I recently acquired an exploit for an image viewer program and started analyzing.

Specific details cannot be given, but basically it is a SEH overwrite exploit using malicious image file.

Using immunity dbg, I saw that SEH being overwritten by 38 4c 5c 36. But dbg fails to execute that memory address.

Exploit executes calc just fine, but by attaching the viewer program to a debugger, it hangs trying to execute 38 4c 5c 36.

I tried to jump to that address but dbg says it is a unspecified address. I have a few questions about this memory address

1. what kind of data is loaded in memory address near 38 4c 5c 36 ? (looking at the memory map it is between loaded dll files and nothing is loaded it seems)

2. is 38 4c 5c 36 where the exploit is loaded in the memory or am I making a wrong guess?

3. If it is where exploit is loaded, what should I do to further analyze using a debugger?

Thank you in advance :)

I recently acquired an exploit for an image viewer program and started analyzing.

Specific details cannot be given, but basically it is a SEH overwrite exploit using malicious image file.

Using immunity dbg, I saw that SEH being overwritten by 38 4c 5c 36. But dbg fails to execute that memory address.

Exploit executes calc just fine, but by attaching a debugger to the viewer program, it hangs trying to execute 38 4c 5c 36.

I tried to jump to that address but dbg says it is a unspecified address. I have a few questions about this memory address

1. what kind of data is loaded in memory address near 38 4c 5c 36 ? (looking at the memory map it is between loaded dll files and nothing is loaded it seems)

2. is 38 4c 5c 36 where the exploit is loaded in the memory or am I making a wrong guess?

3. If it is where exploit is loaded, what should I do to further analyze using a debugger?

Thank you in advance :)