Skip to content
This repository has been archived by the owner on Dec 27, 2023. It is now read-only.

Latest commit

 

History

History

dwarf64-uaf

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
 
 
 
 

Use-after-free in dwarf64

Reproduction steps:

reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ida64.exe" /v "GlobalFlag" /t REG_SZ /d "0x2000000" /f
windbgx -g "C:\Program Files\IDA Pro 7.5\ida64.exe" -B crash-EXCEPTION_ACCESS_VIOLATION-7ffa93547453

Output from windbg:

0:000> r
rax=00000160a2765ff0 rbx=000000449a1f3a90 rcx=00000160a2765ff0
rdx=0000000000000000 rsi=0000000000000015 rdi=00000160a7265ff0
rip=00007ffa93547453 rsp=000000449a1f3980 rbp=0000000000000000
 r8=0000000000000000  r9=0000000000000001 r10=0000000000000000
r11=0000000000000246 r12=0000000000000001 r13=00000160a270f000
r14=0000000000000000 r15=000000449a1f9580
iopl=0         nv up ei pl nz na pe nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
dwarf64+0x47453:
00007ffa`93547453 488b07          mov     rax,qword ptr [rdi] ds:00000160`a7265ff0=????????????????

0:000> !heap -p -a @rdi
    address 00000160a7265ff0 found in
    _DPH_HEAP_ROOT @ 160936c1000
    in free-ed allocation (  DPH_HEAP_BLOCK:         VirtAddr         VirtSize)
                                160b0397410:      160a7265000             2000
    00007ffacdee57f6 ntdll!RtlDebugReAllocateHeap+0x0000000000000046
    00007ffacde95914 ntdll!RtlpReAllocateHeapInternal+0x0000000000072bd4
    00007ffacde22d0a ntdll!RtlReAllocateHeap+0x000000000000005a
    00007ffacaf23c99 ucrtbase!_realloc_base+0x0000000000000039
    000000007030f23f ida64!qvector_reserve+0x000000000000007f
    00007ffa9354743c dwarf64+0x000000000004743c
    00007ffa93528d5f dwarf64+0x0000000000028d5f
    00007ffa935292e7 dwarf64+0x00000000000292e7
    00007ffa93518c32 dwarf64+0x0000000000018c32
    00007ffa935537d6 dwarf64+0x00000000000537d6
    00007ffa9355004a dwarf64+0x000000000005004a
    00007ffa9352190d dwarf64+0x000000000002190d
    00007ffa935267b1 dwarf64+0x00000000000267b1
    00007ffa9354bbdf dwarf64+0x000000000004bbdf
    00007ffa9354ba41 dwarf64+0x000000000004ba41
    00007ffa9354bd2e dwarf64+0x000000000004bd2e
    00007ffa93518d42 dwarf64+0x0000000000018d42
    00007ffa935537d6 dwarf64+0x00000000000537d6
    00007ffa935500c3 dwarf64+0x00000000000500c3
    00007ffa9352190d dwarf64+0x000000000002190d
    00007ffa935267b1 dwarf64+0x00000000000267b1
    00007ffa9354bbdf dwarf64+0x000000000004bbdf
    00007ffa9354ba41 dwarf64+0x000000000004ba41
    00007ffa9354bd2e dwarf64+0x000000000004bd2e
    00007ffa93518d42 dwarf64+0x0000000000018d42
    00007ffa935537d6 dwarf64+0x00000000000537d6
    00007ffa9355004a dwarf64+0x000000000005004a
    00007ffa9352190d dwarf64+0x000000000002190d
    00007ffa935267b1 dwarf64+0x00000000000267b1
    00007ffa9354bbdf dwarf64+0x000000000004bbdf
    00007ffa9354ba41 dwarf64+0x000000000004ba41
    00007ffa9354bd2e dwarf64+0x000000000004bd2e