软件下载：https://www.exploit-db.com/apps/a1def037869c831496bda3d81b0d06f5-soritong10.exe

加载POC

程序崩溃点：

SoriTong!MmutilityC8_4+0xc53:

0040c55f 8802            mov     byte ptr [edx],al          ds:0023:00130000=41\

该段代码伪代码：

int __cdecl sub_40C444(int a4, LPCSTR lpFileName)

{

  const CHAR *v5; // ecx@2

  int v6; // eax@4

  int v7; // esi@4

  int result; // eax@5

  __int32 v9; // eax@6

  HGLOBAL v10; // ebx@6

  __int32 v11; // eax@6

  CHAR *v12; // edx@10

  CHAR v13; // al@12

  int v14; // ecx@12

  LPCSTR *v15; // eax@20

  char v16; // [sp+0h] [bp-238h]@0

  CHAR Buffer; // [sp+8h] [bp-230h]@20

  CHAR FileName; // [sp+108h] [bp-130h]@7

  LPSTR FilePart; // [sp+208h] [bp-30h]@20

  __int16 v20; // [sp+21Ch] [bp-1Ch]@1

  int v21; // [sp+228h] [bp-10h]@1

  char v22; // [sp+230h] [bp-8h]@20

  int v23; // [sp+234h] [bp-4h]@1

  __InitExceptBlockLDTC();

  System::AnsiString::AnsiString((System::AnsiString *)&lpFileName, (const System::AnsiString *)&lpFileName);

  v20 = 20;

  v23 = 0;

  Sysutils::ExtractFilePath(lpFileName, &v23);

  sub_486A54(v23);

  v21 = 2;

  System::AnsiString::~AnsiString((System::AnsiString *)&v23);

  if ( lpFileName )

    v5 = lpFileName;

  else

    v5 = (const CHAR *)&unk_4A1684;

  v6 = j____open(v5, 0, v16);

  v7 = v6;

  v20 = 8;

  if ( v6 >= 0 )

  {

    v9 = filelength(v6);

    v10 = GlobalAlloc(0x40u, v9 + 16);

    v11 = filelength(v7);

    j____read(v7, v10, v11);

    j____close(v7);

    lstrcatA((LPSTR)v10, asc_4A1685);

    while ( *(_BYTE *)v10 )

    {

      memset(&FileName, 0, 0x100u);

      v20 = 8;

      while ( *(_BYTE *)v10 == 32 )

        v10 = (char *)v10 + 1;

      v12 = &FileName;

      while ( 1 )

      {

        v13 = *(_BYTE *)v10;

        v14 = *(_BYTE *)v10;

        if ( v14 == 13 || v14 == 10 || !v13 )

          break;

        *v12++ = v13;

        v10 = (char *)v10 + 1;

      }

      while ( *(_BYTE *)v10 == 13 || *(_BYTE *)v10 == 10 && *(_BYTE *)v10 )

        v10 = (char *)v10 + 1;

      GetFullPathNameA(&FileName, 0x100u, &Buffer, &FilePart);

      v20 = 32;

      v15 = (LPCSTR *)sub_49ACA0(&v22, &Buffer);

      ++v21;

      sub_40BA7C(a4, *v15);

      --v21;

      System::AnsiString::~AnsiString((System::AnsiString *)&v22);

      v20 = 0;

    }

    GlobalFree(v10);

    --v21;

    result = System::AnsiString::~AnsiString((System::AnsiString *)&lpFileName);

  }

  else

  {

    --v21;

    result = System::AnsiString::~AnsiString((System::AnsiString *)&lpFileName);

  }

  return result;

}

 

怀疑lstrcatA函数出错

对0040C523下断点，应该问题就出在这个函数，未检查缓冲区长度