Debug Fundamentals Exercise 4: The GAMEOVER exercise
We are back with another addition to the debugging fundamentals series here in 2009! Regardless of your debugging experience we hope you enjoy this one. Don’t worry too much if you can’t answer them all but give them your best shot.
The problem:
While debugging an application, a developer observes a crash and is puzzled. The developer saves a memory dump of the process using the command “.dump /ma dbgex4.dmp” and sends it to you for debug assistance.
0:000> r
eax=53454750 ebx=00000000 ecx=00000100 edx=000001b0 esi=001bfe20 edi=00ac36bc
eip=47414d45 esp=001bfe00 ebp=4f564552 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246
47414d45 ?? ???
The attached zip, dbgex4.zip, includes three files. The program itself, the program’s symbols file and the saved memory dump file. (NOTE: You do not need to execute the program for the exercise however you may want to in order to solve the bonus’. You will need to rename the file dbgex4.ex_ to dbgex4.exe in order to run it).
Using the accompanying files, answer the following questions:
Part One – Debugging
1. What caused the access violation?
2. Examine the registers at the time of the crash. Is there anything interesting about the contents?
3. How did the registers get into this state?
4. Find the offending data structure which caused this state to occur. What are its contents?
5. Are there security concerns with this access violation? Why?
6. Why is this class of crashes not seen in the wild much anymore?
Part Two – Reverse Engineering
Examine the functions main(), snap(), crack(), pop(), and boom().
1. Describe with a sentence or two what each one is doing. (There is no need to comment on every assembly instruction or re-write the code in C here unless you really feel you need to.)
Bonus:
1. If this access violation occurred while the program was running without a debugger present, would there be anything different about the crashing register state or the data structure which caused it? If so what is it and why? (HINT: If you would like to observe the crashing state like this, you can register windbg.exe to be the Just-In-Time debugger using the –I switch like so “windbg.exe -I”. When you run the dbgex4.exe program, it will crash and windbg.exe will launch automatically and attach to it.)
2. The functions from “Part Two – Reverse Engineering” perform operations on a set of data. During this manipulation some data is lost. Find this data and decode its “secret” message.
| Share this post : |  |
 |
 |
 |
 |