1

I have been working on finding an overflow in wordpad and i was able to run an exception with an undefined behavior (my point of view). I am using x64dbg (I am not a pro x64dbg) and it shows unexpected HRESULT and almost all registers filled with random values (they dont get filled when a non corrupted file is loaded). I am new to x64dbg and how would I go saying this is vulnerable ? How do I analyze the exception and the behavior ? How do I exploit ? I have so many questions. Please help. The memory dump is too big so it is impossible to identify anything. What steps should I follow ? Sometimes shows unexpected HRESULT on R8 register as well.

enter image description here

| improve this question | |
  • Please don’t use “x64” as abbreviation of x64dbg, it’s a separate term on its own. – Igor Skochinsky♦ Jun 3 at 18:43
  • @IgorSkochinsky why do registers get random values even tho this is not an overflow ? How do I analyze the exception – turmuka Jun 4 at 10:36
  • why do you think these values are random? – morsisko Jul 4 at 21:38
  • apparently they are not. but why @morsisko – turmuka Jul 11 at 1:32
0

The exception shown in status bar (CPP_EH_EXCEPTION) is a special exception code used to implement C++ exceptions (throw/catch) and usually does not indicate a bug or vulnerability. In most cases it can be passed to the program which expects it and will handle it.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.