full-disclosure - re: eeye temporary patch for current IEvulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Tue Mar 28 20:25:21 2006
From: list.srv at gmail.com (list srv)
Subject: re: eeye temporary patch for current
	IEvulnerability

> >And you convinced yourself that the patch and the source matched,
> >how,
> >exactly? :)
>

XP sp1

orig
6B703AA9      66:C785 74FFF>MOV WORD PTR SS:[EBP-8C],0
6B703AB2   .  6A 00         PUSH 0
6B703AB4   .  8B4B 48       MOV ECX,DWORD PTR DS:[EBX+48]

patched
6B703AA9     /E9 76EA0600   JMP jscript.6B772524
6B703AAE   ? |FFFF          ???                                      ;
 Unknown command
6B703AB0   ? |0000          ADD BYTE PTR DS:[EAX],AL
6B703AB2   .  6A 00         PUSH 0
6B703AB4   .  8B4B 48       MOV ECX,DWORD PTR DS:[EBX+48]

orig
lots of NULLs, unused space

patched
6B772524      60            PUSHAD
6B772525      8DBC25 74FFFF>LEA EDI,DWORD PTR SS:[EBP-8C]
6B77252C      33C0          XOR EAX,EAX
6B77252E      AB            STOS DWORD PTR ES:[EDI]
6B77252F      AB            STOS DWORD PTR ES:[EDI]
6B772530      61            POPAD
6B772531    ^ E9 7A15F9FF   JMP jscript.6B703AB2