1

I have been working on finding an overflow in WordPad and I was able to run an exception with an undefined behavior (my point of view).

I am using x64dbg (I am not a pro x64dbg) and it shows unexpected HRESULT and almost all registers filled with random values (they don't get filled when a non-corrupted file is loaded).

I am new to x64dbg — how would I go saying this is vulnerable? How do I analyze the exception and the behavior? How do I exploit it?

I have so many questions. Please help. The memory dump is too big, so it is impossible to identify anything. What steps should I follow? Sometimes shows unexpected HRESULT on R8 register as well.

enter image description here

Improve this question
4
  • Please don’t use “x64” as abbreviation of x64dbg, it’s a separate term on its own.
    – Igor Skochinsky ♦
    Jun 3 '20 at 18:43
  • @IgorSkochinsky why do registers get random values even tho this is not an overflow ? How do I analyze the exception
    – turmuka
    Jun 4 '20 at 10:36
  • why do you think these values are random?
    – morsisko
    Jul 4 '20 at 21:38
  • apparently they are not. but why @morsisko
    – turmuka
    Jul 11 '20 at 1:32
1

The exception shown in status bar (CPP_EH_EXCEPTION) is a special exception code used to implement C++ exceptions (throw/catch) and usually does not indicate a bug or vulnerability. In most cases it can be passed to the program which expects it and will handle it.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.