Win32k! GreBatchTextOut overflow exp challenge

Win32k! GreBatchTextOut overflow exp challenge

Http://technet.microsoft.com/en-us/security/bulletin/ms13-101 cve-2013-3899

 

Kd> u win32k! GreBatchTextOut
Win32k! GreBatchTextOut:
Bf8aa8b4 6818010000 push 118 h
Bf8aa8b9 68703c9abf push offset win32k! 'String' + 0x4c (bf9a3c70)
Bf8aa8be e8adc6feff call win32k! _ SEH_prolog (bf896f70)
Bf8aa8c3 a1acaf9abf mov eax, dword ptr [win32k! _ Security_cookie (bf9aafac)]
Bf8aa8c8 8945e4 mov dword ptr [ebp-1Ch], eax
Bf8aa8cb 8b5d08 mov ebx, dword ptr [ebp + 8]
Bf8aa8ce 8b4d0c mov ecx, dword ptr [ebp + 0Ch]
Bf8aa8d1 33c0 xor eax, eax
Bf8aa8d3 898508 ffffff mov dword ptr [ebp-0F8h], eax
Bf8aa8d9 838d04ffffffff or dword ptr [ebp-0FCh], 0 ffffffffffh
Bf8aa8e0 8985 fcfeffff mov dword ptr [ebp-104h], eax
Bf8aa8e6 6683790203 cmp word ptr [ecx + 2], 3
Bf8aa8eb 0f85bcfdffff jne win32k! GreBatchTextOut + 0x11c (bf8aa6ad)

 

Kd> u bf8aa6ad
Bf8aa6ad 898500 ffffff mov dword ptr [ebp-100h], eax
Bf8aa6b3 8b5120 mov edx, dword ptr [ecx + 20 h]
Bf8aa6b6 89951 cffffff mov dword ptr [ebp-0E4h], edx
Bf8aa6bc 8b4138 mov eax, dword ptr [ecx + 38 h]
Bf8aa6bf 898510 ffffff mov dword ptr [ebp-0F0h], eax
Bf8aa6c5 8b713c mov esi, dword ptr [ecx + 3Ch]
Bf8aa6c8 8b4510 mov eax, dword ptr [ebp + 10 h]
Bf8aa6cb 83c0b0 add eax, 0FFFFFFB0h

/*

Integer Overflow

*/

 

Bf8aa6ce 8bf8 mov edi, eax
Bf8aa6d0 d1ef shr edi, 1
Bf8aa6d2 39bd10ffffff cmp dword ptr [ebp-0F0h], edi
Bf8aa6d8 0f8730030000 ja win32k! GreBatchTextOut + 0x420 (bf8aaa0e)
Bf8aa6de 85f6 test esi, esi
Bf8aa6e0 0f85e8020000 jne win32k! GreBatchTextOut + 0x151 (bf8aa9ce)
Bf8aa6e6 8b03 mov eax, dword ptr [ebx]
Bf8aa6e8 8b702c mov esi, dword ptr [eax + 2Ch]
Kd> u
Win32k! GreBatchTextOut + 0x197:
Bf8aa6eb 8b7e18 mov edi, dword ptr [esi + 18 h]
Bf8aa6ee 89bdf4feffff movdword ptr [ebp-10Ch], edi
Bf8aa6f4 8b561c mov edx, dword ptr [esi + 1Ch]
Bf8aa6f7 8995f0feffff mov dword ptr [ebp-110h], edx
Bf8aa6fd 8b7104 mov esi, dword ptr [ecx + 4]
Bf8aa700 3bfe cmp edi, esi
Bf8aa702 0f8582feffff jne win32k! GreBatchTextOut + 0x1b0 (bf8aa58a)
Bf8aa708 8b03 mov eax, dword ptr [ebx]