On Thu, 15 Jul 2004, Paul Szabo wrote: > Being curious, on Win2k, I copied cmd.exe (from winnt\system32) as xyz.pif; > then (right-click) Properties, Program crashes explorer. Is this related to > IconHandler, and is it exploitable? Right -- in Win2K SP4 clicking on [Program] tab of Properties window causes "access violation" -- the memory at 0x00000000 could not be "read" by SHELL32.DLL. MSVC++, acting as a debugger, shows a mixture of KERNEL32, COMCTL32, USER32, SHELL32 and SHLWAPI in stack trace. Disassembly window shows that there was an attempt to read dword at [EAX] (EAX=0). So at first glance this doesn't seem to be trivially exploitable, but I'm not a win32 expert, and intuition suggests that there must be a way. _________________________________________ Dmitry Yu. Bolkhovityanov The Budker Institute of Nuclear Physics Novosibirsk, Russia
