Bug Hunter Diary

Figure 6-5: Graph view of the vulnerable code path in IDA Pro, part 2Here’s some pseudo C code of that memcpy() call:memcpy ([EAX+0x18], ESI + 4, 0x21a * 4);Or, in more abstract terms:memcpy (user_controlled_address, user_controlled_data, 0x868);It is therefore possible to write 0x868 bytes (0x21a * 4 bytes, as therep movsd instruction copies DWORDs from one location to another)of user-controllable data to an arbitrary user-controlled address ineither user or kernel space. Nice!The anatomy of the bug, diagrammed in Figure 6-6, is as follows:1. An IOCTL request (0xB2D60030) is sent to the kernel driverAavmker4.sys using the AavmKer4 device.2. The driver code checks whether the IOCTL input data lengthequals the value 0x878. If so, proceed to step 3.102 Chapter 6