####################################################################### Luigi Auriemma Application: Microsoft Reader http://www.microsoft.com/reader Versions: <= 2.1.1.3143 (PC version) <= 2.6.1.7169 (Origami version) the non-PC versions have not been tested Platforms: Windows, Windows Mobile, Tablet PC and UMPC devices Bug: heap overflow Date: 11 Apr 2011 Author: Luigi Auriemma e-mail: aluigi@autistici.org web: aluigi.org ####################################################################### 1) Introduction 2) Bug 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== Microsoft Reader is a software needed to read and catalog the ebooks in LIT format and the Audible audio books bought via internet, indeed the homepage acts also as online store for these protected contents. ####################################################################### ====== 2) Bug ====== Heap overflow caused by the allocation of a certain amount of memory and the copying of arbitrary data during the decompression of the sections. A quick trace of the sum operations performed with the entry size/offset values and then the function that performs the copying: 0107F517 |> 8B85 E0FDFFFF MOV EAX,DWORD PTR SS:[EBP-220] ; second 64bit number (entry->size) 0107F51D |. 0B85 E4FDFFFF OR EAX,DWORD PTR SS:[EBP-21C] 0107F523 |. 74 12 JE SHORT msreader.0107F537 0107F525 |. 8B46 60 MOV EAX,DWORD PTR DS:[ESI+60] ; 64bit total size 0107F528 |. 8B4E 64 MOV ECX,DWORD PTR DS:[ESI+64] 0107F52B |. 0185 D8FDFFFF ADD DWORD PTR SS:[EBP-228],EAX ; added to the first 64bit number (entry->offset) 0107F531 |. 118D DCFDFFFF ADC DWORD PTR SS:[EBP-224],ECX 0107F537 |> FF75 18 PUSH DWORD PTR SS:[EBP+18] 0107F53A |. 8D85 D8FDFFFF LEA EAX,DWORD PTR SS:[EBP-228] 0107F540 |. FF75 14 PUSH DWORD PTR SS:[EBP+14] 0107F543 |. 50 PUSH EAX 0107F544 |. FF76 74 PUSH DWORD PTR DS:[ESI+74] 0107F547 |. 56 PUSH ESI 0107F548 |. FF75 0C PUSH DWORD PTR SS:[EBP+C] 0107F54B |. E8 DEBEFEFF CALL msreader.0106B42E ... 0106B596 |. 8B71 48 MOV ESI,DWORD PTR DS:[ECX+48] ; second 64bit number (entry->size) 0106B599 |. 897D F0 MOV DWORD PTR SS:[EBP-10],EDI 0106B59C |. 13C2 ADC EAX,EDX 0106B59E |. 03F3 ADD ESI,EBX ; added to the 64bit total size 0106B5A0 |. 8975 0C MOV DWORD PTR SS:[EBP+C],ESI 0106B5A3 |. 8B71 4C MOV ESI,DWORD PTR DS:[ECX+4C] 0106B5A6 |. 1371 44 ADC ESI,DWORD PTR DS:[ECX+44] 0106B5A9 |. 5B POP EBX 0106B5AA |. 3BD6 CMP EDX,ESI 0106B5AC |. 72 1C JB SHORT msreader.0106B5CA 0106B5AE |. 77 08 JA SHORT msreader.0106B5B8 ... 01092A02 /. 55 PUSH EBP ; copying function ...skip... examples specific for the PoC msreader_2a.lit LocalAlloc 000a6f68 = 01610020 ReadFile 000a6f68 (file offset 0x22f5d) LocalAlloc 000a6f68 = 016c0020 DES decryption of the data read by the file with output in the second allocated buffer memcpy esi is 016c0020 memcpy edi is 0022a008 ...skip... 01092B50 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] 01092B53 |. 8B55 F4 MOV EDX,DWORD PTR SS:[EBP-C] 01092B56 |. 8B7D 14 MOV EDI,DWORD PTR SS:[EBP+14] 01092B59 |. 8BCB MOV ECX,EBX 01092B5B |. 8D3410 LEA ESI,DWORD PTR DS:[EAX+EDX] 01092B5E |. 8BD1 MOV EDX,ECX 01092B60 |. C1E9 02 SHR ECX,2 01092B63 |. F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS> The data copied in the heap buffer is exactly the one coming from the file and decrypted with DES, that's why the bytes visible during the copying can't be seen in the file. I have provided two proof-of-concepts where the first shows the exact location of the memcpy while the second will cause an exception during the "call [ret+num]" instruction (could take some seconds to be reached). Modified bytes for msreader_2a.lit: 000005F6 84 40 ; from 0x230 to 0x40 000005F7 30 5F ; modified only to keep the size of the subsequent entry string Modified bytes for msreader_2b.lit: 000005F7 30 00 ; from 0x230 to 0x200 ####################################################################### =========== 3) The Code =========== http://aluigi.org/poc/msreader_2.zip ####################################################################### ====== 4) Fix ====== No fix. #######################################################################