;Title : OllyDbg/Immunity Debugger - Crash POC
;Researcher : Souhail Hammou (Dark-Puzzle)
;Research Team : http://itsecurity.ma
;Facebook : http://www.facebook.com/dark.puzzle.sec
;Date : 29/07/2013
;Details and Analysis :
;Pictures : 1.jpg : http://oi44.tinypic.com/dytanq.jpg
; 2.jpg : http://oi42.tinypic.com/2md0uvm.jpg
;This bug affects both OllyDbg and Immunity Debugger, a user can crash the debugger using one of the "pane" functionalities. The pane actually helps the reverser
;in order to locate where jumps were taken from or where they will lead, it will also display the memory addresses and display the ASCII format of what it holds if
;it's a printable string of course when the instruction containing that memory address is clicked.
;What we will be looking at is the "modify register" command that will help you modify a register value directly from the pane.
;Let's fully demonstrate the issue by debugging an x86 ASM little program "MASM Syntax".
welcome db "Hello...",0
bye db "Bye",0
whatever db 10 dup(?)
invoke StdOut, addr welcome
mov eax, 00403000h ;demonstrating mov instruction
lea ecx, bye ;demonstrating lea instruction
invoke StdOut, addr bye
invoke StdIn, addr whatever,10
;Now let's see how the debugger is disassembling the targets' instructions :
;0040100A |. B8 00304000 MOV EAX,test.00403000 ; ASCII "Hello..."
;0040100F |. 8D0D 09304000 LEA ECX,DWORD PTR DS: ; 00403009 is pointing to ASCII "Bye"
;Now without stepping into the MOV instruction , try just to click on it and you'll see the following in the pane :
; 00403000=test.00403000 (ASCII "Hello...")
;Select this line and click the right button , now click on "modify register" which will open a box indicating that you are about to edit the value of EAX register
;Without stepping again, select the LEA instruction you will see in the pane this :
; Address=00403009, (ASCII "Bye")
;Click the right button on that line again, and select "Modify Register" ... Boom !! Crash !
;The difference between MOV and LEA is that when dealing with MOV the debugger will edit the value of the register which the instruction is moved to.
;But when dealing with LEA instruction the debugger will just crash.
;Quick Crash Analysis :
;When the user will click "modify register" in the case of a LEA instruction , Olly/Immunity debugger will try to print "Modify reg"
;using this set of instructions:
;004302B9 . 8B1C95 A475650>MOV EBX,DWORD PTR DS:[EDX*4+6575A4] ; | Important Instruction !
;004309DA > 8B049D 48D25E0>MOV EAX,DWORD PTR DS:[EBX*4+5ED248] ; | Important Instruction !
;004309E1 . 8DB424 C609000>LEA ESI,DWORD PTR SS:[ESP+9C6] ; |
;004309E8 . 31FF XOR EDI,EDI ; |
;004309EA . C74424 04 0E48>MOV DWORD PTR SS:[ESP+4],Immunity.0060480E ; |ASCII "Modify %s"
;004309F2 . 893424 MOV DWORD PTR SS:[ESP],ESI ; |
;004309F5 . 894424 08 MOV DWORD PTR SS:[ESP+8],EAX ; |
;004309F9 . E8 12501A00 CALL <JMP.&ntdll.sprintf> ; \sprintf
;Actually when dealing with a MOV instruction. at address 004302B9 , [EBX*4+6575A4] will hold a small value that indicates the placement of the targeted register string
;in memory that will be multiplied by 4 and added to memory address 005ED248.
;But when Dealing with a LEA instructions [EBX*4+6575A4] will hold the memory address of the element shown in the pane, in our case 00403009 which equals 4206601 in decimal .
;So when trying to detect which register is dealed with (at 004309DA) , the debugger will face an address that is out of memory range (inexistant) 4206601*4+5ED248 in my case.
;And it will simply CRASH.