitters have different sizes when started the program.

I set SplitterWidth to 4 and surprisingly the result looked good. The splitters, however, were too wide to use it in a program. You can see ot on the picture below.

The solution is as follows. I don't know the root cause of this but I realized if I set SplitterWidth to 1 in the constructor of the Form, the splitters' wide have the same size, as seen below.

Above experiences are with Microsoft Visual C# 2010 Express.

Software and Visual Thinking

Being said that the design of Graphical User Interface should not introduce new functionality in the application. The GUI and the functionality should be separated, and implemented on different levels which pretty much seems to be logical for me, but I'd add something important to this general claim.

There are people, including me, who are more of visual types. For me, visual things excite the imagination and when representing things visually, I can create new things from them that have some kind of value.

It happened to me numerous times to get new ideas involving awesome functionalities during the design of GUI. These ideas didn't come to my mind when I was focusing exclusively on functionality design.

Freedom inhibits creativity. When you're on the design of GUI, there are many restrictions (that you can see) and this stimulates the brain to create some new ideas.

I've imagined an application consists of multiple functions. Actually, it is a mix and improvement of some tools I wrote earlier. I'd put these small ideas into one application, by doing so, there is the possibility to connect those small functions to work together and would take the advantage of it. Also, I have some ideas about functionalities that I've seen in other applications, albeit that need change according to imagination.

The basic is as follows. The input is the (unknown) binary file. You can browse the file, can discover the structure of it, can display distribution diagrams and others. Also, can apply particular algorithms on data such as decoding compressed stream or display multimedia content.

Analysis of Data Formats by Guessing - Part II

I'm writing about how to find possible TIMESTAMP values in raw binary data.

Here is the first part of data format analysis by guessing but you can read this entry independently anyway.

TIMESTAMP is a DWORD value, represents Unix time, and we assume it's encoded as little-endian somewhere in the binary.

The prototype program reads the binary data into a byte array. It iterates through the array elements by reading four bytes at each position in the array, interprets as DWORD, and compares if the value falls into the date range we are after.

The looser date range you set the more likely to find false positives in your search result.

I've tested the code with a relatively strict date range, i.e. one month, and didn't find any false positives but did find TIMESTAMP. There were cases when multiple TIMESTAMPs found in PE files; for example one in the header and one in the .rdata section.

If you cannot set a loose date range, and there is a likelihood you came across to false positives you can filter out the results by applying some of the below.

• You know more about the date e.g. it cannot be Saturday or Sunday?
• It should be in a high entropy region of the dump, or on the contrary?
• There might be other values stored around, do you know more about those values? Presence of scattered zeroes?
• Should it be aligned to some value?