病毒分类 普通文件病毒

溢出发生在user32.dll!_LoadAniIcon

_LoadCursorIconFromFileMap -> _LoadAniIcon@20

typedef struct TagHeader

{

DWORD Tag; // LIST , anih , etc.

DWORD OverlaySize;

}ST_TagHeader;

typedef struct MappingFile

{

PBYTE ViewBase;

DWORD CurPointer;

}ST_MappingFile;

; __stdcall LoadCursorIconFromFileMap(x, x, x, x, x, x)

_LoadCursorIconFromFileMap@24 :

...

.text:77D5429F cmp dword ptr [ebp-10h], 'hina'

.text:77D542A6 jnz short loc_77D54309

.text:77D542A8 cmp dword ptr [ebp-0Ch], 24h ;ST_TagHeader结构中的OverlaySize被检查了

;所以第一个anih结构的OverlaySize必须是0x24

.text:77D542AC jnz loc_77D543C5

...

...

...

.text:77D542FF call _LoadAniIcon@20 ; anih

.text:77D54304 jmp loc_77D543E6

...

...

; int __stdcall LoadAniIcon(int,int,int,int,int)

.text:77D53F83 _LoadAniIcon@20

...

...

...

.text:77D54008 cmp eax, 'hina'

.text:77D5400D jnz tag_unknown

.text:77D54013 lea eax, [ebp-4Ch] ;

.text:77D54016 push eax ; pOutBuffer,LocalBuffer,ebp-4ch

.text:77D54017 lea eax, [ebp-28h]

.text:77D5401A push eax ; ST_TagHeader*

.text:77D5401B push ebx ; ST_MappingFile*

.text:77D5401C call _ReadChunk@12 ; ST_TagHeader结构中的OverlaySize没有被检查

; 如果OverlaySize>0x50的话，RET就会被覆盖

.text:77D54021 test eax, eax

...

...

...