#1 - A BUG HUNTER'S DIARY

It's a little difficult for me to do the experiment but I made it finally. Thanks to the author for I could download all resources I need according to the annotations. Let me tell what happened this morning.



Get VLC code (vlc-0.9.4.tar.bz2.tar.bz2.tar.bz2)
To verify author's finding, I check the key place of our buffer overflow attacks.

1. static void parse_master(demux_t *p_demux)
2. {
3.     demux_sys_t *p_sys = p_demux->p_sys;
4.     uint8_t mst_buf[32];
5.     int i, i_map_size;
6.     int64_t i_save_pos = stream_Tell(p_demux->s);
7.     int64_t i_pts_secs;
8. 
   
9.     /* Note that the entries in the SEQ table in the stream may have
10.        different sizes depending on the bits per entry.  We store them
11.        all in the same size structure, so we have to parse them out one
12.        by one.  If we had a dynamic structure, we could simply read the
13.        entire table directly from the stream into memory in place. */
14. 
    
15.     /* clear the SEQ table */
16.     free(p_sys->seq_table);
17.     
18.     /* parse header info */
19.     stream_Read(p_demux->s, mst_buf, 32);
20.     i_map_size = U32_AT(&mst_buf[20]);  /* size of bitmask, in bytes */
21.     p_sys->i_bits_per_seq_entry = i_map_size * 8;
22.     i = U32_AT(&mst_buf[28]);   /* size of SEQ table, in bytes */
23.     p_sys->i_seq_table_size = i / (8 + i_map_size);
24. 
    
25.     /* parse all the entries */
26.     p_sys->seq_table = malloc(p_sys->i_seq_table_size * sizeof(ty_seq_table_t));
27.     for (i=0; i<p_sys->i_seq_table_size; i++) {
28.         stream_Read(p_demux->s, mst_buf, 8 + i_map_size);

Download TiVo format video
According to the code, I use notepad++ to find out the place of value - 0xf5467abd

Certainly the next step is to edit the value in an offset 0x14 from 0xf5467abd and to make it larger than 0x18. (Here I did it by 0xff)

Play it and you will find exception offset 0x20030000.

Then I find where 0x23003000 (little-endian) is and make it an value I want (this is what we want to do), 0x81818181 for example. 

Finally, because it's concerned about laws, author didn't tell how to use bug. So I can't try or provide it here. Up to now, I have no idea how to make it and the next step is to learn something about "jmp reg".