I’ll remove the Moir\u00e9 pattern for you from this and all the other screen shots. I’ll also do the organic OCR\u00b9 and convert it to text. Because I’m a nice guy that wants his writing to be readable. (Unlike the finder, apparently.)<\/p>\n
\n
pcshell\\shell\\explorer\\something.cpp(80)\\explorer.exe!00007FF813D017E2: (caller: 00007FF813CB690C) ReturnHr(7) tid(b2c) 80070002 The system cannot find the file specified\r\npcshell\\shell\\explorer\\something.cpp(80)\\explorer.exe!00007FF813D017E2: (caller: 00007FF813CB690C) ReturnHr(8) tid(b2c) 80070002 The system cannot find the file specified\r\npcshell\\shell\\explorer\\something.cpp(80)\\explorer.exe!00007FF813D017E2: (caller: 00007FF813CB690C) ReturnHr(9) tid(b2c) 80070002 The system cannot find the file specified\r\n<\/pre>\n<\/div>\nOkay, this is some debug spew that’s logging a File not found<\/i> error.<\/p>\n
The finder, however, didn’t characterize it as debug spew, but rather described it as “an exception”. Their next step was to set a breakpoint on the reported address 00007FF813D017E2<\/code> and repeat the scenario, and then when the breakpoint hits, take a stack trace.<\/p>\n0:002> k\r\n # Child-SP\r\n00 0000009c`aa2ffae0 00007ff8`13cb690c explorer!<lambda_bab32d760b0e6e31>::operator()+0x704c2\r\n01 0000009c`aa2ffb90 00007ff8`13cb5eed explorer!Windows::Internal::ComTaskPool::CThread::_ThreadProc+0x228\r\n02 0000009c`aa2ffc80 00007ff8`13cb5e39 explorer!Windows::Internal::ComTaskPool::CThread::s_ExecuteThreadPr\r\n03 0000009c`aa2ffcd0 00007ff8`91adc774 explorer!Windows::Internal::ComTaskPool::CThread::s_ThreadProc+0x9\r\n04 0000009c`aa2ffd00 00007ff8`91defd51 kernel32!BaseThreadInitThunk+0x14\r\n05 0000009c`aa2ffd30 00000000`00000000 ntdll!RtlUserThreadStart+0x21\r\n<\/pre>\nA little disassembling around the first return address reveals<\/p>\n
00007ff8`13cb6906 ff1557351100 call qword ptr [explorer!_guard_dispatch_icall_ptr (00007ff8`3cbfe08)]\r\n00007ff8`13cb690c 488b4b50 mov rcx, qword ptr [rbx+50h]\r\n<\/pre>\nThe finder explained that “the function is _guard_<\/code>dispatch_<\/code>icall_<\/code>fptr<\/code>, not the lambda_<\/code>bab32d...<\/code>. Decompiling the code at _guard_<\/code>dispatch_<\/code>icall_<\/code>fptr<\/code>, you’ll see the buffer overflow.” Here’s the code in question:<\/p>\n0:002> u 00007ff8`13cbfe08\r\nexplorer!_guard_dispatch_icall_fptr:\r\n00007ff8`13cbfe08 206388 and byte ptr [rbx-78h],ah\r\n00007ff8`13cb6e0b 9a ???<\/span> \u21d0\r\n<\/pre>\nIn the screen shot, they highlighted the second line. And that was the end of their report.<\/p>\n
It seems that the finder saw a debug message, and then started fumbling around. They saw that the disassembler printed ???<\/code> which they interpreted as a clear sign of a security vulnerability.<\/p>\nBut that’s not what they found.<\/p>\n
First of all, the messages that appear on the debugger are some error logging trace messages. They aren’t exceptions.<\/p>\n
Next, the instruction prior to the return address is an indirect call, but they somehow thought this was a label, because they said that the function was misreported by the debugger as lambda_<\/code>bab32d...<\/code> when it was actually _guard_<\/code>dispatch_<\/code>icall_<\/code>fptr<\/code>. Nope, the function really is lambda_<\/code>bab32d...<\/code>. What it’s doing is calling through<\/i> the function pointer _guard_<\/code>dispatch_<\/code>icall_<\/code>fptr<\/code>.<\/p>\nNext, the finder misread the disassembly. In Intel notation, square brackets around an effective address mean “the memory stored at this address”. The call qword ptr [_guard_<\/code>dispatch_<\/code>icall_<\/code>fptr]<\/code> doesn’t mean “call the function _guard_<\/code>dispatch_<\/code>icall_<\/code>fptr<\/code>.” It means “read eight bytes from _guard_<\/code>dispatch_<\/code>icall_<\/code>fptr<\/code>, treat those eight bytes as a 64-bit value, interpret that value as an address, and call to that address.” The bytes you see at _guard_<\/code>dispatch_<\/code>icall_<\/code>fptr<\/code> are not code; they are data. Disassembling them as code is meaningless.<\/p>\nSo +1 on the finder for resourcefulness and curiosity. But \u22121 for not really understanding what you are doing, \u22121 for not checking your work with a colleague before sending it in, and \u22121 for poor presentation.<\/p>\n
\u00b9 In other words, I used my eyeballs.<\/p>\n","protected":false},"excerpt":{"rendered":"
Not quite knowing how assembly language works, I guess.<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[26],"class_list":["post-100435","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-other"],"acf":[],"blog_post_summary":"
Not quite knowing how assembly language works, I guess.<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/100435","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=100435"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/100435\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=100435"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=100435"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=100435"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}