Software Diagnostics Institute

2010 (7DA) is The Year of Dump Analysis!

Try to find 2010 in the corrupt code after committing the greeting to memory:

0:000> u eip
ntdll!KiFastSystemCallRet:
7c90e514 c3 ret
7c90e515 8da42400000000 lea esp,[esp]
7c90e51c 8d642400 lea esp,[esp]
ntdll!KiIntSystemCall:
7c90e520 8d542408 lea edx,[esp+8]
7c90e524 cd2e int 2Eh
7c90e526 c3 ret
7c90e527 90 nop
ntdll!RtlRaiseException:
7c90e528 55 push ebp
0:000> u
ntdll!RtlRaiseException+0x1:
7c90e529 8bec mov ebp,esp
7c90e52b 9c pushfd
7c90e52c 81ecd0020000 sub esp,2D0h
7c90e532 8985dcfdffff mov dword ptr [ebp-224h],eax
7c90e538 898dd8fdffff mov dword ptr [ebp-228h],ecx
7c90e53e 8b4508 mov eax,dword ptr [ebp+8]
7c90e541 8b4d04 mov ecx,dword ptr [ebp+4]
7c90e544 89480c mov dword ptr [eax+0Ch],ecx
0:000> u
ntdll!RtlRaiseException+0x1f:
7c90e547 8d852cfdffff lea eax,[ebp-2D4h]
7c90e54d 8988b8000000 mov dword ptr [eax+0B8h],ecx
7c90e553 8998a4000000 mov dword ptr [eax+0A4h],ebx
7c90e559 8990a8000000 mov dword ptr [eax+0A8h],edx
7c90e55f 89b0a0000000 mov dword ptr [eax+0A0h],esi
7c90e565 89b89c000000 mov dword ptr [eax+9Ch],edi
7c90e56b 8d4d0c lea ecx,[ebp+0Ch]
7c90e56e 8988c4000000 mov dword ptr [eax+0C4h],ecx
0:000> u
ntdll!RtlRaiseException+0x4c:
7c90e574 8b4d00 mov ecx,dword ptr [ebp]
7c90e577 8988b4000000 mov dword ptr [eax+0B4h],ecx
7c90e57d 8b4dfc mov ecx,dword ptr [ebp-4]
7c90e580 48 dec eax
7c90e581 61 popad
7c90e582 7070 jo ntdll!_CIcos+0xe (7c90e5f4)
7c90e584 7920 jns ntdll!RtlRaiseException+0x7e (7c90e5a6)
7c90e586 4d dec ebp
0:000> u
ntdll!RtlRaiseException+0x5f:
7c90e587 656d ins dword ptr es:[edi],dx
7c90e589 6f outs dx,dword ptr [esi]
7c90e58a 7269 jb ntdll!_CIcos+0xf (7c90e5f5)
7c90e58c 657320 jae ntdll!RtlRaiseException+0x87 (7c90e5af)
7c90e58f 696e202020da07 imul ebp,dword ptr [esi+20h],7DA2020h
7c90e596 0000 add byte ptr [eax],al
7c90e598 2121 and dword ptr [ecx],esp
7c90e59a 2121 and dword ptr [ecx],esp
0:000> u
ntdll!RtlRaiseException+0x74:
7c90e59c 0000 add byte ptr [eax],al
7c90e59e 8ca88c000000 mov word ptr [eax+8Ch],gs
7c90e5a4 8c90c8000000 mov word ptr [eax+0C8h],ss
7c90e5aa c70007000100 mov dword ptr [eax],10007h
7c90e5b0 6a01 push 1
7c90e5b2 50 push eax
7c90e5b3 ff7508 push dword ptr [ebp+8]
7c90e5b6 e8f3f3ffff call ntdll!NtRaiseException (7c90d9ae)