Add notepad-report.txt
This commit is contained in:
@@ -0,0 +1,116 @@
|
|||||||
|
|
||||||
|
== C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2605.29.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe ==
|
||||||
|
machine : x86-64
|
||||||
|
size : 3,298,112 bytes
|
||||||
|
image base : 0x140000000
|
||||||
|
entry point : 0x1401636e0
|
||||||
|
sections : 6
|
||||||
|
.text @ 0x140001000 vsize=2,080,327
|
||||||
|
.rdata @ 0x1401fd000 vsize=742,354
|
||||||
|
.data @ 0x1402b3000 vsize=289,281
|
||||||
|
.pdata @ 0x1402fa000 vsize=94,296
|
||||||
|
.rsrc @ 0x140312000 vsize=72,704
|
||||||
|
.reloc @ 0x140324000 vsize=14,884
|
||||||
|
|
||||||
|
imports : 666
|
||||||
|
strings : 38776
|
||||||
|
functions : 8701
|
||||||
|
of which named/exported: 0
|
||||||
|
decoded cleanly : 8701
|
||||||
|
by source : pdata=7858, prologue=460, recursive=383
|
||||||
|
discovery : recursive=383, prologue=460, seed-recall=100.0%
|
||||||
|
|
||||||
|
-- first 20 meaningful strings (5,433 of 38,776 total) --
|
||||||
|
[ ascii] 0x140203140 .rdata '433333333333333'
|
||||||
|
[ ascii] 0x140204bd5 .rdata '31:viN<'
|
||||||
|
[ ascii] 0x14020c695 .rdata 'V?AgPhU'
|
||||||
|
[ ascii] 0x14020edf7 .rdata 'R5qhi5'
|
||||||
|
[ ascii] 0x140212fda .rdata '~yjS6/1'
|
||||||
|
[ ascii] 0x1402134a0 .rdata '~yjS6/1'
|
||||||
|
[ ascii] 0x140213996 .rdata '~yjS6/1'
|
||||||
|
[ ascii] 0x140213e8c .rdata '~yjS6/1'
|
||||||
|
[ ascii] 0x1402143b2 .rdata '~yjS6/1'
|
||||||
|
[ ascii] 0x1402148f0 .rdata '~yjS6/1'
|
||||||
|
[ ascii] 0x14021531e .rdata 'BXwxZH+'
|
||||||
|
[ ascii] 0x1402158d3 .rdata 'dSp^z0hS 6'
|
||||||
|
[ ascii] 0x140215e89 .rdata 'dSp^z0h'
|
||||||
|
[ ascii] 0x14021646f .rdata 'dSp^z0h'
|
||||||
|
[ ascii] 0x140216a6d .rdata 'dSp^z0h'
|
||||||
|
[ ascii] 0x140217083 .rdata 'dSp^z0h'
|
||||||
|
[ ascii] 0x1402176b1 .rdata 'dSp^z0h'
|
||||||
|
[ ascii] 0x14021aaa9 .rdata '|1T8xBO'
|
||||||
|
[ ascii] 0x14021b1df .rdata '|1T8xBO'
|
||||||
|
[ ascii] 0x14021b945 .rdata '|1T8xBO'
|
||||||
|
|
||||||
|
-- first 20 functions --
|
||||||
|
0x140001000 305b 68 insn [pdata] (unnamed)
|
||||||
|
0x140001140 982b 195 insn [pdata] (unnamed)
|
||||||
|
0x140001520 361b 79 insn [pdata] (unnamed)
|
||||||
|
0x140001690 321b 72 insn [pdata] (unnamed)
|
||||||
|
0x1400017e0 321b 71 insn [pdata] (unnamed)
|
||||||
|
0x140001930 341b 76 insn [pdata] (unnamed)
|
||||||
|
0x140001a90 595b 123 insn [pdata] (unnamed)
|
||||||
|
0x140001cf0 659b 138 insn [pdata] (unnamed)
|
||||||
|
0x140001f90 451b 99 insn [pdata] (unnamed)
|
||||||
|
0x140002160 532b 115 insn [pdata] (unnamed)
|
||||||
|
0x140002380 822b 175 insn [pdata] (unnamed)
|
||||||
|
0x1400026c0 611b 126 insn [pdata] (unnamed)
|
||||||
|
0x140002930 595b 124 insn [pdata] (unnamed)
|
||||||
|
0x140002b90 563b 114 insn [pdata] (unnamed)
|
||||||
|
0x140002dd0 547b 111 insn [pdata] (unnamed)
|
||||||
|
0x140003000 431b 96 insn [pdata] (unnamed)
|
||||||
|
0x1400031b0 547b 118 insn [pdata] (unnamed)
|
||||||
|
0x1400033e0 565b 120 insn [pdata] (unnamed)
|
||||||
|
0x140003620 579b 131 insn [pdata] (unnamed)
|
||||||
|
0x140003870 451b 99 insn [pdata] (unnamed)
|
||||||
|
|
||||||
|
-- control-flow / call graph --
|
||||||
|
functions analyzed : 8,701
|
||||||
|
basic blocks : 139,268
|
||||||
|
cfg edges : 164,513
|
||||||
|
direct call edges : 23,023
|
||||||
|
indirect callsites : 11,969
|
||||||
|
|
||||||
|
-- top 20 imported callees (by indirect call count) --
|
||||||
|
1084x api-ms-win-crt-runtime-l1-1-0.dll!abort
|
||||||
|
376x USER32.dll!SendMessageW
|
||||||
|
242x MSVCP140.dll!?_Xout_of_range@std@@YAXPEBD@Z
|
||||||
|
228x MSVCP140.dll!?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
|
||||||
|
218x api-ms-win-crt-runtime-l1-1-0.dll!_invoke_watson
|
||||||
|
204x KERNEL32.dll!CloseHandle
|
||||||
|
191x MSVCP140.dll!?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
|
||||||
|
154x MSVCP140.dll!?_Throw_Cpp_error@std@@YAXH@Z
|
||||||
|
146x KERNEL32.dll!GetLastError
|
||||||
|
101x KERNEL32.dll!MulDiv
|
||||||
|
100x MSVCP140.dll!_Thrd_yield
|
||||||
|
100x USER32.dll!GetDpiForWindow
|
||||||
|
82x MSVCP140.dll!??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
|
||||||
|
76x MSVCP140.dll!_Mtx_unlock
|
||||||
|
70x MSVCP140.dll!_Mtx_lock
|
||||||
|
70x KERNEL32.dll!SetLastError
|
||||||
|
67x api-ms-win-crt-runtime-l1-1-0.dll!_errno
|
||||||
|
64x MSVCP140_ATOMIC_WAIT.dll!__std_atomic_notify_all_direct
|
||||||
|
64x MSVCP140.dll!??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
|
||||||
|
63x MSVCP140.dll!?_Xlength_error@std@@YAXPEBD@Z
|
||||||
|
|
||||||
|
== assumption findings ==
|
||||||
|
entries scanned : 2,623
|
||||||
|
sink observations : 1,336
|
||||||
|
unique findings : 4 (182.2s)
|
||||||
|
unguarded : 4
|
||||||
|
attacker-reachable : 4 (surface: 392 entries)
|
||||||
|
input-flow CONFIRM : 0 (attacker input provably reaches the sink arg)
|
||||||
|
|
||||||
|
-- top 20 findings (most-dangerous control first, then confirmed) --
|
||||||
|
[ -] wcscpy_s(src) @ 0x140132460 deref=2 control=unguarded reachable(no-flow)
|
||||||
|
local src=- *((((loc:rsp - 0x1a0) + 0x50) + 0x78)).[0x10]
|
||||||
|
in 0x140132290, 3 hops from: 0x1401a83e0, 0x1401a8b10
|
||||||
|
[ -] wcscpy_s(dest) @ 0x140132460 deref=0 control=unguarded reachable(no-flow)
|
||||||
|
local src=- ((loc:rsp + -0x37) + -0x1d)
|
||||||
|
in 0x140132290, 3 hops from: 0x1401a83e0, 0x1401a8b10
|
||||||
|
[ -] wcscpy_s(dest) @ 0x140150842 deref=0 control=unguarded reachable(no-flow)
|
||||||
|
local src=- ((loc:rsp + -0xc0) + 0x1c)
|
||||||
|
in 0x1401506a0, 4 hops from: 0x1400a87f0, 0x1401a6fc0
|
||||||
|
[ -] wcscpy_s(src) @ 0x140150842 deref=0 control=unguarded reachable(no-flow)
|
||||||
|
unknown src=- ?
|
||||||
|
in 0x1401506a0, 4 hops from: 0x1400a87f0, 0x1401a6fc0
|
||||||
Reference in New Issue
Block a user