A Closer Look at Ichitaro - TrendLabs | Malware Blog - by Trend Micro

一太郎の脆弱性を使ったウイルスに関する解析手法のデモです。

全く持ってわからない・・・このあたり勉強するか・・・それとも・・・

The exploit is a stack-based buffer overflow on Ichitaro (.jtd file) application. The vulnerable code can be found on JSTBLLY2.DLL. The exploit was achieved by calling certain wrapper function (found at 0×3B61BE20) for MSVCRT.memmove API. Validation was not done on this function. Calling it for 0×1B08h times causes a buffer to overflow, overwriting a return value in the stack, thereby gaining control of the execution.

---