Blast's Security Lab
14 Nov 2009
要是传入参数没检查就直接写入估计有点小危险
#COMPILE EXE
#DIM ALL
FUNCTION PBMAIN () AS LONG
LOCAL vHndl AS DWORD , mHndl AS ASCIIZ PTR
LOCAL lRes AS LONG, tHndl AS ASCIIZ PTR
GLOBALMEM ALLOC 1 TO vHndl
IF vHndl THEN
GLOBALMEM LOCK vHndl TO mHndl
' @mHndl=STRING$(5555,"a")
@mHndl="ABCDEF"
tHndl=mHndl+1
MSGBOX @mHndl
MSGBOX @tHndl
GLOBALMEM UNLOCK vHndl TO lRes
GLOBALMEM FREE vHndl TO lRes
END IF
END FUNCTION
◎欢迎参与讨论,请在这里发表您的看法、交流您的观点。