the original cloud security

Reverse Engineering SEHOP Chain Validation

Reverse Engineering SEHOP Chain Validation
Posted Jan 11, 2012
Authored by x90c

This proof of concept reverse engineering code demonstrates SEHOP chain validation.

tags | exploit, proof of concept
MD5 | 51cce128eb69749ce5846a7d9b1c95f0

Reverse Engineering SEHOP Chain Validation

Change Mirror Download
Reverse Engineering code of SEHOP Chain Validation 
by x90c (geinblues@gmail.com)


--[ sehop_chain_validation.c ]--

typedef struct _EXCEPTION_REGISTRATION_RECORD
{
struct _EXCEPTION_REGISTRATION_RECORD *Next;
PEXCEPTION_ROUTINE Handler;
} EXCEPTION_REGISTRATION_RECORD, *PEXCEPTION_REGISTRATION_RECORD;

/* first E_R struct of ebx[E_R->Next] to search */
register _EXCEPTION_REGISTRATION_RECORD *E_R = first_E_R_struct;

SEHOP_CHAIN_VALIDATION:
{
/* E_R and E_R->scopetable(E_R+8) isn't in the stack area? */
if(E_R < stack_bottom || E_R->scopetable > stack_top)
SEHOP_validation_error();

/* E_R struct isn't 4-byte alignment ? */
if(!(E_R & 0x3))
SEHOP_validation_error();

/*
* E_R->Handler isn't in the stack area(0x12c000 ~ 0x130000)?
* If stack ASLR then the address range will be changed.
*/
if(E_R->Handler < stack_bottom || E_R->Handler > stack_top))
SEHOP_validation_error();
else
E_R->Handler();

E_R = E_R->Next; /* Move to next chain record */

/*
* Next is the symbolic record(last chain record)?
* The symbolic record(last chain record) can be final exception registration record
* for ntdll!FinalExceptionHandler.
*/
if(E_R != 0xFFFFFFFF)
goto SEHOP_CHAIN_VALIDATION;
}
-- [ eoc ] --


Disassemble In Win Vista UltimateK sp1 running on VMware.
76e40d9c 8b1b mov ebx,dword ptr [ebx] ; ebx = E_R->Next
76e40d6d 3b5df8 cmp ebx,dword ptr [ebp-8] ; <-- (1) ebx = E_R struct < 12c000 ?
76e40d70 0f829ad1feff jb ntdll!RtlDispatchException+0x19d (76e2df10)
76e40d76 8d4308 lea eax,[ebx+8] ; eax = E_R+8 (scopetable)
76e40d79 3b45f4 cmp eax,dword ptr [ebp-0Ch]
76e40d7c 0f878ed1feff ja ntdll!RtlDispatchException+0x19d (76e2df10) ; 12e5dc > [12db00] ( 130000 )
76e40d82 f6c303 test bl,3 ; bl & 3 ( Not 4-byte alignment ? )
76e40d85 0f8585d1feff jne ntdll!RtlDispatchException+0x19d (76e2df10) ; not 4-byte alignment?
76e40d8b 8b4304 mov eax,dword ptr [ebx+4] ; eax = [E_R+4] (_exception_handler)
76e40d8e 3b45f8 cmp eax,dword ptr [ebp-8]
76e40d91 7209 jb ntdll!RtlDispatchException+0x96 (76e40d9c) ; exception handler < 0012c000 ?
76e40d93 3b45f4 cmp eax,dword ptr [ebp-0Ch]
76e40d96 0f8274d1feff jb ntdll!RtlDispatchException+0x19d (76e2df10) ; exception handler < 00130000 ?
76e40d9e 3bdf cmp ebx,edi
76e40da0 75cb jne ntdll!RtlDispatchException+0x67 (76e40d6d) ; ebx != FFFFFFFFh ?



Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

July 2017

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    2 Files
  • 2
    Jul 2nd
    3 Files
  • 3
    Jul 3rd
    15 Files
  • 4
    Jul 4th
    4 Files
  • 5
    Jul 5th
    15 Files
  • 6
    Jul 6th
    15 Files
  • 7
    Jul 7th
    10 Files
  • 8
    Jul 8th
    2 Files
  • 9
    Jul 9th
    10 Files
  • 10
    Jul 10th
    15 Files
  • 11
    Jul 11th
    15 Files
  • 12
    Jul 12th
    19 Files
  • 13
    Jul 13th
    16 Files
  • 14
    Jul 14th
    15 Files
  • 15
    Jul 15th
    3 Files
  • 16
    Jul 16th
    2 Files
  • 17
    Jul 17th
    8 Files
  • 18
    Jul 18th
    11 Files
  • 19
    Jul 19th
    2 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close