Home

Happy New Year 2020!

We resume our seasonal greetings in a memory dump analysis style. The new year number resembles Regular Data analysis pattern seen in corrupt structures, heap, and pool entries. In our greeting case, this means that 2020 is everywhere. To model this abnormal or anomaly condition, we created a simple C++ program that overwrites a structure which has a function pointer with a new year value in a hexadecimal format:

#include <vector>
#include <string>

using Execute = int (*)();

int ExecutePlans()
{
	return 0;
}

struct Plans 
{
	std::vector<std::wstring> readingList;
	Execute func{ ExecutePlans };
	wchar_t notes[256];
} newYearPlans{};

int wmain()
{
	short y2020{ 0x2020 };

	for (int i{ 0 }; i < sizeof(newYearPlans) / sizeof(y2020);
	   ++i)
	{
		*(reinterpret_cast<decltype(&y2020)>
		    (&newYearPlans) + i) = y2020;
	}

	return newYearPlans.func();
}

When we launch the application, it crashes:

Since we enabled LocalDumps, we got a crash dump which we open in WinDbg:

Microsoft (R) Windows Debugger Version 10.0.18362.1 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\MemoryDumps\2020.exe.9512.dmp]
User Mini Dump File with Full Memory: 
Only application data is available

Symbol search path is: srv*
Executable search path is: 
Windows 10 Version 18362 MP (8 procs) Free x64
Product: WinNt, suite: SingleUserTS
18362.1.amd64fre.19h1_release.190318-1202
Machine Name:
Debug session time: Sun Dec 29 22:54:00.000 2019 (UTC + 4:00)
System Uptime: 0 days 22:33:17.949
Process Uptime: 0 days 0:00:05.000
....
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(2528.2024): Access violation - code c0000005 
(first/second chance not available)
For analysis of this file, run !analyze -v
ntdll!NtWaitForMultipleObjects+0x14:
00007fff`be27cc14 c3              ret

When looking at Stored Exception we see Invalid Pointer code pointer having Regular Data values:

0:000> dx newYearPlans
newYearPlans                 [Type: Plans]
    [+0x000] readingList      : { size=0 } 
        [Type: std::vector...]
    [+0x018] func             : 0x2020202020202020 
        [Type: int (__cdecl*)()]
    [+0x020] notes            :
"†††††††††††††††††††††††††††††††††††††††††
†††††††††††††††††††††††††††††††††††††††††††
†††††††††††††††††††††††††††††††††††††††††††
†††††††††††††††††††††††††††††††††††††††††††
†††††††††††††††††††††††††††††††††††††††††††
†††††††††††††††††††††††††††††††††††††††††††???" [Type: wchar_t [256]]

0:000> du newYearPlans
00007ff7`88355a10  "††††††††††††††††††††††††††††††††"
00007ff7`88355a50  "††††††††††††††††††††††††††††††††"
00007ff7`88355a90  "††††††††††††††††††††††††††††††††"
00007ff7`88355ad0  "††††††††††††††††††††††††††††††††"
00007ff7`88355b10  "††††††††††††††††††††††††††††††††"
00007ff7`88355b50  "††††††††††††††††††††††††††††††††"
00007ff7`88355b90  "††††††††††††††††††††††††††††††††"
00007ff7`88355bd0  "††††††††††††††††††††††††††††††††"
00007ff7`88355c10  "††††††††††††††††."

0:000> da newYearPlans
00007ff7`88355a10  "                                "
00007ff7`88355a30  "                                "
00007ff7`88355a50  "                                "
00007ff7`88355a70  "                                "
00007ff7`88355a90  "                                "
00007ff7`88355ab0  "                                "
00007ff7`88355ad0  "                                "
00007ff7`88355af0  "                                "
00007ff7`88355b10  "                                "
00007ff7`88355b30  "                                "
00007ff7`88355b50  "                                "
00007ff7`88355b70  "                                "

0:000> dw newYearPlans
00007ff7`88355a10  2020 2020 2020 2020 2020 2020 2020 2020
00007ff7`88355a20  2020 2020 2020 2020 2020 2020 2020 2020
00007ff7`88355a30  2020 2020 2020 2020 2020 2020 2020 2020
00007ff7`88355a40  2020 2020 2020 2020 2020 2020 2020 2020
00007ff7`88355a50  2020 2020 2020 2020 2020 2020 2020 2020
00007ff7`88355a60  2020 2020 2020 2020 2020 2020 2020 2020
00007ff7`88355a70  2020 2020 2020 2020 2020 2020 2020 2020
00007ff7`88355a80  2020 2020 2020 2020 2020 2020 2020 2020

What caught our attention during exploratory dump analysis (EDA) is UNICODE interpretation of the new year value cast in a hexadecimal format. This doesn’t look good for software behavior. We hope this just means RIP 2019. As a New Year gift, we include a collection of memory analysis patterns from the Encyclopedia of Crash Dump Analysis Patterns that mention Regular Data.