├── bin
    └── tainttracer.dll
├── .gitattributes
├── .gitignore
├── pin_taint_trace.py
├── src
    └── tainttracer.cpp
└── example-output
    └── vulnserver_trace_localhost.txt


/bin/tainttracer.dll:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/jrjr/taint-parade/HEAD/bin/tainttracer.dll


--------------------------------------------------------------------------------
/.gitattributes:
--------------------------------------------------------------------------------
 1 | # Auto detect text files and perform LF normalization
 2 | * text=auto
 3 | 
 4 | # Custom for Visual Studio
 5 | *.cs     diff=csharp
 6 | *.sln    merge=union
 7 | *.csproj merge=union
 8 | *.vbproj merge=union
 9 | *.fsproj merge=union
10 | *.dbproj merge=union
11 | 
12 | # Standard to msysgit
13 | *.doc	 diff=astextplain
14 | *.DOC	 diff=astextplain
15 | *.docx diff=astextplain
16 | *.DOCX diff=astextplain
17 | *.dot  diff=astextplain
18 | *.DOT  diff=astextplain
19 | *.pdf  diff=astextplain
20 | *.PDF	 diff=astextplain
21 | *.rtf	 diff=astextplain
22 | *.RTF	 diff=astextplain
23 | 


--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
 1 | # Windows image file caches
 2 | Thumbs.db
 3 | ehthumbs.db
 4 | 
 5 | # Folder config file
 6 | Desktop.ini
 7 | 
 8 | # Recycle Bin used on file shares
 9 | $RECYCLE.BIN/
10 | 
11 | # Windows Installer files
12 | *.cab
13 | *.msi
14 | *.msm
15 | *.msp
16 | 
17 | # =========================
18 | # Operating System Files
19 | # =========================
20 | 
21 | # OSX
22 | # =========================
23 | 
24 | .DS_Store
25 | .AppleDouble
26 | .LSOverride
27 | 
28 | # Icon must ends with two \r.
29 | Icon

30 | 
31 | # Thumbnails
32 | ._*
33 | 
34 | # Files that might appear on external disk
35 | .Spotlight-V100
36 | .Trashes
37 | 


--------------------------------------------------------------------------------
/pin_taint_trace.py:
--------------------------------------------------------------------------------
  1 | # Copyright 2014 James Ritchey
  2 | # GNU GPLv3
  3 | 
  4 | #KNOB<string> KnobOutputFile(KNOB_MODE_WRITEONCE, "pintool",
  5 | #    "o", "tainttracer.txt", "specify trace output file name");
  6 | #KNOB<string> KnobFileRead(KNOB_MODE_WRITEONCE, "pintool",
  7 | #    "f", "", "specify which file name to trace");
  8 | #KNOB<string> KnobNetworkRead(KNOB_MODE_WRITEONCE, "pintool",
  9 | #    "n", "", "specify which IP address to trace");
 10 | #KNOB<unsigned int> KnobSleep(KNOB_MODE_WRITEONCE, "pintool",
 11 | #    "s", "10000", "specify sleep for process in milliseconds");
 12 | #KNOB<unsigned int> KnobOracle(KNOB_MODE_WRITEONCE, "pintool",
 13 | #    "z", "0", "only as oracle 0 or 1"); // only check for fatal unhandled exception
 14 | #KNOB<int> KnobImplicit(KNOB_MODE_WRITEONCE, "pintool",
 15 | #    "i", "0", "specify how many levels of implicit taints (EIP taints), 0 Default only explicit, -1 is unlimited");
 16 | #KNOB<int> KnobDereference(KNOB_MODE_WRITEONCE, "pintool",
 17 | #    "d", "0", "specify whether to dereference read memory or not, 0 or 1; can cause crash");
 18 | 
 19 | from pydbg import *
 20 | from pydbg.defines import *
 21 | import shutil
 22 | from datetime import datetime
 23 | import subprocess
 24 | import os
 25 | from os.path import join
 26 | 
 27 | sleeptime = 0													# how many milliseconds to sleep for
 28 | outputfile = r'C:\Users\user\Desktop\tainttracer.txt'		# output file information
 29 | program = r'C:\Program Files\DAEMON Tools Lite\DTLite.exe'		# program to start from beginning
 30 | service = r'DTLite.exe'			# service to attach to
 31 | inputfile = r''					# filter file read by file name
 32 | inputip = r'127.0.0.1'			# filter recv by peer IP address
 33 | crashdir = r'C:\newcrashes' 	# where to store crash information
 34 | implicit = 0					# how many implicit taints to do
 35 | doattach = True					# attach to program or start program from beginning
 36 | dereferencememory = 0			# whether to dereference read memory or not
 37 | pinbat = r'C:\Users\user\Downloads\pin-2.13-65163-msvc10-windows\pin-2.13-65163-msvc10-windows\pin_bat.bat'
 38 | pintool = r'C:\Users\user\Downloads\pin-2.13-65163-msvc10-windows\pin-2.13-65163-msvc10-windows\source\tools\ManualExamples\obj-ia32\tainttracer.dll'
 39 | 
 40 | def getTimeStamp():
 41 | 	return datetime.now().strftime("%Y_%m_%d_%H_%M_%S")
 42 | 
 43 | def process(retv):
 44 | 	if retv == 3:
 45 | 		print " program crashed, now copying outfile: " + outputfile
 46 | 		print " program name: " + os.path.basename(program)
 47 | 		print " input file name: " + os.path.basename(inputfile)
 48 | 		crashimage="UnknownImage"
 49 | 		crashrva="UnknownCrashRVA"
 50 | 		
 51 | 		#get program name (without path), inputfile, parse crashed module, parse crash rva, get timestamp, write outfile and input crashfile
 52 | 		try:
 53 | 			f = open(outputfile, "r")
 54 | 			for line in f:
 55 | 				tokens = line.split("::", 2)
 56 | 				if (len(tokens) == 2):
 57 | 					name = tokens[0].lstrip().rstrip()
 58 | 					value = tokens[1].lstrip().rstrip()
 59 | 					if name == "IMG name":
 60 | 						if value:
 61 | 							print "IMG name is " + value
 62 | 							crashimage = value
 63 | 					elif name == "CrashRVA":
 64 | 						if value:
 65 | 							print "Crash RVA is " + value
 66 | 							crashrva = value
 67 | 		except IOError:
 68 | 			print " Problems opening outputfile"
 69 | 		finally:
 70 | 			f.close()
 71 | 		print "IMG: " + crashimage
 72 | 		print "RVA: " + crashrva
 73 | 		print "Input: " + os.path.basename(inputfile)
 74 | 		print "Program: " + os.path.basename(program)
 75 | 		try:
 76 | 			os.makedirs(crashdir + "\\" + os.path.basename(program) + "\\" + os.path.basename(inputfile) + "\\" + os.path.basename(crashimage) + "\\" + crashrva)
 77 | 		except Exception:
 78 | 			print "Couldn't make directories, or already exists"
 79 | 		try:
 80 | 			filename, fileext = os.path.splitext(inputfile)
 81 | 			print "name: " + filename
 82 | 			print "ext: " + fileext
 83 | 			print "inputfile: " + inputfile
 84 | 			print "target: " + crashdir + "\\"+ os.path.basename(program) + "\\" + os.path.basename(inputfile) + "\\" + os.path.basename(crashimage) + "\\" + crashrva + "\\crashsynop_" + thetime + fileext
 85 | 
 86 | 			shutil.copyfile(outputfile, crashdir + "\\"+ os.path.basename(program) + "\\" + os.path.basename(inputfile) + "\\" + os.path.basename(crashimage) + "\\" + crashrva + "\\crash_" + thetime + ".out")
 87 | 		except IOError, (errno, strerror):
 88 | 			print "Couldn't copy fuzzed filename to crash directory"
 89 | 			print "%s %s" % (errno, strerror)
 90 | 	elif retv == 5:
 91 | 		print getTimeStamp()  + " program ended from timer"
 92 | 	else:
 93 | 		print getTimeStamp()  + " program ended naturally??"
 94 | 
 95 | # MAIN #
 96 | dbg = pydbg()
 97 | found = 0
 98 | for (pid, name) in dbg.enumerate_processes():
 99 | 	if name == service:
100 | 		found=1
101 | 		break
102 | 
103 | print  getTimeStamp() + "executing pin tool"
104 | 
105 | if (doattach):
106 | 	if (found):
107 | 		returnv = subprocess.call(pinbat + ' -follow_execv -pid '+ str(pid) +' -t ' + pintool + ' -n ' + inputip + ' -d ' + str(dereferencememory) + ' -i ' + str(implicit) + ' -o ' + outputfile + ' -s ' + str(sleeptime) + ' --' , shell=True)
108 | 		thetime = getTimeStamp()
109 | 		print thetime + " return code " + str(returnv)
110 | 		process(returnv)
111 | 	else:
112 | 		print getTimeStamp() + " couldn't find service"
113 | else:
114 | 	returnv = subprocess.call(pinbat + ' -follow_execv -t ' + pintool  + ' -n ' + inputip + ' -d ' + str(dereferencememory) + ' -i ' + str(implicit) + ' -s ' + str(sleeptime) + ' -o ' + outputfile + ' -- "' + program + '" ' + inputfile, shell=True)
115 | 	thetime = getTimeStamp()
116 | 	print thetime + " return code " + str(returnv)
117 | 	process(returnv)


--------------------------------------------------------------------------------
/src/tainttracer.cpp:
--------------------------------------------------------------------------------
   1 | /*
   2 |  * Copyright 2014 James Ritchey
   3 |  * GNU GPLv3
   4 |  * 
   5 |  */
   6 | #include "pin.H"
   7 | #include <iostream>
   8 | #include <fstream>
   9 | #include <iomanip>
  10 | #include <set>
  11 | #include <map>
  12 | #include <stdint.h>
  13 | #include <sstream>
  14 | #include <ctime>
  15 | #include <cstdlib>
  16 | 
  17 | extern "C" {
  18 | 	#include "xed-interface.h"
  19 | 	#include "xed-flags.h"
  20 | 	#include "xed-types.h"
  21 | 	#include "xed-portability.h"
  22 | 	#include "xed-flag-enum.h"
  23 | 	#include "xed-flag-action-enum.h"
  24 | 	#include "xed-gen-table-defs.h"
  25 | }
  26 | 
  27 | namespace WINDOWS
  28 | {
  29 | 	#pragma comment (lib, "WS2_32.lib")
  30 | 	#include <Winsock2.h>
  31 | 	#include <ws2tcpip.h>
  32 | 	#include<Windows.h>
  33 | 
  34 | 	typedef struct _IO_STATUS_BLOCK {
  35 | 		union {
  36 | 			NTSTATUS Status;
  37 | 			PVOID Pointer;
  38 | 		};
  39 | 		ULONG_PTR Information;
  40 | 	} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;
  41 | 
  42 | 	typedef VOID(WINAPI *PIO_APC_ROUTINE) (
  43 | 		IN PVOID ApcContext,
  44 | 		IN PIO_STATUS_BLOCK IoStatusBlock,
  45 | 		IN ULONG Reserved
  46 | 		);
  47 | 		
  48 | }	
  49 | 
  50 | #define BUFSIZE							1024
  51 | #define STATUS_ACCESS_VIOLATION			0xc0000005
  52 | #define STATUS_STACK_BUFFER_OVERRUN		0xc0000409
  53 | #define BREAKPOINT 						0x80000003
  54 | #define GUARD_PAGE						0x80000001
  55 | #define SINGLE_STEP						0x80000004
  56 | #define CONTEXT_CONTROL                 0x00010001
  57 | #define CONTEXT_INTEGER                 0x00010002
  58 | #define CONTEXT_SEGMENTS                0x00010004
  59 | #define CONTEXT_FULL                    0x00010007
  60 | #define CONTEXT_DEBUG_REGISTERS         0x00010010
  61 | 
  62 | xed_state_t xedstate;
  63 | static bool canstartimplicit = false; // Bool for if can start implicit tainting, only after first tainted flag is read
  64 | static int implicitcount=0;
  65 | std::ofstream TraceFile;
  66 | static stringstream outfilestream;
  67 | 
  68 | class ThreadInfo {
  69 | 	public:
  70 | 		struct taintedflagsinfo {
  71 | 			unsigned int flags;
  72 | 			unsigned int value;
  73 | 		};
  74 | 		struct taintedregsinfo {
  75 | 			unsigned int value;
  76 | 		};
  77 | 		set<REG> readreg; // read registers for this address, use xed to get which registers
  78 | 		set<REG> writtenreg; //written registers for this address, use xed to get which registers
  79 | 		set<unsigned int>memoryaddressesread; // address read, and length
  80 | 		set<unsigned int>memoryaddresseswritten; // address written, and length
  81 | 		bool flagsw; 
  82 | 		bool flagsr; 
  83 | 		xed_flag_set_t readflags; 
  84 | 		xed_flag_set_t writtenflags; 
  85 | 		char instmap[50]; //disassembly for this address
  86 | 		bool istainted;
  87 | 		bool decoded;
  88 | 		unsigned char itext[XED_MAX_INSTRUCTION_BYTES]; // hex opcodes
  89 | 		xed_decoded_inst_t decodedinstruction;
  90 | 		IMG img; //module which this address belongs
  91 | 		RTN rtn; // routine that the instruction is on
  92 | 		map<REG, taintedregsinfo *> taintedregs; // current map of tainted registers for a thread, [reg][value]
  93 | 		taintedflagsinfo taintedflags; // current map of tainted flags for a thread id, [tainted flags][flag value]
  94 | 		
  95 | 		ThreadInfo()
  96 | 		{
  97 | 			istainted=false;
  98 | 			decoded=false;
  99 | 			flagsr=false;
 100 | 			flagsw=false;
 101 | 			taintedflags.flags = 0;
 102 | 			taintedflags.value = 0;
 103 | 		}
 104 | 		
 105 | 		void clean()
 106 | 		{
 107 | 			istainted=false;
 108 | 			decoded=false;
 109 | 			flagsr=false;
 110 | 			flagsw=false;
 111 | 			readreg.clear();
 112 | 			writtenreg.clear();
 113 | 			memoryaddressesread.clear();
 114 | 			memoryaddresseswritten.clear();
 115 | 		}
 116 | 		
 117 | 		string ImgToString()
 118 | 		{
 119 | 			string imgname;		
 120 | 			if (IMG_Valid(img))
 121 | 				imgname = IMG_Name(img);
 122 | 			else
 123 | 				imgname = "Unknown";	
 124 | 			return imgname;
 125 | 		}
 126 | 		
 127 | 		string RtnToString()
 128 | 		{
 129 | 			string rtnname;
 130 | 			if (RTN_Valid(rtn))
 131 | 				rtnname = RTN_Name(rtn);
 132 | 			else
 133 | 				rtnname="Unknown";
 134 | 			return rtnname;
 135 | 		}
 136 | 		
 137 | 		void addRegs(REG reg, bool isread)
 138 | 		{
 139 | 			if (isread)
 140 | 			{
 141 | 				switch (reg)
 142 | 				{
 143 | 					case REG_EAX:
 144 | 						readreg.insert(REG_AH);
 145 | 						readreg.insert(REG_AL);
 146 | 						readreg.insert(REG_AX);
 147 | 						break;
 148 | 					case REG_AX:
 149 | 						readreg.insert(REG_AH);
 150 | 						readreg.insert(REG_AL);
 151 | 						readreg.insert(REG_EAX);
 152 | 						break;
 153 | 					case REG_AH:
 154 | 					case REG_AL:
 155 | 						readreg.insert(REG_AX);
 156 | 						readreg.insert(REG_EAX);
 157 | 						break;
 158 | 					case REG_EBX:
 159 | 						readreg.insert(REG_BH);
 160 | 						readreg.insert(REG_BL);
 161 | 						readreg.insert(REG_BX);
 162 | 						break;
 163 | 					case REG_BX:
 164 | 						readreg.insert(REG_BH);
 165 | 						readreg.insert(REG_BL);
 166 | 						readreg.insert(REG_EBX);
 167 | 						break;
 168 | 					case REG_BH:
 169 | 					case REG_BL:
 170 | 						readreg.insert(REG_BX);
 171 | 						readreg.insert(REG_EBX);
 172 | 						break;
 173 | 					case REG_ECX:
 174 | 						readreg.insert(REG_CH);
 175 | 						readreg.insert(REG_CL);
 176 | 						readreg.insert(REG_CX);
 177 | 						break;
 178 | 					case REG_CX:
 179 | 						readreg.insert(REG_CH);
 180 | 						readreg.insert(REG_CL);
 181 | 						readreg.insert(REG_ECX);
 182 | 						break;
 183 | 					case REG_CH:
 184 | 					case REG_CL:
 185 | 						readreg.insert(REG_ECX);
 186 | 						readreg.insert(REG_CX);
 187 | 						break;
 188 | 					case REG_EDX:
 189 | 						readreg.insert(REG_DH);
 190 | 						readreg.insert(REG_DL);
 191 | 						readreg.insert(REG_DX);
 192 | 						break;
 193 | 					case REG_DX:
 194 | 						readreg.insert(REG_DH);
 195 | 						readreg.insert(REG_DL);
 196 | 						readreg.insert(REG_EDX);
 197 | 						break;
 198 | 					case REG_DH:
 199 | 					case REG_DL:
 200 | 						readreg.insert(REG_DX);
 201 | 						readreg.insert(REG_EDX);
 202 | 						break;
 203 | 					case REG_ESI:
 204 | 						readreg.insert(REG_SI);
 205 | 						break;
 206 | 					case REG_SI:
 207 | 						readreg.insert(REG_ESI);
 208 | 						break;
 209 | 					case REG_EDI:
 210 | 						readreg.insert(REG_DI);
 211 | 						break;
 212 | 					case REG_DI:
 213 | 						readreg.insert(REG_EDI);
 214 | 						break;
 215 | 					case REG_EBP:
 216 | 						readreg.insert(REG_BP);
 217 | 						break;
 218 | 					case REG_BP:
 219 | 						readreg.insert(REG_EBP);
 220 | 						break;
 221 | 					case REG_ESP:
 222 | 						readreg.insert(REG_SP);
 223 | 						break;
 224 | 					case REG_SP:
 225 | 						readreg.insert(REG_ESP);
 226 | 						break;
 227 | 					case REG_EIP:
 228 | 						readreg.insert(REG_IP);
 229 | 						break;
 230 | 					case REG_IP:
 231 | 						readreg.insert(REG_EIP);
 232 | 						break;
 233 | 					default:
 234 | 						break;
 235 | 				}
 236 | 			}
 237 | 			else // written regs
 238 | 			{
 239 | 				switch (reg)
 240 | 				{
 241 | 					case REG_EAX:
 242 | 						writtenreg.insert(REG_AH);
 243 | 						writtenreg.insert(REG_AL);
 244 | 						writtenreg.insert(REG_AX);
 245 | 						break;
 246 | 					case REG_AX:
 247 | 						writtenreg.insert(REG_AH);
 248 | 						writtenreg.insert(REG_AL);
 249 | 						writtenreg.insert(REG_EAX);
 250 | 						break;
 251 | 					case REG_AH:
 252 | 					case REG_AL:
 253 | 						writtenreg.insert(REG_AX);
 254 | 						writtenreg.insert(REG_EAX);
 255 | 						break;
 256 | 					case REG_EBX:
 257 | 						writtenreg.insert(REG_BH);
 258 | 						writtenreg.insert(REG_BL);
 259 | 						writtenreg.insert(REG_BX);
 260 | 						break;
 261 | 					case REG_BX:
 262 | 						writtenreg.insert(REG_BH);
 263 | 						writtenreg.insert(REG_BL);
 264 | 						writtenreg.insert(REG_EBX);
 265 | 						break;
 266 | 					case REG_BH:
 267 | 					case REG_BL:
 268 | 						writtenreg.insert(REG_BX);
 269 | 						writtenreg.insert(REG_EBX);
 270 | 						break;
 271 | 					case REG_ECX:
 272 | 						writtenreg.insert(REG_CH);
 273 | 						writtenreg.insert(REG_CL);
 274 | 						writtenreg.insert(REG_CX);
 275 | 						break;
 276 | 					case REG_CX:
 277 | 						writtenreg.insert(REG_CH);
 278 | 						writtenreg.insert(REG_CL);
 279 | 						writtenreg.insert(REG_ECX);
 280 | 						break;
 281 | 					case REG_CH:
 282 | 					case REG_CL:
 283 | 						writtenreg.insert(REG_ECX);
 284 | 						writtenreg.insert(REG_CX);
 285 | 						break;
 286 | 					case REG_EDX:
 287 | 						writtenreg.insert(REG_DH);
 288 | 						writtenreg.insert(REG_DL);
 289 | 						writtenreg.insert(REG_DX);
 290 | 						break;
 291 | 					case REG_DX:
 292 | 						writtenreg.insert(REG_DH);
 293 | 						writtenreg.insert(REG_DL);
 294 | 						writtenreg.insert(REG_EDX);
 295 | 						break;
 296 | 					case REG_DH:
 297 | 					case REG_DL:
 298 | 						writtenreg.insert(REG_DX);
 299 | 						writtenreg.insert(REG_EDX);
 300 | 						break;
 301 | 					case REG_ESI:
 302 | 						writtenreg.insert(REG_SI);
 303 | 						break;
 304 | 					case REG_SI:
 305 | 						writtenreg.insert(REG_ESI);
 306 | 						break;
 307 | 					case REG_EDI:
 308 | 						writtenreg.insert(REG_DI);
 309 | 						break;
 310 | 					case REG_DI:
 311 | 						writtenreg.insert(REG_EDI);
 312 | 						break;
 313 | 					case REG_EBP:
 314 | 						writtenreg.insert(REG_BP);
 315 | 						break;
 316 | 					case REG_BP:
 317 | 						writtenreg.insert(REG_EBP);
 318 | 						break;
 319 | 					case REG_ESP:
 320 | 						writtenreg.insert(REG_SP);
 321 | 						break;
 322 | 					case REG_SP:
 323 | 						writtenreg.insert(REG_ESP);
 324 | 						break;
 325 | 					case REG_EIP:
 326 | 						writtenreg.insert(REG_IP);
 327 | 						break;
 328 | 					case REG_IP:
 329 | 						writtenreg.insert(REG_EIP);
 330 | 						break;
 331 | 					default:
 332 | 						break;
 333 | 				}
 334 | 			}
 335 | 		}
 336 | 		
 337 | 		bool disassembleInst(unsigned int instructionpointer)
 338 | 		{	
 339 | 			if (xed_format_intel(&decodedinstruction, instmap, 50, instructionpointer))
 340 | 			{
 341 | 				return true;
 342 | 			}
 343 | 			return false;
 344 | 		}
 345 | 		
 346 | 		bool decodeInstruction(unsigned int size)
 347 | 		{
 348 | 			xed_decoded_inst_zero_set_mode(&decodedinstruction, &xedstate);
 349 | 			xed_error_enum_t e = xed_decode(&decodedinstruction, itext, XED_MAX_INSTRUCTION_BYTES);
 350 | 			if ( e == XED_ERROR_NONE )
 351 | 			{
 352 | 				return true;
 353 | 			}
 354 | 			outfilestream <<"decode failure: " << xed_error_enum_t2str(e)<<endl;
 355 | 			return false;	
 356 | 		}
 357 | 	
 358 | 		unsigned int setInstructionTextOpcodes(unsigned int instructionpointer, unsigned int length)
 359 | 		{
 360 | 			return PIN_SafeCopy(itext, (unsigned int *)instructionpointer, length);
 361 | 		}
 362 | 	
 363 | 		void setFlags(unsigned int instructionpointer)
 364 | 		{
 365 | 			if (xed_decoded_inst_uses_rflags(&decodedinstruction)) {
 366 | 				unsigned int i, nflags;
 367 | 				const xed_simple_flag_t* rfi = xed_decoded_inst_get_rflags_info(&decodedinstruction);
 368 | 				if (xed_simple_flag_reads_flags(rfi)) {
 369 | 					flagsr=true;
 370 | 					PIN_SafeCopy(&readflags, xed_simple_flag_get_read_flag_set(rfi), sizeof(xed_flag_set_t));
 371 | 				}
 372 | 				if (xed_simple_flag_writes_flags(rfi)) {
 373 | 					flagsw=true;
 374 | 					PIN_SafeCopy(&writtenflags, xed_simple_flag_get_written_flag_set(rfi), sizeof(xed_flag_set_t));
 375 | 				}
 376 | 			}
 377 | 		}
 378 | 
 379 | 		void UpdateTaintedWrittenFlagsValues( const CONTEXT *ctx)
 380 | 		{
 381 | 			if (flagsw)
 382 | 			{
 383 | 				unsigned int wflags = xed_flag_set_mask((const xed_flag_set_t *)&writtenflags);
 384 | 				unsigned int writtenvalues = (unsigned int)PIN_GetContextReg(ctx, REG_GFLAGS);
 385 | 				unsigned int temp = ((~((~writtenvalues) & wflags)) &	taintedflags.value);
 386 | 				// fix the 1s and finish
 387 | 				taintedflags.value = ((writtenvalues & wflags) | temp);
 388 | 			}
 389 | 		}
 390 | 		
 391 | 		void UnTaintWrittenFlags()
 392 | 		{
 393 | 			if (flagsw)
 394 | 			{
 395 | 				unsigned int wflags = xed_flag_set_mask((const xed_flag_set_t *)&writtenflags);
 396 | 				taintedflags.flags = (~wflags) & taintedflags.flags;
 397 | 			}
 398 | 		}
 399 | 
 400 | 		void TaintWrittenFlags()
 401 | 		{
 402 | 			if (flagsw)
 403 | 			{
 404 | 				unsigned int wflags = xed_flag_set_mask((const xed_flag_set_t *)&writtenflags);
 405 | 				unsigned int taintedandwrittenflags = taintedflags.flags & wflags;
 406 | 
 407 | 				taintedflags.flags = taintedflags.flags | wflags;
 408 | 			}
 409 | 		}
 410 | 
 411 | 		string TaintedAndReadFlagsToString(const CONTEXT *ctx)
 412 | 		{
 413 | 			stringstream result;
 414 | 
 415 | 			if (flagsr)
 416 | 			{
 417 | 				unsigned int read = xed_flag_set_mask((const xed_flag_set_t *)&readflags);
 418 | 				unsigned int readandtainted = taintedflags.flags & read;
 419 | 				unsigned int readandnottainted = readandtainted ^ read;	
 420 | 				unsigned int flagvalues = (unsigned int)PIN_GetContextReg((const CONTEXT *)ctx, REG_GFLAGS);
 421 | 				
 422 | 				char buf[500];
 423 | 				xed_flag_set_print((const xed_flag_set_t *)&readandnottainted,buf,500);
 424 | 				result <<hex<< readandnottainted << ":" << buf;
 425 | 				
 426 | 				if (readandtainted)
 427 | 				{
 428 | 					char buff[500];
 429 | 					result << "[T ";
 430 | 					xed_flag_set_print((const xed_flag_set_t *)&readandtainted,buff,500);
 431 | 					result <<hex<< readandtainted << ":" << buff;
 432 | 					result << "]";
 433 | 				}
 434 | 				result << ":Values:" <<hex<< flagvalues;
 435 | 			}
 436 | 			
 437 | 			return result.str();
 438 | 		}
 439 | 		
 440 | 		bool IsReadFlagsTainted()
 441 | 		{
 442 | 			if (flagsr)
 443 | 			{
 444 | 				unsigned int tempread = xed_flag_set_mask(&readflags);
 445 | 				if (taintedflags.flags & tempread) 
 446 | 				{
 447 | 					canstartimplicit = true;
 448 | 					return true;
 449 | 				}
 450 | 			}
 451 | 			return false;
 452 | 		}
 453 | 
 454 | 		void UnTaintWrittenRegs()
 455 | 		{
 456 | 			set<REG>::iterator writtenregit = writtenreg.begin();
 457 | 			for (; writtenregit != writtenreg.end();writtenregit++)
 458 | 			{
 459 | 				if (taintedregs.find(*writtenregit) != taintedregs.end())
 460 | 				{
 461 | 					delete taintedregs[(*writtenregit)];
 462 | 					taintedregs.erase(*writtenregit);
 463 | 				}
 464 | 			}
 465 | 		}
 466 | 
 467 | 		void TaintWrittenRegisters(const CONTEXT *ctx)
 468 | 		{
 469 | 			set<REG>::iterator writtenregit = writtenreg.begin();
 470 | 			for (; writtenregit != writtenreg.end();writtenregit++)
 471 | 			{
 472 | 				// do not taint the stack pointer register?
 473 | 				if (REG_FullRegName(*writtenregit) == REG_STACK_PTR)
 474 | 				{
 475 | 					continue;
 476 | 				}
 477 | 				
 478 | 				unsigned int val;
 479 | 				if (!REG_is_fr_or_x87(REG_FullRegName(*writtenregit)))
 480 | 				{
 481 | 					val = (unsigned int)PIN_GetContextReg(ctx, REG_FullRegName(*writtenregit));
 482 | 				} else
 483 | 				{
 484 | 					if (REG_is_fr_for_get_context(REG_FullRegName(*writtenregit)))
 485 | 					{
 486 | 						val = (unsigned int)PIN_GetContextReg(ctx, REG_FullRegName(*writtenregit));
 487 | 					}
 488 | 					else
 489 | 					{
 490 | 						val =0;
 491 | 					}
 492 | 				}
 493 | 
 494 | 				// if the written register is not in the tainted set already, then add it there
 495 | 				if (taintedregs.find((*writtenregit)) == taintedregs.end())
 496 | 				{
 497 | 					taintedregs.insert(pair<REG, taintedregsinfo *>(*writtenregit, new taintedregsinfo));
 498 | 				}
 499 | 				taintedregs[(*writtenregit)]->value = val;	
 500 | 			}
 501 | 		}
 502 | 
 503 | 		string TaintedAndReadRegsToString(const CONTEXT *ctx)
 504 | 		{
 505 | 			stringstream result;
 506 | 			set<REG>::iterator readregit = readreg.begin();
 507 | 			//for each read register
 508 | 			for (; readregit != readreg.end();readregit++)
 509 | 			{
 510 | 				// this can cause "duplicates" for nested registers
 511 | 				result << REG_StringShort(*readregit);
 512 | 				// if it's in list of tainted registers, show that it's tainted
 513 | 				if (taintedregs.find(*readregit) != taintedregs.end())
 514 | 				{
 515 | 					result << "[T]";
 516 | 				}
 517 | 				result << ": ";
 518 | 				
 519 | 				if (REG_is_xmm(REG_FullRegName(*readregit)) || REG_is_ymm(REG_FullRegName(*readregit)) || REG_is_fr_or_x87(*readregit))
 520 | 				{
 521 | 					if (REG_is_fr_for_get_context(REG_FullRegName(*readregit)))
 522 | 					{
 523 | 						result <<hex<<(unsigned int)PIN_GetContextReg(ctx, REG_FullRegName(*readregit));
 524 | 					}
 525 | 					else
 526 | 					{
 527 | 						result << "can't get value";
 528 | 					}
 529 | 				}
 530 | 				else
 531 | 				{
 532 | 					result <<hex<<(unsigned int)PIN_GetContextReg(ctx, REG_FullRegName(*readregit));
 533 | 				}
 534 | 				result << ": ";
 535 | 			}
 536 | 			
 537 | 			return result.str();
 538 | 		}
 539 | 		
 540 | 		string TaintedAndWrittenRegsToString(const CONTEXT *ctx)
 541 | 		{
 542 | 			stringstream result;
 543 | 			set<REG>::iterator writtenregit = writtenreg.begin();
 544 | 			//for each read register
 545 | 			for (; writtenregit != writtenreg.end();writtenregit++)
 546 | 			{
 547 | 				// this can cause "duplicates" for nested registers
 548 | 				result << REG_StringShort(*writtenregit);
 549 | 				// if it's in list of tainted registers, show that it's tainted
 550 | 				if (taintedregs.find(*writtenregit) != taintedregs.end())
 551 | 				{
 552 | 					result << "[T]";
 553 | 				}
 554 | 				result << ": ";
 555 | 				
 556 | 				if (REG_is_xmm(REG_FullRegName(*writtenregit)) || REG_is_ymm(REG_FullRegName(*writtenregit)) || REG_is_fr_or_x87(*writtenregit))
 557 | 				{
 558 | 					if (REG_is_fr_for_get_context(REG_FullRegName(*writtenregit)))
 559 | 					{
 560 | 						result <<hex<<(unsigned int)PIN_GetContextReg(ctx, REG_FullRegName(*writtenregit));
 561 | 					}
 562 | 					else
 563 | 					{
 564 | 						result << "can't get value";
 565 | 					}
 566 | 				}
 567 | 				else
 568 | 				{
 569 | 					result <<hex<<(unsigned int)PIN_GetContextReg(ctx, REG_FullRegName(*writtenregit));
 570 | 				}
 571 | 				result << ": ";
 572 | 			}
 573 | 			
 574 | 			return result.str();
 575 | 		}
 576 | 		
 577 | 
 578 | 		bool IsReadRegistersTainted()
 579 | 		{
 580 | 			set<REG>::iterator readregit = readreg.begin();
 581 | 			//for each read register
 582 | 			for (; readregit != readreg.end();readregit++)
 583 | 			{
 584 | 				// if it's in list of tainted registers
 585 | 				if (taintedregs.find(*readregit) != taintedregs.end())
 586 | 				{
 587 | 					return true;
 588 | 				}
 589 | 			}
 590 | 			return false;
 591 | 		}
 592 | };
 593 | 
 594 | struct taintedmeminfo {
 595 | 	uint8_t value;
 596 | };
 597 | 
 598 | struct readinfo {
 599 | 	WINDOWS::LONGLONG offset;
 600 | 	bool gotread;
 601 | 	unsigned int buffer;
 602 | 	WINDOWS::PIO_STATUS_BLOCK Iosb;
 603 | 	unsigned int length;
 604 | };
 605 | 
 606 | KNOB<string> KnobOutputFile(KNOB_MODE_WRITEONCE, "pintool",
 607 |     "o", "tainttracer.txt", "specify trace output file name");
 608 | KNOB<string> KnobFileRead(KNOB_MODE_WRITEONCE, "pintool",
 609 |     "f", "", "specify which file name to trace");
 610 | KNOB<string> KnobNetworkRead(KNOB_MODE_WRITEONCE, "pintool",
 611 |     "n", "", "specify which IP address to trace");
 612 | KNOB<unsigned int> KnobSleep(KNOB_MODE_WRITEONCE, "pintool",
 613 |     "s", "10000", "specify sleep for process in milliseconds");
 614 | KNOB<unsigned int> KnobOracle(KNOB_MODE_WRITEONCE, "pintool",
 615 |     "z", "0", "only as oracle 0 or 1"); // only check for fatal unhandled exception
 616 | KNOB<int> KnobImplicit(KNOB_MODE_WRITEONCE, "pintool",
 617 |     "i", "0", "specify how many levels of implicit taints (EIP taints), 0 Default only explicit, -1 is unlimited");
 618 | KNOB<int> KnobDereference(KNOB_MODE_WRITEONCE, "pintool",
 619 |     "d", "0", "specify whether to dereference read memory or not, 0 or 1; can cause crash");
 620 | 
 621 | static map<unsigned int, taintedmeminfo *>taintedmem; // current map of tainted memory with byte value
 622 | static map<unsigned int, ThreadInfo *> threadinfo; // per thread information
 623 | static string inputfilename = "filename";
 624 | static string inputipaddress = "ipaddress";
 625 | static bool checkingip=false;
 626 | static bool begintaint=false;
 627 | static map<unsigned int, struct readinfo *> treadinfo; // per thread read information
 628 | static unsigned int sleepthreadid;
 629 | static unsigned int onlyasoracle=0;
 630 | static unsigned int dereferencememory=0;
 631 | 
 632 | PIN_LOCK lock;
 633 | 
 634 | VOID ThreadStart(THREADID threadid, CONTEXT *ctxt, INT32 flags, VOID *v) 
 635 | {
 636 |     PIN_GetLock(&lock, threadid+1);
 637 |     outfilestream << "thread begin " << threadid <<endl;
 638 | 	threadinfo.insert(pair<unsigned int, ThreadInfo *>(threadid, new ThreadInfo()));
 639 |     PIN_ReleaseLock(&lock);
 640 | }
 641 | 
 642 | VOID ThreadFini(THREADID threadid, const CONTEXT *ctxt, INT32 code, VOID *v) 
 643 | {
 644 |     PIN_GetLock(&lock, threadid+1);
 645 |     outfilestream << "thread end "<<threadid<<" code " << code <<endl;
 646 | 	delete threadinfo[threadid];
 647 | 	threadinfo.erase(threadid);
 648 |     PIN_ReleaseLock(&lock);
 649 | 	/*
 650 | 	if (threadid == 0)
 651 | 	{
 652 | 		outfilestream << "main thread returned, stopping process"<<endl;
 653 | 		if (outfilestream.rdbuf()->in_avail() != 0)
 654 | 		{
 655 | 			TraceFile << outfilestream.str();
 656 | 			outfilestream.str("");
 657 | 		}
 658 | 		TraceFile.flush();
 659 | 		TraceFile.close();
 660 | 		PIN_ExitProcess(5);
 661 | 	}
 662 | 	*/
 663 | }
 664 | 
 665 | VOID BeforeUnhandledExceptionFilter(THREADID threadid, CHAR *name, WINDOWS::EXCEPTION_POINTERS *exceptionpointer)
 666 | {
 667 |     PIN_GetLock(&lock, threadid+1);
 668 | 	
 669 | 	outfilestream << "Unhandled Exception Thread "<<threadid;
 670 | 	outfilestream << ": name "<<name;
 671 | 	outfilestream << ": exception code "<<exceptionpointer->ExceptionRecord->ExceptionCode;
 672 | 	outfilestream <<": Is not continuable? "<<exceptionpointer->ExceptionRecord->ExceptionFlags;
 673 | 	outfilestream <<": address "<<exceptionpointer->ExceptionRecord->ExceptionAddress<<endl;
 674 | 	
 675 | 	for (int i=0;i<exceptionpointer->ExceptionRecord->NumberParameters;i++)
 676 | 	{
 677 | 		outfilestream <<"Exception param "<<i<<": "<<exceptionpointer->ExceptionRecord->ExceptionInformation[i]<<endl;
 678 | 	}
 679 | 	
 680 | 	bool accessviolation=false;
 681 | 	unsigned int crasheip=0;
 682 | 	IMG cimg;
 683 | 	string rtnname;
 684 | 	string imgname;
 685 | 	unsigned int imgaddress = 0;
 686 | 	unsigned int crashrva = 0;
 687 | 	
 688 | 	switch (exceptionpointer->ExceptionRecord->ExceptionCode)
 689 | 	{
 690 | 		case STATUS_ACCESS_VIOLATION:
 691 | 			outfilestream << "Access Violation"<<endl;
 692 | 			for (int i=0;i<exceptionpointer->ExceptionRecord->NumberParameters;i++)
 693 | 			{
 694 | 				if (i == 0)
 695 | 					if (exceptionpointer->ExceptionRecord->ExceptionInformation[i] == 0)
 696 | 						outfilestream <<"Read exception"<<endl;
 697 | 					else if (exceptionpointer->ExceptionRecord->ExceptionInformation[i] == 1)
 698 | 						outfilestream <<"Write exception"<<endl;
 699 | 					else
 700 | 						outfilestream <<"Not read or write."<<endl;
 701 | 				else if (i == 1)
 702 | 					outfilestream <<"@ address : "<<exceptionpointer->ExceptionRecord->ExceptionInformation[i]<<endl;
 703 | 				else
 704 | 					outfilestream <<"Some extra data"<<endl;
 705 | 			}
 706 | 			accessviolation=true;
 707 | 		case STATUS_STACK_BUFFER_OVERRUN:
 708 | 			if (!accessviolation)
 709 | 				outfilestream << "Status_Stack_buffer_overrun"<<endl;	
 710 | 			if (exceptionpointer->ContextRecord->ContextFlags & CONTEXT_CONTROL)
 711 | 			{
 712 | 				outfilestream <<"EIP: " << exceptionpointer->ContextRecord->Eip<<endl;
 713 | 				crasheip = exceptionpointer->ContextRecord->Eip;
 714 | 				outfilestream <<"EBP: " << exceptionpointer->ContextRecord->Ebp<<endl;
 715 | 				outfilestream <<"ESP: " << exceptionpointer->ContextRecord->Esp<<endl;
 716 | 				outfilestream <<"EFlags: " << exceptionpointer->ContextRecord->EFlags<<endl;
 717 | 				outfilestream <<"SegCs: " << exceptionpointer->ContextRecord->SegCs<<endl;
 718 | 				outfilestream <<"SegSs: " << exceptionpointer->ContextRecord->SegSs<<endl;
 719 | 			}
 720 | 			if (exceptionpointer->ContextRecord->ContextFlags & CONTEXT_INTEGER)
 721 | 			{
 722 | 				outfilestream <<"ESI: " << exceptionpointer->ContextRecord->Esi<<endl;
 723 | 				outfilestream <<"EDI: " << exceptionpointer->ContextRecord->Edi<<endl;
 724 | 				outfilestream <<"Eax: " << exceptionpointer->ContextRecord->Eax<<endl;
 725 | 				outfilestream <<"Ebx: " << exceptionpointer->ContextRecord->Ebx<<endl;
 726 | 				outfilestream <<"Ecx: " << exceptionpointer->ContextRecord->Ecx<<endl;
 727 | 				outfilestream <<"Edx: " << exceptionpointer->ContextRecord->Edx<<endl;
 728 | 			}
 729 | 			if (exceptionpointer->ContextRecord->ContextFlags & CONTEXT_SEGMENTS)
 730 | 			{
 731 | 				outfilestream <<"SegDs: " << exceptionpointer->ContextRecord->SegDs<<endl;
 732 | 				outfilestream <<"SegEs: " << exceptionpointer->ContextRecord->SegEs<<endl;
 733 | 				outfilestream <<"SegFs: " << exceptionpointer->ContextRecord->SegFs<<endl;
 734 | 				outfilestream <<"SegGs: " << exceptionpointer->ContextRecord->SegGs<<endl;
 735 | 			}
 736 | 			
 737 | 			PIN_LockClient();
 738 | 			cimg = IMG_FindByAddress(crasheip);
 739 | 			rtnname = RTN_FindNameByAddress(crasheip);
 740 | 			PIN_UnlockClient();
 741 | 
 742 | 			if (IMG_Valid(cimg))
 743 | 			{
 744 | 				imgname = IMG_Name(cimg);
 745 | 				imgaddress = IMG_StartAddress(cimg);
 746 | 				outfilestream << "IMG name:: "<<imgname <<endl;
 747 | 				outfilestream << "IMG StartAddress: "<<imgaddress <<endl;
 748 | 			}
 749 | 			else
 750 | 			{
 751 | 				imgname = "Unknown";
 752 | 				outfilestream << "IMG name:: "<<imgname <<endl;
 753 | 				outfilestream << "IMG StartAddress: "<<imgaddress <<endl;
 754 | 			}
 755 | 			if (!rtnname.empty())
 756 | 			{
 757 | 				outfilestream <<"RTN name: "<<rtnname<<endl;
 758 | 			}
 759 | 			else
 760 | 			{
 761 | 				rtnname = "Unknown";
 762 | 				outfilestream <<"RTN name: "<<rtnname<<endl;
 763 | 			}
 764 | 			crashrva = crasheip - imgaddress;
 765 | 			outfilestream << "CrashRVA:: "<<crashrva<<endl;
 766 | 
 767 | 			break;
 768 | 		case SINGLE_STEP: 
 769 | 			outfilestream <<"Single step"<<endl;
 770 | 			break;
 771 | 		case GUARD_PAGE: 
 772 | 			outfilestream <<"Guard page"<<endl;
 773 | 			break;
 774 | 		case BREAKPOINT: 
 775 | 			outfilestream <<"Breakpoint"<<endl;
 776 | 			break;
 777 | 		default:
 778 | 			outfilestream <<"Unknown exception"<<endl;
 779 | 			break;
 780 | 	}
 781 | 
 782 | //	if (exceptionpointer->ExceptionRecord->ExceptionFlags) //if exception is non-continueable, then exit
 783 | 	outfilestream << "Exception, exiting application"<<endl;
 784 | 
 785 | 	if (outfilestream.rdbuf()->in_avail() != 0)
 786 | 	{
 787 | 		TraceFile << outfilestream.str();
 788 | 		outfilestream.str("");
 789 | 	}
 790 | 
 791 |     TraceFile.close();
 792 | 	PIN_ReleaseLock(&lock);
 793 | 	PIN_ExitProcess(3);
 794 | }
 795 | 
 796 | VOID BeforeWSARecv(THREADID tid, CHAR * name, int s, unsigned int buf, unsigned int bufcount, unsigned int length, int flags, WINDOWS::LPOVERLAPPED  lpOverlapped, WINDOWS::LPOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine) 
 797 | {
 798 | 	PIN_GetLock(&lock, tid+1);
 799 |     outfilestream << "Before: " << name << hex << s << ", " << buf << ", " << bufcount << ", "<<length<<", "<< flags<<", "<<lpOverlapped<<", "<<lpCompletionRoutine<< endl;
 800 | 	PIN_ReleaseLock(&lock);
 801 | }
 802 | 
 803 | VOID AfterWSARecv(THREADID tid, CHAR * name, ADDRINT ret)
 804 | {
 805 | 	PIN_GetLock(&lock, tid+1);
 806 |     outfilestream << "After: " << name << "  returns " <<hex<< ret << hex << endl;
 807 | 	PIN_ReleaseLock(&lock);
 808 | }
 809 | 
 810 | VOID BeforeRecv(THREADID tid,CHAR * name, int s, unsigned int buf, int len, int flags) 
 811 | {
 812 | 	PIN_GetLock(&lock, tid+1);
 813 | 	struct WINDOWS::sockaddr_in sockname;
 814 | 	int leng = sizeof(sockname);
 815 | 	outfilestream << "TID "<<tid<< " Before: " << name << " " << hex << s << ", " << buf << ", " << len << ", "<< flags<< endl;
 816 | 	if (WINDOWS::getpeername(s, (struct WINDOWS::sockaddr *)&sockname, &leng) == 0)
 817 | 	{
 818 | 		string temp(WINDOWS::inet_ntoa(sockname.sin_addr));
 819 | 		outfilestream << "Peer name: " << temp <<endl;
 820 | 		if (inputipaddress.compare(temp) == 0)
 821 | 		{
 822 | 			outfilestream << "Input IP address equals peer name, tainting " <<endl;
 823 | 			
 824 | 			if (treadinfo[tid])
 825 | 				delete treadinfo[tid];
 826 | 			struct readinfo *tem = new readinfo;
 827 | 			tem->gotread=true;
 828 | 			tem->offset = 0;
 829 | 			tem->buffer = buf;
 830 | 			treadinfo[tid]=tem;
 831 | 		}
 832 | 	}
 833 | 	PIN_ReleaseLock(&lock);
 834 | }
 835 | 
 836 | VOID AfterRecv(THREADID tid, CHAR * name, ADDRINT ret)
 837 | {
 838 | 	PIN_GetLock(&lock, tid+1);
 839 | 	outfilestream << "TID: " << tid << " After: " << name << "  returns " << ret << endl;
 840 | 	
 841 | 	if (ret>0 && treadinfo[tid] && treadinfo[tid]->gotread)
 842 | 	{
 843 | 		outfilestream << "Recv on tid: " << tid<<endl;
 844 | 		treadinfo[tid]->gotread = false;
 845 | 		treadinfo[tid]->length = ret;
 846 | 		
 847 | 		outfilestream << "Read length: " << treadinfo[tid]->length<<endl;
 848 | 		outfilestream << "Read data: " << (char *)treadinfo[tid]->buffer<<endl;
 849 | 		for (unsigned int i=0; i <  treadinfo[tid]->length ;i++) 
 850 | 		{
 851 | 			if (taintedmem.find( (unsigned int)treadinfo[tid]->buffer + i) == taintedmem.end()) 
 852 | 				taintedmem.insert(pair<unsigned int, taintedmeminfo *>(treadinfo[tid]->buffer+i, new taintedmeminfo));
 853 | 				
 854 | 			taintedmem[(unsigned int) treadinfo[tid]->buffer+i]->value = *(uint8_t *)treadinfo[tid]->buffer+i;
 855 | 		}
 856 | 		begintaint=true;
 857 | 	}
 858 | 	
 859 | 	PIN_ReleaseLock(&lock);
 860 | }
 861 | 
 862 | VOID BeforeReadFile(THREADID tid, CHAR * name, WINDOWS::HANDLE hFile, WINDOWS::LPVOID lpBuffer, WINDOWS::DWORD nNumberOfBytesToRead, WINDOWS::LPDWORD lpNumberOfBytesRead, WINDOWS::LPOVERLAPPED lpOverlapped) 
 863 | {
 864 | 	PIN_GetLock(&lock, tid+1);
 865 | 	char Path[BUFSIZE];
 866 | 
 867 |     outfilestream << "TID "<<tid<< " Before: " << name << hFile << ", " << lpBuffer << ", " << nNumberOfBytesToRead << ", "<< lpNumberOfBytesRead <<", " << lpOverlapped << hex << endl;
 868 | 	if (WINDOWS::GetFinalPathNameByHandle(hFile, Path, BUFSIZE, 0) < BUFSIZE)
 869 | 	{
 870 | 		outfilestream << "Name: " << Path<<endl;
 871 | 		string tempstr(Path);
 872 | 		if (tempstr.find(inputfilename) != string::npos)
 873 | 		{
 874 | 		// assign buffer and number of bytes read
 875 | 		// set received read as true
 876 | 		}
 877 | 	}
 878 | 
 879 | 	PIN_ReleaseLock(&lock);
 880 | }
 881 | 
 882 | VOID AfterReadFile(THREADID tid, CHAR * name, ADDRINT ret)
 883 | {
 884 | 	PIN_GetLock(&lock, tid+1);
 885 | 
 886 |     outfilestream << "TID "<<tid<< " After: " << name << "  returns " << hex << ret << endl;
 887 | 	
 888 | 	// if got read
 889 | 		// set tainted memory
 890 | 	
 891 | 	PIN_ReleaseLock(&lock);
 892 | }
 893 | 
 894 | pair<unsigned int, unsigned int> StackRange(CONTEXT *ctx)
 895 | {
 896 | 	unsigned int fs = (unsigned int)PIN_GetContextReg(ctx, REG_SEG_FS_BASE);
 897 | 	unsigned int topofstack = *(unsigned int *)(fs +4);
 898 | 	unsigned int bottomofstack = *(unsigned int *)(fs + 8);
 899 | 	return make_pair<unsigned int, unsigned int>(topofstack, bottomofstack);
 900 | }
 901 | 
 902 | void UnwindStack(CONTEXT *ctx)
 903 | {
 904 | 	pair<unsigned int, unsigned int> stackrange = StackRange(ctx);
 905 | 	unsigned int ebpframe = (unsigned int)PIN_GetContextReg(ctx, REG_EBP);
 906 | 	unsigned int top = get<0>(stackrange);
 907 | 	unsigned int bottom = get<1>(stackrange);
 908 | 	outfilestream << "Stack Trace: " << ebpframe<<endl;
 909 | 	
 910 | 	while(ebpframe)
 911 | 	{
 912 | 		if (ebpframe & 3)
 913 | 			break; // not dword aligned
 914 | 		unsigned int returnaddr = *(unsigned int *)(ebpframe + 4);
 915 | 		PIN_LockClient();
 916 | 		IMG frameimage = IMG_FindByAddress(returnaddr);
 917 | 		string framertn = RTN_FindNameByAddress(returnaddr);
 918 | 		PIN_UnlockClient();
 919 | 		string imgname;
 920 | 		outfilestream <<"Return address: " << returnaddr<< " ";
 921 | 		if (IMG_Valid(frameimage))
 922 | 		{
 923 | 			imgname = IMG_Name(frameimage);
 924 | 			outfilestream << "Image: " << imgname << " ";
 925 | 		}
 926 | 		else
 927 | 		{
 928 | 			outfilestream<< "image invalid "<<" ";
 929 | 			break; // image invalid
 930 | 		}
 931 | 		outfilestream << "RTN: " << framertn<<endl;
 932 | 		
 933 | 		unsigned int nextframe = *(unsigned int *)(ebpframe);
 934 | 		if (nextframe <= ebpframe)
 935 | 			break; // next frame is lower than this one
 936 | 		ebpframe = nextframe;
 937 | 	}
 938 | }
 939 | 
 940 | VOID BeforeNtReadFile(THREADID tid, CHAR * name, WINDOWS::HANDLE FileHandle, WINDOWS::HANDLE Event, WINDOWS::PIO_APC_ROUTINE ApcRoutine, 
 941 | 	WINDOWS::PVOID ApcContext, WINDOWS::PIO_STATUS_BLOCK IoStatusBlock, WINDOWS::PVOID Buffer, WINDOWS::ULONG Length, WINDOWS::PLARGE_INTEGER ByteOffset, WINDOWS::PULONG Key)
 942 | {
 943 | 	PIN_GetLock(&lock, tid+1);
 944 | 
 945 |    	char Path[BUFSIZE];
 946 | 
 947 | 	outfilestream << "TID "<< tid<< " Before: " << name<<  " FileHandle: " <<FileHandle << " Event: " <<Event<< " ApcRoutine: " << ApcRoutine << " ApcContext: " << ApcContext
 948 | 				<< " IoStatusBlock: "<< IoStatusBlock << " Buffer: " << Buffer << " Length: "<<Length<< " ByteOffset: "	<< ByteOffset << " Key: "<< Key << endl;
 949 | 	if (ByteOffset)
 950 | 	{
 951 | 		outfilestream << "*ByteOffset: " << ByteOffset->QuadPart <<endl;
 952 | 	}
 953 | 	if (WINDOWS::GetFinalPathNameByHandle(FileHandle, Path, BUFSIZE, 0) < BUFSIZE)
 954 | 	{
 955 | 		outfilestream << "Name: " << Path<<endl;
 956 | 		string tempstr(Path);
 957 | 		if (tempstr.find(inputfilename) != string::npos)
 958 | 		{
 959 | 			if (treadinfo[tid])
 960 | 				delete treadinfo[tid];
 961 | 			struct readinfo *tem = new readinfo;
 962 | 			tem->gotread=true;
 963 | 			if (ByteOffset)
 964 | 				tem->offset = ByteOffset->QuadPart;
 965 | 			else
 966 | 				tem->offset = 0;
 967 | 			tem->Iosb = IoStatusBlock;
 968 | 			tem->buffer = (unsigned int)Buffer;
 969 | 			treadinfo[tid]=tem;
 970 | 		}
 971 | 	}
 972 | 	PIN_ReleaseLock(&lock);
 973 | }
 974 | 
 975 | VOID AfterNtReadFile(THREADID tid, CHAR * name, ADDRINT ret)
 976 | {
 977 | 	PIN_GetLock(&lock, tid+1);
 978 | 	outfilestream << "After: " << name << "  returns " << hex << ret << endl;
 979 | 	if (ret==0 && treadinfo[tid] && treadinfo[tid]->gotread)
 980 | 	{
 981 | 		outfilestream << "Read on tid: " << tid<<endl;
 982 | 		treadinfo[tid]->gotread = false;
 983 | 		if (treadinfo[tid]->Iosb->Information > 0) // if read length is greater than 0
 984 | 		{
 985 | 			outfilestream << "File offset: " << treadinfo[tid]->offset<<endl;
 986 | 			outfilestream << "Read status: " << treadinfo[tid]->Iosb->Status<<endl;
 987 | 			outfilestream << "Read length: " << treadinfo[tid]->Iosb->Information<<endl;
 988 | 			outfilestream << "Read data: " << (char *)treadinfo[tid]->buffer<<endl;
 989 | 			for (unsigned int i=0; i <  treadinfo[tid]->Iosb->Information ;i++) 
 990 | 			{
 991 | 				if (taintedmem.find( (unsigned int)treadinfo[tid]->buffer + i) == taintedmem.end()) 
 992 | 					taintedmem.insert(pair<unsigned int, taintedmeminfo *>(treadinfo[tid]->buffer+i, new taintedmeminfo));
 993 | 					
 994 | 				taintedmem[(unsigned int) treadinfo[tid]->buffer+i]->value = *(uint8_t *)treadinfo[tid]->buffer+i;
 995 | 			}
 996 | 			begintaint=true;
 997 | 		}
 998 | 	}
 999 | 	PIN_ReleaseLock(&lock);
1000 | }
1001 | 
1002 | VOID BeforeIsDebuggerPresent(THREADID tid,CHAR * name) 
1003 | {
1004 |    PIN_GetLock(&lock, tid+1);
1005 | 
1006 |     outfilestream << "TID "<<tid<< " Before: " << name << endl;
1007 | 
1008 | 	PIN_ReleaseLock(&lock);
1009 | }
1010 | 
1011 | VOID AfterIsDebuggerPresent(THREADID tid, CHAR * name, ADDRINT ret, CONTEXT *ctx)
1012 | {
1013 | 	PIN_GetLock(&lock, tid+1);
1014 | 	unsigned int eax = (unsigned int)PIN_GetContextReg(ctx, REG_EAX);
1015 | 	unsigned int eip = (unsigned int)PIN_GetContextReg(ctx, REG_EIP);
1016 | 
1017 |     outfilestream << "After: " << name << "  returns " << hex << ret << " EAX: " <<eax<< " EIP: " <<eip<< " replacement function failed" << endl;
1018 | 
1019 | 	PIN_ReleaseLock(&lock);
1020 | 	PIN_SetContextReg(ctx, REG_EAX, 0);
1021 | 	PIN_ExecuteAt((const CONTEXT *)ctx);
1022 | }   
1023 | 
1024 | WINDOWS::BOOL MyIsDebuggerPresent(THREADID tid, AFUNPTR orig)
1025 | {
1026 | 	PIN_GetLock(&lock, tid+1);
1027 | 	outfilestream << "MyIsDebuggerPresent: " << "TID: " << tid << " Original function: " <<orig<<endl;
1028 | 	PIN_ReleaseLock(&lock);
1029 | 	return 0;
1030 | }
1031 | 
1032 | void UnTaintWrittenMemory(THREADID tid)
1033 | {
1034 | 	set<unsigned int>::iterator writtenmemit;
1035 | 	for (writtenmemit=threadinfo[tid]->memoryaddresseswritten.begin();writtenmemit != threadinfo[tid]->memoryaddresseswritten.end();writtenmemit++)
1036 | 	{
1037 | 		map<unsigned int, taintedmeminfo *>::iterator taintedit;	
1038 | 		taintedit = taintedmem.find(*writtenmemit);
1039 | 		//if it's in the tainted set, remove it
1040 | 		if (taintedit != taintedmem.end())
1041 | 		{
1042 | 			delete taintedmem[taintedit->first];
1043 | 			taintedmem.erase(taintedit);
1044 | 		}
1045 | 	}
1046 | }
1047 | 
1048 | void TaintWrittenMemory(THREADID tid)
1049 | {
1050 | 	set<unsigned int>::iterator writtenmemit;
1051 | 	for (writtenmemit=threadinfo[tid]->memoryaddresseswritten.begin();writtenmemit != threadinfo[tid]->memoryaddresseswritten.end();writtenmemit++)
1052 | 	{
1053 | 		if (taintedmem.find(*writtenmemit) == taintedmem.end())
1054 | 		{	
1055 | 			taintedmem.insert(pair<unsigned int, taintedmeminfo *>(*writtenmemit, new taintedmeminfo));			
1056 | 		}
1057 | 		taintedmem[*writtenmemit]->value = *(uint8_t *)(*writtenmemit);	
1058 | 	}
1059 | }
1060 | 
1061 | string TaintedAndReadMemoryToString(THREADID tid)
1062 | {
1063 | 	stringstream result;
1064 | 	set<unsigned int>::iterator readmemit;
1065 | 	for (readmemit=threadinfo[tid]->memoryaddressesread.begin();readmemit != threadinfo[tid]->memoryaddressesread.end();readmemit++)
1066 | 	{
1067 | 		result <<hex<< *readmemit << " ";
1068 | 		if ( taintedmem.find(*readmemit) != taintedmem.end())
1069 | 		{
1070 | 			result << "[T] ";
1071 | 		}
1072 | 		if (dereferencememory)
1073 | 			result << " value "<<hex<< (int) (*(uint8_t *)(*readmemit)) << " ";
1074 | 	}
1075 | 	result << ":";
1076 | 	
1077 | 	return result.str();
1078 | }
1079 | 
1080 | bool IsReadMemoryTainted(THREADID tid)
1081 | {
1082 | 	set<unsigned int>::iterator readmemit;
1083 | 	for (readmemit=threadinfo[tid]->memoryaddressesread.begin();readmemit != threadinfo[tid]->memoryaddressesread.end();readmemit++)
1084 | 	{
1085 | 		if ( taintedmem.find(*readmemit) != taintedmem.end())
1086 | 		{
1087 | 			return true;
1088 | 		}
1089 | 	}
1090 | 	return false;
1091 | }
1092 | 
1093 | bool IsImplicitTainted(THREADID tid)
1094 | {
1095 | 	if (((implicitcount > 0) && canstartimplicit) || implicitcount == -1)
1096 | 	{
1097 | 		//if ((threadinfo[tid]->taintedregs.find(REG_EIP) != threadinfo[tid]->taintedregs.end()))
1098 | 		//{
1099 | 			implicitcount--;
1100 | 			return true;
1101 | 		//}
1102 | 	}
1103 | 	return false;
1104 | }
1105 | 
1106 | VOID Image(IMG img, VOID *v)
1107 | {
1108 | 	if (outfilestream.rdbuf()->in_avail() != 0)
1109 | 	{
1110 | 		outfilestream.flush();
1111 | 		TraceFile << outfilestream.str();
1112 | 		TraceFile.flush();
1113 | 		outfilestream.str("");
1114 | 	}
1115 | 	if (IMG_Valid(img))
1116 | 	{
1117 | 		outfilestream << "Image loaded: " <<IMG_Name(img) << " at "<<IMG_StartAddress(img)<<endl;
1118 | 	}
1119 | 
1120 |     for (SYM sym = IMG_RegsymHead(img); SYM_Valid(sym); sym = SYM_Next(sym))
1121 |     {
1122 |         string function = PIN_UndecorateSymbolName(SYM_Name(sym), UNDECORATION_NAME_ONLY);
1123 | 		
1124 | 		if (!onlyasoracle)
1125 | 		{	
1126 | 			if (checkingip)
1127 | 			{
1128 | 				if (function == "recv")
1129 | 				{
1130 | 					RTN recvRtn = RTN_FindByAddress(IMG_LowAddress(img) + SYM_Value(sym));
1131 | 					
1132 | 					if (RTN_Valid(recvRtn))
1133 | 					{
1134 | 						outfilestream<<"Recv loaded"<<endl;
1135 | 						RTN_Open(recvRtn);
1136 | 						
1137 | 						RTN_InsertCall(recvRtn, IPOINT_BEFORE, (AFUNPTR)BeforeRecv,
1138 | 												IARG_THREAD_ID,
1139 | 												IARG_ADDRINT, "recv",
1140 | 												IARG_FUNCARG_ENTRYPOINT_VALUE, 0,
1141 | 												IARG_FUNCARG_ENTRYPOINT_VALUE, 1,
1142 | 												IARG_FUNCARG_ENTRYPOINT_VALUE, 2,
1143 | 												IARG_FUNCARG_ENTRYPOINT_VALUE, 3,
1144 | 												IARG_END);
1145 | 						RTN_InsertCall(recvRtn, IPOINT_AFTER, (AFUNPTR)AfterRecv,
1146 | 												IARG_THREAD_ID,
1147 | 												IARG_ADDRINT, "recv",
1148 | 												IARG_FUNCRET_EXITPOINT_VALUE,
1149 | 												IARG_END);
1150 | 						RTN_Close(recvRtn);
1151 | 					}
1152 | 				} 
1153 | 			}
1154 | 			
1155 | 			/*
1156 | 			if (function == "ReadFile")
1157 | 			{
1158 | 				RTN readfileRtn = RTN_FindByAddress(IMG_LowAddress(img) + SYM_Value(sym));
1159 | 				
1160 | 				if (RTN_Valid(readfileRtn))
1161 | 				{
1162 | 					outfilestream<<"ReadFile loaded"<<endl;
1163 | 					RTN_Open(readfileRtn);
1164 | 					
1165 | 					RTN_InsertCall(readfileRtn, IPOINT_BEFORE, (AFUNPTR)BeforeReadFile,
1166 | 											IARG_THREAD_ID,
1167 | 											IARG_ADDRINT, "ReadFile",
1168 | 											IARG_FUNCARG_ENTRYPOINT_VALUE, 0,
1169 | 											IARG_FUNCARG_ENTRYPOINT_VALUE, 1,
1170 | 											IARG_FUNCARG_ENTRYPOINT_VALUE, 2,
1171 | 											IARG_FUNCARG_ENTRYPOINT_VALUE, 3,
1172 | 											IARG_FUNCARG_ENTRYPOINT_VALUE, 4,
1173 | 											IARG_END);
1174 | 					RTN_InsertCall(readfileRtn, IPOINT_AFTER, (AFUNPTR)AfterReadFile,
1175 | 											IARG_THREAD_ID,
1176 | 											IARG_ADDRINT, "ReadFile",
1177 | 											IARG_FUNCRET_EXITPOINT_VALUE,
1178 | 											IARG_END);
1179 | 					RTN_Close(readfileRtn);
1180 | 				}
1181 | 			}
1182 | 			*/
1183 | 			if (!checkingip)
1184 | 			{
1185 | 				if (function == "ZwReadFile")
1186 | 				{
1187 | 					RTN readfileRtn = RTN_FindByAddress(IMG_LowAddress(img) + SYM_Value(sym));
1188 | 					
1189 | 					if (RTN_Valid(readfileRtn))
1190 | 					{
1191 | 						outfilestream<<"ZwReadFile loaded"<<endl;
1192 | 						RTN_Open(readfileRtn);
1193 | 						
1194 | 						RTN_InsertCall(readfileRtn, IPOINT_BEFORE, (AFUNPTR)BeforeNtReadFile,
1195 | 													IARG_THREAD_ID,
1196 | 													IARG_ADDRINT, "ZwReadFile",
1197 | 													IARG_FUNCARG_ENTRYPOINT_VALUE, 0,
1198 | 													IARG_FUNCARG_ENTRYPOINT_VALUE, 1,
1199 | 													IARG_FUNCARG_ENTRYPOINT_VALUE, 2,
1200 | 													IARG_FUNCARG_ENTRYPOINT_VALUE, 3,
1201 | 													IARG_FUNCARG_ENTRYPOINT_VALUE, 4,
1202 | 													IARG_FUNCARG_ENTRYPOINT_VALUE, 5,
1203 | 													IARG_FUNCARG_ENTRYPOINT_VALUE, 6,
1204 | 													IARG_FUNCARG_ENTRYPOINT_VALUE, 7,
1205 | 													IARG_FUNCARG_ENTRYPOINT_VALUE, 8,
1206 | 													IARG_END);
1207 | 						RTN_InsertCall(readfileRtn, IPOINT_AFTER, (AFUNPTR)AfterNtReadFile,
1208 | 													IARG_THREAD_ID,
1209 | 													IARG_ADDRINT, "ZwReadFile",
1210 | 													IARG_FUNCRET_EXITPOINT_VALUE,
1211 | 													IARG_END);
1212 | 						
1213 | 						RTN_Close(readfileRtn);
1214 | 					}
1215 | 				}		
1216 | 			}
1217 | 			/*
1218 | 			if (function == "WSARecv")
1219 | 			{
1220 | 				RTN recvRtn = RTN_FindByAddress(IMG_LowAddress(img) + SYM_Value(sym));
1221 | 				
1222 | 				if (RTN_Valid(recvRtn))
1223 | 				{
1224 | 					outfilestream<<"WSARecv loaded"<<endl;
1225 | 					RTN_Open(recvRtn);
1226 | 					
1227 | 					RTN_InsertCall(recvRtn, IPOINT_BEFORE, (AFUNPTR)BeforeWSARecv,
1228 | 											IARG_ADDRINT, "WSARecv",
1229 | 											IARG_THREAD_ID,
1230 | 											IARG_FUNCARG_ENTRYPOINT_VALUE, 0,
1231 | 											IARG_FUNCARG_ENTRYPOINT_VALUE, 1,
1232 | 											IARG_FUNCARG_ENTRYPOINT_VALUE, 2,
1233 | 											IARG_FUNCARG_ENTRYPOINT_VALUE, 3,
1234 | 											IARG_FUNCARG_ENTRYPOINT_VALUE, 4,
1235 | 											IARG_FUNCARG_ENTRYPOINT_VALUE, 5,
1236 | 											IARG_FUNCARG_ENTRYPOINT_VALUE, 6,
1237 | 											IARG_END);
1238 | 					RTN_InsertCall(recvRtn, IPOINT_AFTER, (AFUNPTR)AfterWSARecv,
1239 | 											IARG_THREAD_ID,
1240 | 											IARG_ADDRINT, "WSARecv",
1241 | 											IARG_FUNCRET_EXITPOINT_VALUE,
1242 | 											IARG_END);	
1243 | 					RTN_Close(recvRtn);
1244 | 				}
1245 | 			}
1246 | 			*/
1247 | 		}
1248 | 		
1249 | 		if (function == "UnhandledExceptionFilter")
1250 | 		{
1251 | 			RTN raiseexcept = RTN_FindByAddress(IMG_LowAddress(img) + SYM_Value(sym));
1252 | 			if (RTN_Valid(raiseexcept))
1253 | 			{	
1254 | 				outfilestream << "UnhandledExceptionFilter loaded"<<endl;
1255 | 				RTN_Open(raiseexcept);
1256 | 				RTN_InsertCall(raiseexcept, IPOINT_BEFORE, (AFUNPTR)BeforeUnhandledExceptionFilter,
1257 | 											IARG_THREAD_ID,
1258 | 											IARG_ADDRINT, "UnhandledExceptionFilter",
1259 | 											IARG_FUNCARG_ENTRYPOINT_VALUE, 0,	
1260 | 											IARG_END);
1261 | 				RTN_Close(raiseexcept);
1262 | 			}
1263 | 		}
1264 | 		
1265 | 		/*
1266 | 		if (function == "IsDebuggerPresent")
1267 |         {
1268 |             RTN isdebuggerpresent = RTN_FindByAddress(IMG_LowAddress(img) + SYM_Value(sym));
1269 |             PROTO proto = PROTO_Allocate(PIN_PARG(WINDOWS::BOOL), CALLINGSTD_DEFAULT, "MyIsDebuggerPresent", PIN_PARG_END());
1270 |             if (RTN_Valid(isdebuggerpresent))
1271 |             {
1272 | 				outfilestream<<"IsDebuggerPresent loaded, instrumenting, and replacing"<<endl;
1273 |                 RTN_Open(isdebuggerpresent);
1274 |                 
1275 |                 RTN_InsertCall(isdebuggerpresent, IPOINT_BEFORE, (AFUNPTR)BeforeIsDebuggerPresent,
1276 | 													IARG_THREAD_ID,
1277 | 													IARG_ADDRINT, "IsDebuggerPresent",
1278 | 													IARG_END);
1279 |                 RTN_InsertCall(isdebuggerpresent, IPOINT_AFTER, (AFUNPTR)AfterIsDebuggerPresent,
1280 | 													IARG_THREAD_ID,
1281 | 													IARG_ADDRINT, "IsDebuggerPresent",
1282 | 													IARG_FUNCRET_EXITPOINT_VALUE,
1283 | 													IARG_CONTEXT,
1284 | 													IARG_END);
1285 |                 
1286 |                 RTN_Close(isdebuggerpresent);
1287 | 				AFUNPTR old = RTN_ReplaceSignature(isdebuggerpresent, AFUNPTR(MyIsDebuggerPresent), IARG_PROTOTYPE, proto, IARG_THREAD_ID, IARG_ORIG_FUNCPTR, IARG_END);	
1288 |             }
1289 | 			PROTO_Free(proto);
1290 |         }
1291 | 		*/
1292 |     }
1293 | }
1294 | 
1295 | VOID BuildMemRead(unsigned int addr, unsigned int size, THREADID tid)
1296 | {
1297 | 	PIN_GetLock(&lock, tid+1);
1298 | 	for (unsigned int i = addr; i<addr + size;i++)
1299 | 	{
1300 | 		threadinfo[tid]->memoryaddressesread.insert(i);
1301 | 	}
1302 | 	
1303 | 	PIN_ReleaseLock(&lock);
1304 | }
1305 | 
1306 | VOID BuildReadReg(THREADID tid, REG reg)
1307 | {
1308 | 	PIN_GetLock(&lock, tid+1);
1309 | 	
1310 | 	threadinfo[tid]->readreg.insert(reg);
1311 | 	threadinfo[tid]->addRegs(reg, true);
1312 | 	
1313 | 	PIN_ReleaseLock(&lock);
1314 | }
1315 | 
1316 | VOID BuildWrittenMemory(unsigned int addr, unsigned int size, THREADID tid)
1317 | {
1318 | 	PIN_GetLock(&lock, tid+1);
1319 | 	for (unsigned int i = addr; i < addr + size;i++)
1320 | 	{
1321 | 		threadinfo[tid]->memoryaddresseswritten.insert(i);
1322 | 	}
1323 | 	PIN_ReleaseLock(&lock);
1324 | }
1325 | 
1326 | VOID BuildWrittenReg(unsigned int addr, THREADID tid, REG reg)
1327 | {
1328 | 	PIN_GetLock(&lock, tid+1);
1329 | 	threadinfo[tid]->writtenreg.insert(reg);
1330 | 	threadinfo[tid]->addRegs(reg, false);
1331 | 	
1332 | 	PIN_ReleaseLock(&lock);
1333 | }
1334 | 
1335 | VOID Taint(THREADID tid, unsigned int ip, const CONTEXT *ctx)
1336 | {
1337 | 	PIN_GetLock(&lock, tid+1);
1338 | 		
1339 | 	if (IsReadMemoryTainted(tid) || threadinfo[tid]->IsReadRegistersTainted() || threadinfo[tid]->IsReadFlagsTainted() || IsImplicitTainted(tid))
1340 | 	{
1341 | 		threadinfo[tid]->istainted=true;
1342 | 		outfilestream << "TID: " <<hex<< tid;
1343 | 		outfilestream << ":IP: " <<hex<< ip;
1344 | 		outfilestream << ":Disasm " << threadinfo[tid]->instmap;
1345 | 		outfilestream << ":IMG: " << threadinfo[tid]->ImgToString();
1346 | 		outfilestream << ":RTN: " << threadinfo[tid]->RtnToString();
1347 | 		outfilestream << ":Read Regs: " << threadinfo[tid]->TaintedAndReadRegsToString(ctx);
1348 | 		outfilestream << ":Read Flags: " << threadinfo[tid]->TaintedAndReadFlagsToString(ctx);
1349 | 		outfilestream << ":Read Memory: "<< TaintedAndReadMemoryToString(tid) <<endl;	
1350 | 	//	outfilestream << ":Written Regs: " << threadinfo[tid]->TaintedAndWrittenRegsToString(ctx) <<endl;
1351 | 		
1352 | 		TaintWrittenMemory(tid);
1353 | 		threadinfo[tid]->TaintWrittenFlags(); // will update flag values after instruction is executed
1354 | 		threadinfo[tid]->TaintWrittenRegisters(ctx);
1355 | 	}
1356 | 	else
1357 | 	{
1358 | 		UnTaintWrittenMemory(tid);
1359 | 		threadinfo[tid]->UnTaintWrittenFlags();
1360 | 		threadinfo[tid]->UnTaintWrittenRegs();
1361 | 	}
1362 | 	
1363 | 	if (outfilestream.rdbuf()->in_avail() != 0)
1364 | 	{
1365 | 		outfilestream.flush();
1366 | 		TraceFile << outfilestream.str();
1367 | 		TraceFile.flush();
1368 | 		outfilestream.str("");
1369 | 	}
1370 | 	
1371 | 	PIN_ReleaseLock(&lock);
1372 | }
1373 | 
1374 | VOID RegWriteAfter(THREADID tid,const CONTEXT *ctx)
1375 | {
1376 | 	PIN_GetLock(&lock, tid+1);
1377 | 	
1378 | 	threadinfo[tid]->UpdateTaintedWrittenFlagsValues(ctx);
1379 | 
1380 | 	PIN_ReleaseLock(&lock);
1381 | }
1382 | 
1383 | VOID cleanAndDecode(unsigned int ip, THREADID tid, unsigned int instructionlength)
1384 | {
1385 | 	PIN_GetLock(&lock, tid+1);
1386 | 	
1387 | 	if (outfilestream.rdbuf()->in_avail() != 0)
1388 | 	{
1389 | 		outfilestream.flush();
1390 | 		TraceFile << outfilestream.str();
1391 | 		TraceFile.flush();
1392 | 		outfilestream.str("");
1393 | 	}
1394 | 	
1395 | 	threadinfo[tid]->clean();
1396 | 	
1397 | 	PIN_LockClient();
1398 | 	threadinfo[tid]->img = IMG_FindByAddress(ip);
1399 | 	threadinfo[tid]->rtn = RTN_FindByAddress(ip);
1400 | 	PIN_UnlockClient();
1401 | 	
1402 | 	threadinfo[tid]->setInstructionTextOpcodes(ip, instructionlength);
1403 | 	
1404 | 	if (threadinfo[tid]->decodeInstruction(instructionlength))
1405 | 	{	
1406 | 		//outfilestream << "decoded ok ";
1407 | 		if (threadinfo[tid]->disassembleInst(ip))
1408 | 		{
1409 | 		//	outfilestream << "disassembly ok";
1410 | 			// decoded fine
1411 | 		}
1412 | 		threadinfo[tid]->setFlags(ip);
1413 | 	}
1414 | 	
1415 | 	PIN_ReleaseLock(&lock);
1416 | }
1417 | 
1418 | //for each instruction
1419 | VOID EachInstruction(INS ins, VOID *v)
1420 | {
1421 | 	if (begintaint) 
1422 | 	{ 
1423 | 		INS_InsertCall(
1424 | 				ins, 
1425 | 				IPOINT_BEFORE, 
1426 | 				(AFUNPTR)cleanAndDecode, 
1427 | 				IARG_INST_PTR,
1428 | 				IARG_THREAD_ID, 
1429 | 				IARG_UINT32, 
1430 | 				INS_Size(ins),
1431 | 				IARG_END);
1432 | 	
1433 | 		UINT32 memOperands = INS_MemoryOperandCount(ins);
1434 | 		//build memory read, reg read, memory write, reg write	
1435 | 		for (UINT32 memOp = 0; memOp < memOperands; memOp++)
1436 | 		{   
1437 | 			if (INS_MemoryOperandIsRead(ins, memOp))
1438 | 			{   
1439 | 				INS_InsertPredicatedCall(
1440 | 					ins, 
1441 | 					IPOINT_BEFORE, 
1442 | 					(AFUNPTR)BuildMemRead,
1443 | 					IARG_MEMORYOP_EA, 
1444 | 					memOp,
1445 | 					IARG_MEMORYREAD_SIZE,
1446 | 					IARG_THREAD_ID,
1447 | 					IARG_END);
1448 | 			}   
1449 | 		}
1450 | 		
1451 | 		//Build read registers
1452 | 		// Handle Stack pointer read on push?
1453 | 		for (UINT32 r=0; r<INS_MaxNumRRegs(ins);r++) 
1454 | 		{
1455 | 				// REG c = INS_RegR(ins, r);	
1456 | 				// There is read EIP on branch/call instructions
1457 | 				// may need to reverse this
1458 | 				if (!(INS_IsBranchOrCall(ins) && (INS_RegR(ins, r) == REG_EIP || INS_RegR(ins, r) == REG_IP)))
1459 | 				{					
1460 | 					INS_InsertCall(
1461 | 					ins, IPOINT_BEFORE, 
1462 | 					(AFUNPTR)BuildReadReg,
1463 | 					IARG_THREAD_ID,
1464 | 					IARG_UINT32,
1465 | 					INS_RegR(ins, r),
1466 | 					IARG_END);
1467 | 				}
1468 | 		}
1469 | 
1470 | 		//Build written memory
1471 | 		for (UINT32 memOp = 0; memOp < memOperands; memOp++)
1472 | 		{   
1473 | 			if (INS_MemoryOperandIsWritten(ins, memOp))
1474 | 			{   
1475 | 				INS_InsertPredicatedCall(
1476 | 							ins, 
1477 | 							IPOINT_BEFORE, 
1478 | 							(AFUNPTR)BuildWrittenMemory,
1479 | 							IARG_MEMORYOP_EA, 
1480 | 							memOp,
1481 | 							IARG_MEMORYWRITE_SIZE,
1482 | 							IARG_THREAD_ID,
1483 | 							IARG_END);
1484 | 			}
1485 | 		}
1486 | 		
1487 | 		//Build written registers
1488 | 		// Handle Stack pointer written on push?
1489 | 		for (UINT32 r=0; r<INS_MaxNumWRegs(ins);r++)
1490 | 		{
1491 | 			INS_InsertCall(
1492 | 				ins, 
1493 | 				IPOINT_BEFORE, 
1494 | 				(AFUNPTR)BuildWrittenReg,
1495 | 				IARG_INST_PTR,
1496 | 				IARG_THREAD_ID,
1497 | 				IARG_UINT32,
1498 | 				INS_RegW(ins, r),
1499 | 				IARG_END);
1500 | 		}
1501 | 			
1502 | 		// taint
1503 | 		INS_InsertCall(
1504 | 			ins, 
1505 | 			IPOINT_BEFORE, 
1506 | 			(AFUNPTR)Taint,
1507 | 			IARG_THREAD_ID,
1508 | 			IARG_INST_PTR,
1509 | 			IARG_CONST_CONTEXT,
1510 | 			IARG_END);
1511 | 			
1512 | 		//update the tainted values for FLAGS after instruction is executed
1513 | 		if (INS_HasFallThrough(ins))
1514 | 		{
1515 | 			INS_InsertCall(
1516 | 				ins, 
1517 | 				IPOINT_AFTER, 
1518 | 				(AFUNPTR)RegWriteAfter,
1519 | 				IARG_THREAD_ID,
1520 | 				IARG_CONST_CONTEXT,
1521 | 				IARG_END);
1522 | 		}
1523 | 	}
1524 | }
1525 | 
1526 | VOID Fini(INT32 code, VOID *v)
1527 | {
1528 | 	if (outfilestream.rdbuf()->in_avail() != 0)
1529 | 	{
1530 | 		TraceFile << outfilestream.str();
1531 | 		outfilestream.str("");
1532 | 	}
1533 |     TraceFile.close();
1534 | }
1535 | 
1536 | VOID ContextChange(THREADID threadid, CONTEXT_CHANGE_REASON reason, const CONTEXT *from, CONTEXT *to, INT32 info, VOID *v)
1537 | {
1538 |     PIN_GetLock(&lock, threadid+1);
1539 | 	if (outfilestream.rdbuf()->in_avail() != 0)
1540 | 	{
1541 | 		outfilestream.flush();
1542 | 		TraceFile << outfilestream.str();
1543 | 		TraceFile.flush();
1544 | 		outfilestream.str("");
1545 | 	}
1546 | //	outfilestream << "Thread "<<threadid<< ": reason "<<reason<<endl;
1547 | 	switch (reason)
1548 | 	{
1549 | 		case  CONTEXT_CHANGE_REASON_EXCEPTION:
1550 | 			outfilestream << "TID: " << threadid << " Exception reason: " << " Exception code "<<info<< " Value: " << v <<endl;
1551 | 			if ((info == STATUS_ACCESS_VIOLATION) || (info == STATUS_STACK_BUFFER_OVERRUN ))
1552 | 				begintaint=false;
1553 | 			break;
1554 | 		case CONTEXT_CHANGE_REASON_CALLBACK:
1555 | 			break;
1556 | 		case CONTEXT_CHANGE_REASON_APC:
1557 | 			break; 
1558 | 		default:
1559 | 			break;
1560 | 	}
1561 | 
1562 |     PIN_ReleaseLock(&lock);
1563 | }
1564 |    
1565 | INT32 Usage()
1566 | {
1567 |     cerr << "This tool produces a taint trace" << endl;
1568 |     cerr << endl << KNOB_BASE::StringKnobSummary() << endl;
1569 |     return -1;
1570 | }
1571 | 
1572 | VOID timer(void *ar)
1573 | {
1574 | 	WINDOWS::Sleep((WINDOWS::DWORD)ar);
1575 | 	if (outfilestream.rdbuf()->in_avail() != 0)
1576 | 	{
1577 | 		TraceFile << outfilestream.str();
1578 | 		outfilestream.str("");
1579 | 	}
1580 |     TraceFile.close();
1581 | 	PIN_ExitProcess(5);
1582 | }
1583 | 
1584 | /*
1585 | VOID SyscallEntry(THREADID thread_id, CONTEXT *ctx, SYSCALL_STANDARD std, void *v)
1586 | {
1587 | 	PIN_GetLock(&lock, thread_id+1);
1588 | 	if (PIN_GetSyscallNumber(ctx, std) == 0x3) // if read syscall
1589 | 	{
1590 | 		outfilestream << "system call: "<<PIN_GetSyscallNumber(ctx, std)<<", arguments:";
1591 | 		for (int i=0;i<4;i++)
1592 | 		{
1593 | 			unsigned int value = PIN_GetSyscallArgument(ctx, std, i);
1594 | 			outfilestream << value << " ";
1595 | 		} 	 
1596 | 		outfilestream<<endl;
1597 | 		unsigned int buf = PIN_GetSyscallArgument(ctx, std, 1);
1598 | 		outfilestream<<endl;
1599 | 	}
1600 | 	PIN_ReleaseLock(&lock);
1601 | }
1602 | */
1603 | /*
1604 | VOID SyscallExit(THREADID tid, CONTEXT *ctx, SYSCALL_STANDARD std, void *v)
1605 | {
1606 | 	PIN_GetLock(&lock, tid+1);
1607 | 
1608 | 	unsigned int value = PIN_GetSyscallReturn(ctx, std);
1609 | 	outfilestream << "return value: "<<value<<endl;
1610 | 	
1611 | 	PIN_ReleaseLock(&lock);
1612 | }
1613 | */
1614 | 
1615 | int main(int argc, char *argv[])
1616 | {
1617 |     PIN_InitSymbols();
1618 | 	
1619 |     if( PIN_Init(argc,argv) )
1620 |     {
1621 |         return Usage();
1622 |     }
1623 | 
1624 | 	PIN_InitLock(&lock);
1625 | 	unsigned int sleeptime = KnobSleep.Value();
1626 | 	onlyasoracle = KnobOracle.Value();
1627 | 	implicitcount = KnobImplicit.Value();
1628 | 	inputfilename = KnobFileRead.Value();
1629 | 	inputipaddress = KnobNetworkRead.Value();
1630 | 	dereferencememory = KnobDereference.Value();
1631 | 	
1632 | 	if (!inputipaddress.empty())
1633 | 	{
1634 | 		checkingip=true;
1635 | 	}
1636 | 	else if (!inputfilename.empty())
1637 | 	{
1638 | 		checkingip=false;
1639 | 	}
1640 | 	else
1641 | 	{
1642 | 		cerr << "Must set input ipaddress or input filename"<<endl;
1643 | 		return Usage();
1644 | 	}
1645 | 	
1646 | 	xed_tables_init();
1647 | 	xed_state_zero(&xedstate);
1648 | 	xed_state_init2(&xedstate, XED_MACHINE_MODE_LEGACY_32, XED_ADDRESS_WIDTH_32b);
1649 | 	
1650 | 	if (sleeptime)
1651 | 		sleepthreadid = PIN_SpawnInternalThread(timer, (void *)sleeptime, 0, NULL);
1652 | 
1653 |     TraceFile.open(KnobOutputFile.Value().c_str());
1654 |     outfilestream << setw(2) << setfill('0') << hex;
1655 |     TraceFile.setf(ios::showbase);
1656 | 	outfilestream << "sleepthreadid: " <<sleepthreadid<<endl;
1657 |     
1658 |     IMG_AddInstrumentFunction(Image, 0);
1659 |     INS_AddInstrumentFunction(EachInstruction, 0);
1660 |     //PIN_AddSyscallEntryFunction(SyscallEntry, 0); 
1661 |     //PIN_AddSyscallExitFunction(SyscallExit, 0);
1662 | 	PIN_AddThreadStartFunction(ThreadStart, 0); 
1663 |     PIN_AddThreadFiniFunction(ThreadFini, 0);
1664 | 	PIN_AddContextChangeFunction(ContextChange, 0);
1665 |     PIN_AddFiniFunction(Fini, 0);
1666 | 
1667 |     PIN_StartProgram();
1668 |     
1669 |     return 0;
1670 | }


--------------------------------------------------------------------------------
/example-output/vulnserver_trace_localhost.txt:
--------------------------------------------------------------------------------
  1 | sleepthreadid: 0
  2 | Image loaded: C:\Users\sunirge\Downloads\vulnserver\vulnserver.exe at 400000
  3 | Image loaded: C:\Users\sunirge\Downloads\vulnserver\essfunc.dll at 62500000
  4 | Image loaded: C:\Windows\System32\wshtcpip.dll at 74a00000
  5 | Image loaded: C:\Windows\system32\mswsock.dll at 74f00000
  6 | Image loaded: C:\Windows\system32\KERNELBASE.dll at 757f0000
  7 | Image loaded: C:\Windows\system32\user32.dll at 76ad0000
  8 | Image loaded: C:\Windows\system32\IMM32.DLL at 76bf0000
  9 | Image loaded: C:\Windows\system32\USP10.dll at 76ca0000
 10 | Image loaded: C:\Windows\system32\kernel32.dll at 76d40000
 11 | UnhandledExceptionFilter loaded
 12 | Image loaded: C:\Windows\system32\GDI32.dll at 76ec0000
 13 | Image loaded: C:\Windows\system32\MSCTF.dll at 77130000
 14 | Image loaded: C:\Windows\system32\msvcrt.dll at 77200000
 15 | Image loaded: C:\Windows\system32\RPCRT4.dll at 772b0000
 16 | Image loaded: C:\Windows\system32\WS2_32.DLL at 77360000
 17 | Recv loaded
 18 | Image loaded: C:\Windows\SYSTEM32\ntdll.dll at 774d0000
 19 | Image loaded: C:\Windows\system32\LPK.dll at 77620000
 20 | Image loaded: C:\Windows\system32\NSI.dll at 776f0000
 21 | thread begin 0
 22 | thread end 0 code 0
 23 | thread begin 1
 24 | thread begin 2
 25 | TID 2 Before: recv 7c, 5c3508, 1000, 0
 26 | Peer name: 127.0.0.1
 27 | Input IP address equals peer name, tainting 
 28 | TID: 2 After: recv  returns 5
 29 | Recv on tid: 2
 30 | Read length: 5
 31 | Read data: HELP
 32 | 
 33 | TID: 2:IP: 772101d5:Disasm mov dl, byte ptr [eax]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eax: 5c3508: ds: 23: al: 5c3508: ah: 5c3508: ax: 5c3508: :Read Flags: :Read Memory: 5c3508 [T] :
 34 | TID: 2:IP: 772101dd:Disasm test dl, dl:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: edx[T]: 48: dl[T]: 48: dx[T]: 48: :Read Flags: :Read Memory: :
 35 | TID: 2:IP: 772101df:Disasm jz 0x77210218:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eflags[T]: 206: :Read Flags: 0:[T 40:zf ]:Values:206:Read Memory: :
 36 | TID: 2:IP: 772101e1:Disasm cmp dl, byte ptr [ecx-0x4]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: edx[T]: 48: ecx: 404248: ds: 23: cl: 404248: ch: 404248: cx: 404248: dl[T]: 48: dx[T]: 48: :Read Flags: :Read Memory: 404244 :
 37 | TID: 2:IP: 772101e4:Disasm jnz 0x77210218:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
 38 | TID: 2:IP: 772101e6:Disasm mov dl, byte ptr [eax-0x3]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eax: 5c350c: ds: 23: al: 5c350c: ah: 5c350c: ax: 5c350c: :Read Flags: :Read Memory: 5c3509 [T] :
 39 | TID: 2:IP: 772101e9:Disasm test dl, dl:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: edx[T]: 45: dl[T]: 45: dx[T]: 45: :Read Flags: :Read Memory: :
 40 | TID: 2:IP: 772101eb:Disasm jz 0x77210225:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eflags[T]: 202: :Read Flags: 0:[T 40:zf ]:Values:202:Read Memory: :
 41 | TID: 2:IP: 772101ed:Disasm cmp dl, byte ptr [ecx-0x3]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: edx[T]: 45: ecx: 404248: ds: 23: cl: 404248: ch: 404248: cx: 404248: dl[T]: 45: dx[T]: 45: :Read Flags: :Read Memory: 404245 :
 42 | TID: 2:IP: 772101f0:Disasm jnz 0x77210225:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
 43 | TID: 2:IP: 772101f2:Disasm mov dl, byte ptr [eax-0x2]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eax: 5c350c: ds: 23: al: 5c350c: ah: 5c350c: ax: 5c350c: :Read Flags: :Read Memory: 5c350a [T] :
 44 | TID: 2:IP: 772101f5:Disasm test dl, dl:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: edx[T]: 4c: dl[T]: 4c: dx[T]: 4c: :Read Flags: :Read Memory: :
 45 | TID: 2:IP: 772101f7:Disasm jz 0x7721023f:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eflags[T]: 202: :Read Flags: 0:[T 40:zf ]:Values:202:Read Memory: :
 46 | TID: 2:IP: 772101f9:Disasm cmp dl, byte ptr [ecx-0x2]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: edx[T]: 4c: ecx: 404248: ds: 23: cl: 404248: ch: 404248: cx: 404248: dl[T]: 4c: dx[T]: 4c: :Read Flags: :Read Memory: 404246 :
 47 | TID: 2:IP: 772101fc:Disasm jnz 0x7721023f:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
 48 | TID: 2:IP: 772101fe:Disasm mov dl, byte ptr [eax-0x1]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eax: 5c350c: ds: 23: al: 5c350c: ah: 5c350c: ax: 5c350c: :Read Flags: :Read Memory: 5c350b [T] :
 49 | TID: 2:IP: 77210201:Disasm test dl, dl:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: edx[T]: 50: dl[T]: 50: dx[T]: 50: :Read Flags: :Read Memory: :
 50 | TID: 2:IP: 77210203:Disasm jz 0x77210232:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eflags[T]: 206: :Read Flags: 0:[T 40:zf ]:Values:206:Read Memory: :
 51 | TID: 2:IP: 77210205:Disasm cmp dl, byte ptr [ecx-0x1]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: edx[T]: 50: ecx: 404248: ds: 23: cl: 404248: ch: 404248: cx: 404248: dl[T]: 50: dx[T]: 50: :Read Flags: :Read Memory: 404247 :
 52 | TID: 2:IP: 77210208:Disasm jnz 0x77210232:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
 53 | TID: 2:IP: 7720b46e:Disasm mov dl, byte ptr [eax]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: eax: 5c350c: ds: 23: al: 5c350c: ah: 5c350c: ax: 5c350c: :Read Flags: :Read Memory: 5c350c [T] :
 54 | TID: 2:IP: 7720b470:Disasm test dl, dl:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: edx[T]: a: dl[T]: a: dx[T]: a: :Read Flags: :Read Memory: :
 55 | TID: 2:IP: 7720b472:Disasm jz 0x7720b478:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: eflags[T]: 206: :Read Flags: 0:[T 40:zf ]:Values:206:Read Memory: :
 56 | TID: 2:IP: 7720b474:Disasm cmp dl, byte ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: edx[T]: a: ecx: 404248: ds: 23: cl: 404248: ch: 404248: cx: 404248: dl[T]: a: dx[T]: a: :Read Flags: :Read Memory: 404248 :
 57 | TID: 2:IP: 7720b476:Disasm jz 0x7720b484:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: eflags[T]: 283: :Read Flags: 0:[T 40:zf ]:Values:283:Read Memory: :
 58 | TID: 2:IP: 7720b478:Disasm movzx eax, byte ptr [eax]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: eax: 5c350c: ds: 23: al: 5c350c: ah: 5c350c: ax: 5c350c: :Read Flags: :Read Memory: 5c350c [T] :
 59 | TID: 2:IP: 7720b47e:Disasm sub eax, ecx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: ecx: 20: eax[T]: a: al[T]: a: ah[T]: a: ax[T]: a: cl: 20: ch: 20: cx: 20: :Read Flags: :Read Memory: :
 60 | TID: 2:IP: 401989:Disasm test eax, eax:IMG: C:\Users\sunirge\Downloads\vulnserver\vulnserver.exe:RTN: unnamedImageEntryPoint:Read Regs: eax[T]: ffffffea: al[T]: ffffffea: ah[T]: ffffffea: ax[T]: ffffffea: :Read Flags: :Read Memory: :
 61 | TID: 2:IP: 40198b:Disasm jnz 0x4019d6:IMG: C:\Users\sunirge\Downloads\vulnserver\vulnserver.exe:RTN: unnamedImageEntryPoint:Read Regs: eflags[T]: 282: :Read Flags: 0:[T 40:zf ]:Values:282:Read Memory: :
 62 | TID: 2:IP: 7720b46e:Disasm mov dl, byte ptr [eax]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: eax: 5c3508: ds: 23: al: 5c3508: ah: 5c3508: ax: 5c3508: :Read Flags: :Read Memory: 5c3508 [T] :
 63 | TID: 2:IP: 7720b470:Disasm test dl, dl:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: edx[T]: 48: dl[T]: 48: dx[T]: 48: :Read Flags: :Read Memory: :
 64 | TID: 2:IP: 7720b472:Disasm jz 0x7720b478:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: eflags[T]: 206: :Read Flags: 0:[T 40:zf ]:Values:206:Read Memory: :
 65 | TID: 2:IP: 7720b474:Disasm cmp dl, byte ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: edx[T]: 48: ecx: 40427c: ds: 23: cl: 40427c: ch: 40427c: cx: 40427c: dl[T]: 48: dx[T]: 48: :Read Flags: :Read Memory: 40427c :
 66 | TID: 2:IP: 7720b476:Disasm jz 0x7720b484:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
 67 | TID: 2:IP: 7720b46e:Disasm mov dl, byte ptr [eax]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: eax: 5c3509: ds: 23: al: 5c3509: ah: 5c3509: ax: 5c3509: :Read Flags: :Read Memory: 5c3509 [T] :
 68 | TID: 2:IP: 7720b470:Disasm test dl, dl:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: edx[T]: 45: dl[T]: 45: dx[T]: 45: :Read Flags: :Read Memory: :
 69 | TID: 2:IP: 7720b472:Disasm jz 0x7720b478:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: eflags[T]: 202: :Read Flags: 0:[T 40:zf ]:Values:202:Read Memory: :
 70 | TID: 2:IP: 7720b474:Disasm cmp dl, byte ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: edx[T]: 45: ecx: 40427d: ds: 23: cl: 40427d: ch: 40427d: cx: 40427d: dl[T]: 45: dx[T]: 45: :Read Flags: :Read Memory: 40427d :
 71 | TID: 2:IP: 7720b476:Disasm jz 0x7720b484:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
 72 | TID: 2:IP: 7720b46e:Disasm mov dl, byte ptr [eax]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: eax: 5c350a: ds: 23: al: 5c350a: ah: 5c350a: ax: 5c350a: :Read Flags: :Read Memory: 5c350a [T] :
 73 | TID: 2:IP: 7720b470:Disasm test dl, dl:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: edx[T]: 4c: dl[T]: 4c: dx[T]: 4c: :Read Flags: :Read Memory: :
 74 | TID: 2:IP: 7720b472:Disasm jz 0x7720b478:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: eflags[T]: 202: :Read Flags: 0:[T 40:zf ]:Values:202:Read Memory: :
 75 | TID: 2:IP: 7720b474:Disasm cmp dl, byte ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: edx[T]: 4c: ecx: 40427e: ds: 23: cl: 40427e: ch: 40427e: cx: 40427e: dl[T]: 4c: dx[T]: 4c: :Read Flags: :Read Memory: 40427e :
 76 | TID: 2:IP: 7720b476:Disasm jz 0x7720b484:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
 77 | TID: 2:IP: 7720b46e:Disasm mov dl, byte ptr [eax]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: eax: 5c350b: ds: 23: al: 5c350b: ah: 5c350b: ax: 5c350b: :Read Flags: :Read Memory: 5c350b [T] :
 78 | TID: 2:IP: 7720b470:Disasm test dl, dl:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: edx[T]: 50: dl[T]: 50: dx[T]: 50: :Read Flags: :Read Memory: :
 79 | TID: 2:IP: 7720b472:Disasm jz 0x7720b478:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: eflags[T]: 206: :Read Flags: 0:[T 40:zf ]:Values:206:Read Memory: :
 80 | TID: 2:IP: 7720b474:Disasm cmp dl, byte ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: edx[T]: 50: ecx: 40427f: ds: 23: cl: 40427f: ch: 40427f: cx: 40427f: dl[T]: 50: dx[T]: 50: :Read Flags: :Read Memory: 40427f :
 81 | TID: 2:IP: 7720b476:Disasm jz 0x7720b484:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
 82 | TID 2 Before: recv 7c, 5c3508, 1000, 0
 83 | Peer name: 127.0.0.1
 84 | Input IP address equals peer name, tainting 
 85 | TID: 2 After: recv  returns 6b
 86 | Recv on tid: 2
 87 | Read length: 6b
 88 | Read data: KSTET aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
 89 | 
 90 | TID: 2:IP: 772101d5:Disasm mov dl, byte ptr [eax]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eax: 5c3508: ds: 23: al: 5c3508: ah: 5c3508: ax: 5c3508: :Read Flags: :Read Memory: 5c3508 [T] :
 91 | TID: 2:IP: 772101dd:Disasm test dl, dl:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: edx[T]: 4b: dl[T]: 4b: dx[T]: 4b: :Read Flags: :Read Memory: :
 92 | TID: 2:IP: 772101df:Disasm jz 0x77210218:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eflags[T]: 206: :Read Flags: 0:[T 40:zf ]:Values:206:Read Memory: :
 93 | TID: 2:IP: 772101e1:Disasm cmp dl, byte ptr [ecx-0x4]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: edx[T]: 4b: ecx: 404248: ds: 23: cl: 404248: ch: 404248: cx: 404248: dl[T]: 4b: dx[T]: 4b: :Read Flags: :Read Memory: 404244 :
 94 | TID: 2:IP: 772101e4:Disasm jnz 0x77210218:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eflags[T]: 206: :Read Flags: 0:[T 40:zf ]:Values:206:Read Memory: :
 95 | TID: 2:IP: 77210218:Disasm movzx eax, byte ptr [eax-0x4]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eax: 5c350c: ds: 23: al: 5c350c: ah: 5c350c: ax: 5c350c: :Read Flags: :Read Memory: 5c3508 [T] :
 96 | TID: 2:IP: 7720b47e:Disasm sub eax, ecx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: ecx: 48: eax[T]: 4b: al[T]: 4b: ah[T]: 4b: ax[T]: 4b: cl: 48: ch: 48: cx: 48: :Read Flags: :Read Memory: :
 97 | TID: 2:IP: 401989:Disasm test eax, eax:IMG: C:\Users\sunirge\Downloads\vulnserver\vulnserver.exe:RTN: unnamedImageEntryPoint:Read Regs: eax[T]: 3: al[T]: 3: ah[T]: 3: ax[T]: 3: :Read Flags: :Read Memory: :
 98 | TID: 2:IP: 40198b:Disasm jnz 0x4019d6:IMG: C:\Users\sunirge\Downloads\vulnserver\vulnserver.exe:RTN: unnamedImageEntryPoint:Read Regs: eflags[T]: 206: :Read Flags: 0:[T 40:zf ]:Values:206:Read Memory: :
 99 | TID: 2:IP: 7720b46e:Disasm mov dl, byte ptr [eax]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: eax: 5c3508: ds: 23: al: 5c3508: ah: 5c3508: ax: 5c3508: :Read Flags: :Read Memory: 5c3508 [T] :
100 | TID: 2:IP: 7720b470:Disasm test dl, dl:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: edx[T]: 4b: dl[T]: 4b: dx[T]: 4b: :Read Flags: :Read Memory: :
101 | TID: 2:IP: 7720b472:Disasm jz 0x7720b478:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: eflags[T]: 206: :Read Flags: 0:[T 40:zf ]:Values:206:Read Memory: :
102 | TID: 2:IP: 7720b474:Disasm cmp dl, byte ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: edx[T]: 4b: ecx: 40427c: ds: 23: cl: 40427c: ch: 40427c: cx: 40427c: dl[T]: 4b: dx[T]: 4b: :Read Flags: :Read Memory: 40427c :
103 | TID: 2:IP: 7720b476:Disasm jz 0x7720b484:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: eflags[T]: 206: :Read Flags: 0:[T 40:zf ]:Values:206:Read Memory: :
104 | TID: 2:IP: 7720b478:Disasm movzx eax, byte ptr [eax]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: eax: 5c3508: ds: 23: al: 5c3508: ah: 5c3508: ax: 5c3508: :Read Flags: :Read Memory: 5c3508 [T] :
105 | TID: 2:IP: 7720b47e:Disasm sub eax, ecx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: ecx: 48: eax[T]: 4b: al[T]: 4b: ah[T]: 4b: ax[T]: 4b: cl: 48: ch: 48: cx: 48: :Read Flags: :Read Memory: :
106 | TID: 2:IP: 4019f1:Disasm test eax, eax:IMG: C:\Users\sunirge\Downloads\vulnserver\vulnserver.exe:RTN: unnamedImageEntryPoint:Read Regs: eax[T]: 3: al[T]: 3: ah[T]: 3: ax[T]: 3: :Read Flags: :Read Memory: :
107 | TID: 2:IP: 4019f3:Disasm jnz 0x401a4b:IMG: C:\Users\sunirge\Downloads\vulnserver\vulnserver.exe:RTN: unnamedImageEntryPoint:Read Regs: eflags[T]: 206: :Read Flags: 0:[T 40:zf ]:Values:206:Read Memory: :
108 | TID: 2:IP: 772101d5:Disasm mov dl, byte ptr [eax]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eax: 5c3508: ds: 23: al: 5c3508: ah: 5c3508: ax: 5c3508: :Read Flags: :Read Memory: 5c3508 [T] :
109 | TID: 2:IP: 772101dd:Disasm test dl, dl:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: edx[T]: 4b: dl[T]: 4b: dx[T]: 4b: :Read Flags: :Read Memory: :
110 | TID: 2:IP: 772101df:Disasm jz 0x77210218:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eflags[T]: 206: :Read Flags: 0:[T 40:zf ]:Values:206:Read Memory: :
111 | TID: 2:IP: 772101e1:Disasm cmp dl, byte ptr [ecx-0x4]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: edx[T]: 4b: ecx: 404384: ds: 23: cl: 404384: ch: 404384: cx: 404384: dl[T]: 4b: dx[T]: 4b: :Read Flags: :Read Memory: 404380 :
112 | TID: 2:IP: 772101e4:Disasm jnz 0x77210218:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eflags[T]: 283: :Read Flags: 0:[T 40:zf ]:Values:283:Read Memory: :
113 | TID: 2:IP: 77210218:Disasm movzx eax, byte ptr [eax-0x4]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eax: 5c350c: ds: 23: al: 5c350c: ah: 5c350c: ax: 5c350c: :Read Flags: :Read Memory: 5c3508 [T] :
114 | TID: 2:IP: 7720b47e:Disasm sub eax, ecx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: ecx: 53: eax[T]: 4b: al[T]: 4b: ah[T]: 4b: ax[T]: 4b: cl: 53: ch: 53: cx: 53: :Read Flags: :Read Memory: :
115 | TID: 2:IP: 401a66:Disasm test eax, eax:IMG: C:\Users\sunirge\Downloads\vulnserver\vulnserver.exe:RTN: unnamedImageEntryPoint:Read Regs: eax[T]: fffffff8: al[T]: fffffff8: ah[T]: fffffff8: ax[T]: fffffff8: :Read Flags: :Read Memory: :
116 | TID: 2:IP: 401a68:Disasm jnz 0x401aef:IMG: C:\Users\sunirge\Downloads\vulnserver\vulnserver.exe:RTN: unnamedImageEntryPoint:Read Regs: eflags[T]: 282: :Read Flags: 0:[T 40:zf ]:Values:282:Read Memory: :
117 | TID: 2:IP: 772101d5:Disasm mov dl, byte ptr [eax]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eax: 5c3508: ds: 23: al: 5c3508: ah: 5c3508: ax: 5c3508: :Read Flags: :Read Memory: 5c3508 [T] :
118 | TID: 2:IP: 772101dd:Disasm test dl, dl:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: edx[T]: 4b: dl[T]: 4b: dx[T]: 4b: :Read Flags: :Read Memory: :
119 | TID: 2:IP: 772101df:Disasm jz 0x77210218:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eflags[T]: 206: :Read Flags: 0:[T 40:zf ]:Values:206:Read Memory: :
120 | TID: 2:IP: 772101e1:Disasm cmp dl, byte ptr [ecx-0x4]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: edx[T]: 4b: ecx: 40439f: ds: 23: cl: 40439f: ch: 40439f: cx: 40439f: dl[T]: 4b: dx[T]: 4b: :Read Flags: :Read Memory: 40439b :
121 | TID: 2:IP: 772101e4:Disasm jnz 0x77210218:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eflags[T]: 287: :Read Flags: 0:[T 40:zf ]:Values:287:Read Memory: :
122 | TID: 2:IP: 77210218:Disasm movzx eax, byte ptr [eax-0x4]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eax: 5c350c: ds: 23: al: 5c350c: ah: 5c350c: ax: 5c350c: :Read Flags: :Read Memory: 5c3508 [T] :
123 | TID: 2:IP: 7720b47e:Disasm sub eax, ecx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: ecx: 52: eax[T]: 4b: al[T]: 4b: ah[T]: 4b: ax[T]: 4b: cl: 52: ch: 52: cx: 52: :Read Flags: :Read Memory: :
124 | TID: 2:IP: 401b0a:Disasm test eax, eax:IMG: C:\Users\sunirge\Downloads\vulnserver\vulnserver.exe:RTN: unnamedImageEntryPoint:Read Regs: eax[T]: fffffff9: al[T]: fffffff9: ah[T]: fffffff9: ax[T]: fffffff9: :Read Flags: :Read Memory: :
125 | TID: 2:IP: 401b0c:Disasm jnz 0x401b93:IMG: C:\Users\sunirge\Downloads\vulnserver\vulnserver.exe:RTN: unnamedImageEntryPoint:Read Regs: eflags[T]: 286: :Read Flags: 0:[T 40:zf ]:Values:286:Read Memory: :
126 | TID: 2:IP: 772101d5:Disasm mov dl, byte ptr [eax]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eax: 5c3508: ds: 23: al: 5c3508: ah: 5c3508: ax: 5c3508: :Read Flags: :Read Memory: 5c3508 [T] :
127 | TID: 2:IP: 772101dd:Disasm test dl, dl:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: edx[T]: 4b: dl[T]: 4b: dx[T]: 4b: :Read Flags: :Read Memory: :
128 | TID: 2:IP: 772101df:Disasm jz 0x77210218:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eflags[T]: 206: :Read Flags: 0:[T 40:zf ]:Values:206:Read Memory: :
129 | TID: 2:IP: 772101e1:Disasm cmp dl, byte ptr [ecx-0x4]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: edx[T]: 4b: ecx: 4043c1: ds: 23: cl: 4043c1: ch: 4043c1: cx: 4043c1: dl[T]: 4b: dx[T]: 4b: :Read Flags: :Read Memory: 4043bd :
130 | TID: 2:IP: 772101e4:Disasm jnz 0x77210218:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eflags[T]: 297: :Read Flags: 0:[T 40:zf ]:Values:297:Read Memory: :
131 | TID: 2:IP: 77210218:Disasm movzx eax, byte ptr [eax-0x4]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eax: 5c350c: ds: 23: al: 5c350c: ah: 5c350c: ax: 5c350c: :Read Flags: :Read Memory: 5c3508 [T] :
132 | TID: 2:IP: 7720b47e:Disasm sub eax, ecx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: ecx: 4c: eax[T]: 4b: al[T]: 4b: ah[T]: 4b: ax[T]: 4b: cl: 4c: ch: 4c: cx: 4c: :Read Flags: :Read Memory: :
133 | TID: 2:IP: 401bae:Disasm test eax, eax:IMG: C:\Users\sunirge\Downloads\vulnserver\vulnserver.exe:RTN: unnamedImageEntryPoint:Read Regs: eax[T]: ffffffff: al[T]: ffffffff: ah[T]: ffffffff: ax[T]: ffffffff: :Read Flags: :Read Memory: :
134 | TID: 2:IP: 401bb0:Disasm jnz 0x401c37:IMG: C:\Users\sunirge\Downloads\vulnserver\vulnserver.exe:RTN: unnamedImageEntryPoint:Read Regs: eflags[T]: 286: :Read Flags: 0:[T 40:zf ]:Values:286:Read Memory: :
135 | TID: 2:IP: 772101d5:Disasm mov dl, byte ptr [eax]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eax: 5c3508: ds: 23: al: 5c3508: ah: 5c3508: ax: 5c3508: :Read Flags: :Read Memory: 5c3508 [T] :
136 | TID: 2:IP: 772101dd:Disasm test dl, dl:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: edx[T]: 4b: dl[T]: 4b: dx[T]: 4b: :Read Flags: :Read Memory: :
137 | TID: 2:IP: 772101df:Disasm jz 0x77210218:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eflags[T]: 206: :Read Flags: 0:[T 40:zf ]:Values:206:Read Memory: :
138 | TID: 2:IP: 772101e1:Disasm cmp dl, byte ptr [ecx-0x4]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: edx[T]: 4b: ecx: 4043e2: ds: 23: cl: 4043e2: ch: 4043e2: cx: 4043e2: dl[T]: 4b: dx[T]: 4b: :Read Flags: :Read Memory: 4043de :
139 | TID: 2:IP: 772101e4:Disasm jnz 0x77210218:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eflags[T]: 283: :Read Flags: 0:[T 40:zf ]:Values:283:Read Memory: :
140 | TID: 2:IP: 77210218:Disasm movzx eax, byte ptr [eax-0x4]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eax: 5c350c: ds: 23: al: 5c350c: ah: 5c350c: ax: 5c350c: :Read Flags: :Read Memory: 5c3508 [T] :
141 | TID: 2:IP: 7720b47e:Disasm sub eax, ecx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: ecx: 53: eax[T]: 4b: al[T]: 4b: ah[T]: 4b: ax[T]: 4b: cl: 53: ch: 53: cx: 53: :Read Flags: :Read Memory: :
142 | TID: 2:IP: 401c52:Disasm test eax, eax:IMG: C:\Users\sunirge\Downloads\vulnserver\vulnserver.exe:RTN: unnamedImageEntryPoint:Read Regs: eax[T]: fffffff8: al[T]: fffffff8: ah[T]: fffffff8: ax[T]: fffffff8: :Read Flags: :Read Memory: :
143 | TID: 2:IP: 401c54:Disasm jnz 0x401cdb:IMG: C:\Users\sunirge\Downloads\vulnserver\vulnserver.exe:RTN: unnamedImageEntryPoint:Read Regs: eflags[T]: 282: :Read Flags: 0:[T 40:zf ]:Values:282:Read Memory: :
144 | TID: 2:IP: 772101d5:Disasm mov dl, byte ptr [eax]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eax: 5c3508: ds: 23: al: 5c3508: ah: 5c3508: ax: 5c3508: :Read Flags: :Read Memory: 5c3508 [T] :
145 | TID: 2:IP: 772101dd:Disasm test dl, dl:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: edx[T]: 4b: dl[T]: 4b: dx[T]: 4b: :Read Flags: :Read Memory: :
146 | TID: 2:IP: 772101df:Disasm jz 0x77210218:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eflags[T]: 206: :Read Flags: 0:[T 40:zf ]:Values:206:Read Memory: :
147 | TID: 2:IP: 772101e1:Disasm cmp dl, byte ptr [ecx-0x4]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: edx[T]: 4b: ecx: 4043f7: ds: 23: cl: 4043f7: ch: 4043f7: cx: 4043f7: dl[T]: 4b: dx[T]: 4b: :Read Flags: :Read Memory: 4043f3 :
148 | TID: 2:IP: 772101e4:Disasm jnz 0x77210218:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eflags[T]: 283: :Read Flags: 0:[T 40:zf ]:Values:283:Read Memory: :
149 | TID: 2:IP: 77210218:Disasm movzx eax, byte ptr [eax-0x4]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eax: 5c350c: ds: 23: al: 5c350c: ah: 5c350c: ax: 5c350c: :Read Flags: :Read Memory: 5c3508 [T] :
150 | TID: 2:IP: 7720b47e:Disasm sub eax, ecx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: ecx: 54: eax[T]: 4b: al[T]: 4b: ah[T]: 4b: ax[T]: 4b: cl: 54: ch: 54: cx: 54: :Read Flags: :Read Memory: :
151 | TID: 2:IP: 401cf6:Disasm test eax, eax:IMG: C:\Users\sunirge\Downloads\vulnserver\vulnserver.exe:RTN: unnamedImageEntryPoint:Read Regs: eax[T]: fffffff7: al[T]: fffffff7: ah[T]: fffffff7: ax[T]: fffffff7: :Read Flags: :Read Memory: :
152 | TID: 2:IP: 401cf8:Disasm jnz 0x401dda:IMG: C:\Users\sunirge\Downloads\vulnserver\vulnserver.exe:RTN: unnamedImageEntryPoint:Read Regs: eflags[T]: 282: :Read Flags: 0:[T 40:zf ]:Values:282:Read Memory: :
153 | TID: 2:IP: 772101d5:Disasm mov dl, byte ptr [eax]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eax: 5c3508: ds: 23: al: 5c3508: ah: 5c3508: ax: 5c3508: :Read Flags: :Read Memory: 5c3508 [T] :
154 | TID: 2:IP: 772101dd:Disasm test dl, dl:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: edx[T]: 4b: dl[T]: 4b: dx[T]: 4b: :Read Flags: :Read Memory: :
155 | TID: 2:IP: 772101df:Disasm jz 0x77210218:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eflags[T]: 206: :Read Flags: 0:[T 40:zf ]:Values:206:Read Memory: :
156 | TID: 2:IP: 772101e1:Disasm cmp dl, byte ptr [ecx-0x4]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: edx[T]: 4b: ecx: 40440c: ds: 23: cl: 40440c: ch: 40440c: cx: 40440c: dl[T]: 4b: dx[T]: 4b: :Read Flags: :Read Memory: 404408 :
157 | TID: 2:IP: 772101e4:Disasm jnz 0x77210218:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eflags[T]: 202: :Read Flags: 0:[T 40:zf ]:Values:202:Read Memory: :
158 | TID: 2:IP: 77210218:Disasm movzx eax, byte ptr [eax-0x4]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eax: 5c350c: ds: 23: al: 5c350c: ah: 5c350c: ax: 5c350c: :Read Flags: :Read Memory: 5c3508 [T] :
159 | TID: 2:IP: 7720b47e:Disasm sub eax, ecx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: ecx: 47: eax[T]: 4b: al[T]: 4b: ah[T]: 4b: ax[T]: 4b: cl: 47: ch: 47: cx: 47: :Read Flags: :Read Memory: :
160 | TID: 2:IP: 401df5:Disasm test eax, eax:IMG: C:\Users\sunirge\Downloads\vulnserver\vulnserver.exe:RTN: unnamedImageEntryPoint:Read Regs: eax[T]: 4: al[T]: 4: ah[T]: 4: ax[T]: 4: :Read Flags: :Read Memory: :
161 | TID: 2:IP: 401df7:Disasm jnz 0x401ead:IMG: C:\Users\sunirge\Downloads\vulnserver\vulnserver.exe:RTN: unnamedImageEntryPoint:Read Regs: eflags[T]: 202: :Read Flags: 0:[T 40:zf ]:Values:202:Read Memory: :
162 | TID: 2:IP: 772101d5:Disasm mov dl, byte ptr [eax]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eax: 5c3508: ds: 23: al: 5c3508: ah: 5c3508: ax: 5c3508: :Read Flags: :Read Memory: 5c3508 [T] :
163 | TID: 2:IP: 772101dd:Disasm test dl, dl:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: edx[T]: 4b: dl[T]: 4b: dx[T]: 4b: :Read Flags: :Read Memory: :
164 | TID: 2:IP: 772101df:Disasm jz 0x77210218:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eflags[T]: 206: :Read Flags: 0:[T 40:zf ]:Values:206:Read Memory: :
165 | TID: 2:IP: 772101e1:Disasm cmp dl, byte ptr [ecx-0x4]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: edx[T]: 4b: ecx: 404420: ds: 23: cl: 404420: ch: 404420: cx: 404420: dl[T]: 4b: dx[T]: 4b: :Read Flags: :Read Memory: 40441c :
166 | TID: 2:IP: 772101e4:Disasm jnz 0x77210218:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eflags[T]: 202: :Read Flags: 0:[T 40:zf ]:Values:202:Read Memory: :
167 | TID: 2:IP: 77210218:Disasm movzx eax, byte ptr [eax-0x4]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eax: 5c350c: ds: 23: al: 5c350c: ah: 5c350c: ax: 5c350c: :Read Flags: :Read Memory: 5c3508 [T] :
168 | TID: 2:IP: 7720b47e:Disasm sub eax, ecx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: ecx: 47: eax[T]: 4b: al[T]: 4b: ah[T]: 4b: ax[T]: 4b: cl: 47: ch: 47: cx: 47: :Read Flags: :Read Memory: :
169 | TID: 2:IP: 401ec8:Disasm test eax, eax:IMG: C:\Users\sunirge\Downloads\vulnserver\vulnserver.exe:RTN: unnamedImageEntryPoint:Read Regs: eax[T]: 4: al[T]: 4: ah[T]: 4: ax[T]: 4: :Read Flags: :Read Memory: :
170 | TID: 2:IP: 401eca:Disasm jnz 0x401f1d:IMG: C:\Users\sunirge\Downloads\vulnserver\vulnserver.exe:RTN: unnamedImageEntryPoint:Read Regs: eflags[T]: 202: :Read Flags: 0:[T 40:zf ]:Values:202:Read Memory: :
171 | TID: 2:IP: 772101d5:Disasm mov dl, byte ptr [eax]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eax: 5c3508: ds: 23: al: 5c3508: ah: 5c3508: ax: 5c3508: :Read Flags: :Read Memory: 5c3508 [T] :
172 | TID: 2:IP: 772101dd:Disasm test dl, dl:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: edx[T]: 4b: dl[T]: 4b: dx[T]: 4b: :Read Flags: :Read Memory: :
173 | TID: 2:IP: 772101df:Disasm jz 0x77210218:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eflags[T]: 206: :Read Flags: 0:[T 40:zf ]:Values:206:Read Memory: :
174 | TID: 2:IP: 772101e1:Disasm cmp dl, byte ptr [ecx-0x4]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: edx[T]: 4b: ecx: 404434: ds: 23: cl: 404434: ch: 404434: cx: 404434: dl[T]: 4b: dx[T]: 4b: :Read Flags: :Read Memory: 404430 :
175 | TID: 2:IP: 772101e4:Disasm jnz 0x77210218:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
176 | TID: 2:IP: 772101e6:Disasm mov dl, byte ptr [eax-0x3]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eax: 5c350c: ds: 23: al: 5c350c: ah: 5c350c: ax: 5c350c: :Read Flags: :Read Memory: 5c3509 [T] :
177 | TID: 2:IP: 772101e9:Disasm test dl, dl:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: edx[T]: 53: dl[T]: 53: dx[T]: 53: :Read Flags: :Read Memory: :
178 | TID: 2:IP: 772101eb:Disasm jz 0x77210225:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eflags[T]: 206: :Read Flags: 0:[T 40:zf ]:Values:206:Read Memory: :
179 | TID: 2:IP: 772101ed:Disasm cmp dl, byte ptr [ecx-0x3]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: edx[T]: 53: ecx: 404434: ds: 23: cl: 404434: ch: 404434: cx: 404434: dl[T]: 53: dx[T]: 53: :Read Flags: :Read Memory: 404431 :
180 | TID: 2:IP: 772101f0:Disasm jnz 0x77210225:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
181 | TID: 2:IP: 772101f2:Disasm mov dl, byte ptr [eax-0x2]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eax: 5c350c: ds: 23: al: 5c350c: ah: 5c350c: ax: 5c350c: :Read Flags: :Read Memory: 5c350a [T] :
182 | TID: 2:IP: 772101f5:Disasm test dl, dl:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: edx[T]: 54: dl[T]: 54: dx[T]: 54: :Read Flags: :Read Memory: :
183 | TID: 2:IP: 772101f7:Disasm jz 0x7721023f:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eflags[T]: 202: :Read Flags: 0:[T 40:zf ]:Values:202:Read Memory: :
184 | TID: 2:IP: 772101f9:Disasm cmp dl, byte ptr [ecx-0x2]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: edx[T]: 54: ecx: 404434: ds: 23: cl: 404434: ch: 404434: cx: 404434: dl[T]: 54: dx[T]: 54: :Read Flags: :Read Memory: 404432 :
185 | TID: 2:IP: 772101fc:Disasm jnz 0x7721023f:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
186 | TID: 2:IP: 772101fe:Disasm mov dl, byte ptr [eax-0x1]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eax: 5c350c: ds: 23: al: 5c350c: ah: 5c350c: ax: 5c350c: :Read Flags: :Read Memory: 5c350b [T] :
187 | TID: 2:IP: 77210201:Disasm test dl, dl:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: edx[T]: 45: dl[T]: 45: dx[T]: 45: :Read Flags: :Read Memory: :
188 | TID: 2:IP: 77210203:Disasm jz 0x77210232:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eflags[T]: 202: :Read Flags: 0:[T 40:zf ]:Values:202:Read Memory: :
189 | TID: 2:IP: 77210205:Disasm cmp dl, byte ptr [ecx-0x1]:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: edx[T]: 45: ecx: 404434: ds: 23: cl: 404434: ch: 404434: cx: 404434: dl[T]: 45: dx[T]: 45: :Read Flags: :Read Memory: 404433 :
190 | TID: 2:IP: 77210208:Disasm jnz 0x77210232:IMG: C:\Windows\system32\msvcrt.dll:RTN: _itow:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
191 | TID: 2:IP: 7720b46e:Disasm mov dl, byte ptr [eax]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: eax: 5c350c: ds: 23: al: 5c350c: ah: 5c350c: ax: 5c350c: :Read Flags: :Read Memory: 5c350c [T] :
192 | TID: 2:IP: 7720b470:Disasm test dl, dl:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: edx[T]: 54: dl[T]: 54: dx[T]: 54: :Read Flags: :Read Memory: :
193 | TID: 2:IP: 7720b472:Disasm jz 0x7720b478:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: eflags[T]: 202: :Read Flags: 0:[T 40:zf ]:Values:202:Read Memory: :
194 | TID: 2:IP: 7720b474:Disasm cmp dl, byte ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: edx[T]: 54: ecx: 404434: ds: 23: cl: 404434: ch: 404434: cx: 404434: dl[T]: 54: dx[T]: 54: :Read Flags: :Read Memory: 404434 :
195 | TID: 2:IP: 7720b476:Disasm jz 0x7720b484:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
196 | TID: 2:IP: 7720b46e:Disasm mov dl, byte ptr [eax]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: eax: 5c350d: ds: 23: al: 5c350d: ah: 5c350d: ax: 5c350d: :Read Flags: :Read Memory: 5c350d [T] :
197 | TID: 2:IP: 7720b470:Disasm test dl, dl:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: edx[T]: 20: dl[T]: 20: dx[T]: 20: :Read Flags: :Read Memory: :
198 | TID: 2:IP: 7720b472:Disasm jz 0x7720b478:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: eflags[T]: 202: :Read Flags: 0:[T 40:zf ]:Values:202:Read Memory: :
199 | TID: 2:IP: 7720b474:Disasm cmp dl, byte ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: edx[T]: 20: ecx: 404435: ds: 23: cl: 404435: ch: 404435: cx: 404435: dl[T]: 20: dx[T]: 20: :Read Flags: :Read Memory: 404435 :
200 | TID: 2:IP: 7720b476:Disasm jz 0x7720b484:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncmp:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
201 | TID: 2:IP: 772108f5:Disasm mov eax, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c3508: ds: 23: si: 5c3508: :Read Flags: :Read Memory: 5c3508 [T] 5c3509 [T] 5c350a [T] 5c350b [T] :
202 | TID: 2:IP: 772108f7:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx: 7efefeff: eax[T]: 4554534b: al[T]: 4554534b: ah[T]: 4554534b: ax[T]: 4554534b: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
203 | TID: 2:IP: 772108f9:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 4554534b: al[T]: 4554534b: ah[T]: 4554534b: ax[T]: 4554534b: :Read Flags: :Read Memory: :
204 | TID: 2:IP: 772108fc:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx[T]: c453524a: eax[T]: baabacb4: al[T]: baabacb4: ah[T]: baabacb4: ax[T]: baabacb4: dl[T]: c453524a: dh[T]: c453524a: dx[T]: c453524a: :Read Flags: :Read Memory: :
205 | TID: 2:IP: 772108fe:Disasm mov edx, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c3508: ds: 23: si: 5c3508: :Read Flags: :Read Memory: 5c3508 [T] 5c3509 [T] 5c350a [T] 5c350b [T] :
206 | TID: 2:IP: 77210903:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 7ef8fefe: al[T]: 7ef8fefe: ah[T]: 7ef8fefe: ax[T]: 7ef8fefe: :Read Flags: :Read Memory: :
207 | TID: 2:IP: 77210908:Disasm jnz 0x7721958c:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
208 | TID: 2:IP: 7721090e:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edi: 5c4918: edx[T]: 4554534b: ds: 23: dl[T]: 4554534b: dh[T]: 4554534b: dx[T]: 4554534b: di: 5c4918: :Read Flags: :Read Memory: :
209 | TID: 2:IP: 772108f5:Disasm mov eax, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c350c: ds: 23: si: 5c350c: :Read Flags: :Read Memory: 5c350c [T] 5c350d [T] 5c350e [T] 5c350f [T] :
210 | TID: 2:IP: 772108f7:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx: 7efefeff: eax[T]: 61612054: al[T]: 61612054: ah[T]: 61612054: ax[T]: 61612054: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
211 | TID: 2:IP: 772108f9:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 61612054: al[T]: 61612054: ah[T]: 61612054: ax[T]: 61612054: :Read Flags: :Read Memory: :
212 | TID: 2:IP: 772108fc:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx[T]: e0601f53: eax[T]: 9e9edfab: al[T]: 9e9edfab: ah[T]: 9e9edfab: ax[T]: 9e9edfab: dl[T]: e0601f53: dh[T]: e0601f53: dx[T]: e0601f53: :Read Flags: :Read Memory: :
213 | TID: 2:IP: 772108fe:Disasm mov edx, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c350c: ds: 23: si: 5c350c: :Read Flags: :Read Memory: 5c350c [T] 5c350d [T] 5c350e [T] 5c350f [T] :
214 | TID: 2:IP: 77210903:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 7efec0f8: al[T]: 7efec0f8: ah[T]: 7efec0f8: ax[T]: 7efec0f8: :Read Flags: :Read Memory: :
215 | TID: 2:IP: 77210908:Disasm jnz 0x7721958c:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
216 | TID: 2:IP: 7721090e:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edi: 5c491c: edx[T]: 61612054: ds: 23: dl[T]: 61612054: dh[T]: 61612054: dx[T]: 61612054: di: 5c491c: :Read Flags: :Read Memory: :
217 | TID: 2:IP: 772108f5:Disasm mov eax, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c3510: ds: 23: si: 5c3510: :Read Flags: :Read Memory: 5c3510 [T] 5c3511 [T] 5c3512 [T] 5c3513 [T] :
218 | TID: 2:IP: 772108f7:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
219 | TID: 2:IP: 772108f9:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
220 | TID: 2:IP: 772108fc:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
221 | TID: 2:IP: 772108fe:Disasm mov edx, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c3510: ds: 23: si: 5c3510: :Read Flags: :Read Memory: 5c3510 [T] 5c3511 [T] 5c3512 [T] 5c3513 [T] :
222 | TID: 2:IP: 77210903:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
223 | TID: 2:IP: 77210908:Disasm jnz 0x7721958c:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
224 | TID: 2:IP: 7721090e:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edi: 5c4920: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 5c4920: :Read Flags: :Read Memory: :
225 | TID: 2:IP: 772108f5:Disasm mov eax, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c3514: ds: 23: si: 5c3514: :Read Flags: :Read Memory: 5c3514 [T] 5c3515 [T] 5c3516 [T] 5c3517 [T] :
226 | TID: 2:IP: 772108f7:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
227 | TID: 2:IP: 772108f9:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
228 | TID: 2:IP: 772108fc:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
229 | TID: 2:IP: 772108fe:Disasm mov edx, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c3514: ds: 23: si: 5c3514: :Read Flags: :Read Memory: 5c3514 [T] 5c3515 [T] 5c3516 [T] 5c3517 [T] :
230 | TID: 2:IP: 77210903:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
231 | TID: 2:IP: 77210908:Disasm jnz 0x7721958c:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
232 | TID: 2:IP: 7721090e:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edi: 5c4924: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 5c4924: :Read Flags: :Read Memory: :
233 | TID: 2:IP: 772108f5:Disasm mov eax, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c3518: ds: 23: si: 5c3518: :Read Flags: :Read Memory: 5c3518 [T] 5c3519 [T] 5c351a [T] 5c351b [T] :
234 | TID: 2:IP: 772108f7:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
235 | TID: 2:IP: 772108f9:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
236 | TID: 2:IP: 772108fc:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
237 | TID: 2:IP: 772108fe:Disasm mov edx, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c3518: ds: 23: si: 5c3518: :Read Flags: :Read Memory: 5c3518 [T] 5c3519 [T] 5c351a [T] 5c351b [T] :
238 | TID: 2:IP: 77210903:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
239 | TID: 2:IP: 77210908:Disasm jnz 0x7721958c:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
240 | TID: 2:IP: 7721090e:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edi: 5c4928: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 5c4928: :Read Flags: :Read Memory: :
241 | TID: 2:IP: 772108f5:Disasm mov eax, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c351c: ds: 23: si: 5c351c: :Read Flags: :Read Memory: 5c351c [T] 5c351d [T] 5c351e [T] 5c351f [T] :
242 | TID: 2:IP: 772108f7:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
243 | TID: 2:IP: 772108f9:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
244 | TID: 2:IP: 772108fc:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
245 | TID: 2:IP: 772108fe:Disasm mov edx, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c351c: ds: 23: si: 5c351c: :Read Flags: :Read Memory: 5c351c [T] 5c351d [T] 5c351e [T] 5c351f [T] :
246 | TID: 2:IP: 77210903:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
247 | TID: 2:IP: 77210908:Disasm jnz 0x7721958c:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
248 | TID: 2:IP: 7721090e:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edi: 5c492c: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 5c492c: :Read Flags: :Read Memory: :
249 | TID: 2:IP: 772108f5:Disasm mov eax, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c3520: ds: 23: si: 5c3520: :Read Flags: :Read Memory: 5c3520 [T] 5c3521 [T] 5c3522 [T] 5c3523 [T] :
250 | TID: 2:IP: 772108f7:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
251 | TID: 2:IP: 772108f9:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
252 | TID: 2:IP: 772108fc:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
253 | TID: 2:IP: 772108fe:Disasm mov edx, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c3520: ds: 23: si: 5c3520: :Read Flags: :Read Memory: 5c3520 [T] 5c3521 [T] 5c3522 [T] 5c3523 [T] :
254 | TID: 2:IP: 77210903:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
255 | TID: 2:IP: 77210908:Disasm jnz 0x7721958c:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
256 | TID: 2:IP: 7721090e:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edi: 5c4930: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 5c4930: :Read Flags: :Read Memory: :
257 | TID: 2:IP: 772108f5:Disasm mov eax, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c3524: ds: 23: si: 5c3524: :Read Flags: :Read Memory: 5c3524 [T] 5c3525 [T] 5c3526 [T] 5c3527 [T] :
258 | TID: 2:IP: 772108f7:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
259 | TID: 2:IP: 772108f9:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
260 | TID: 2:IP: 772108fc:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
261 | TID: 2:IP: 772108fe:Disasm mov edx, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c3524: ds: 23: si: 5c3524: :Read Flags: :Read Memory: 5c3524 [T] 5c3525 [T] 5c3526 [T] 5c3527 [T] :
262 | TID: 2:IP: 77210903:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
263 | TID: 2:IP: 77210908:Disasm jnz 0x7721958c:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
264 | TID: 2:IP: 7721090e:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edi: 5c4934: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 5c4934: :Read Flags: :Read Memory: :
265 | TID: 2:IP: 772108f5:Disasm mov eax, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c3528: ds: 23: si: 5c3528: :Read Flags: :Read Memory: 5c3528 [T] 5c3529 [T] 5c352a [T] 5c352b [T] :
266 | TID: 2:IP: 772108f7:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
267 | TID: 2:IP: 772108f9:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
268 | TID: 2:IP: 772108fc:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
269 | TID: 2:IP: 772108fe:Disasm mov edx, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c3528: ds: 23: si: 5c3528: :Read Flags: :Read Memory: 5c3528 [T] 5c3529 [T] 5c352a [T] 5c352b [T] :
270 | TID: 2:IP: 77210903:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
271 | TID: 2:IP: 77210908:Disasm jnz 0x7721958c:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
272 | TID: 2:IP: 7721090e:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edi: 5c4938: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 5c4938: :Read Flags: :Read Memory: :
273 | TID: 2:IP: 772108f5:Disasm mov eax, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c352c: ds: 23: si: 5c352c: :Read Flags: :Read Memory: 5c352c [T] 5c352d [T] 5c352e [T] 5c352f [T] :
274 | TID: 2:IP: 772108f7:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
275 | TID: 2:IP: 772108f9:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
276 | TID: 2:IP: 772108fc:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
277 | TID: 2:IP: 772108fe:Disasm mov edx, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c352c: ds: 23: si: 5c352c: :Read Flags: :Read Memory: 5c352c [T] 5c352d [T] 5c352e [T] 5c352f [T] :
278 | TID: 2:IP: 77210903:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
279 | TID: 2:IP: 77210908:Disasm jnz 0x7721958c:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
280 | TID: 2:IP: 7721090e:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edi: 5c493c: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 5c493c: :Read Flags: :Read Memory: :
281 | TID: 2:IP: 772108f5:Disasm mov eax, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c3530: ds: 23: si: 5c3530: :Read Flags: :Read Memory: 5c3530 [T] 5c3531 [T] 5c3532 [T] 5c3533 [T] :
282 | TID: 2:IP: 772108f7:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
283 | TID: 2:IP: 772108f9:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
284 | TID: 2:IP: 772108fc:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
285 | TID: 2:IP: 772108fe:Disasm mov edx, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c3530: ds: 23: si: 5c3530: :Read Flags: :Read Memory: 5c3530 [T] 5c3531 [T] 5c3532 [T] 5c3533 [T] :
286 | TID: 2:IP: 77210903:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
287 | TID: 2:IP: 77210908:Disasm jnz 0x7721958c:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
288 | TID: 2:IP: 7721090e:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edi: 5c4940: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 5c4940: :Read Flags: :Read Memory: :
289 | TID: 2:IP: 772108f5:Disasm mov eax, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c3534: ds: 23: si: 5c3534: :Read Flags: :Read Memory: 5c3534 [T] 5c3535 [T] 5c3536 [T] 5c3537 [T] :
290 | TID: 2:IP: 772108f7:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
291 | TID: 2:IP: 772108f9:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
292 | TID: 2:IP: 772108fc:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
293 | TID: 2:IP: 772108fe:Disasm mov edx, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c3534: ds: 23: si: 5c3534: :Read Flags: :Read Memory: 5c3534 [T] 5c3535 [T] 5c3536 [T] 5c3537 [T] :
294 | TID: 2:IP: 77210903:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
295 | TID: 2:IP: 77210908:Disasm jnz 0x7721958c:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
296 | TID: 2:IP: 7721090e:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edi: 5c4944: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 5c4944: :Read Flags: :Read Memory: :
297 | TID: 2:IP: 772108f5:Disasm mov eax, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c3538: ds: 23: si: 5c3538: :Read Flags: :Read Memory: 5c3538 [T] 5c3539 [T] 5c353a [T] 5c353b [T] :
298 | TID: 2:IP: 772108f7:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
299 | TID: 2:IP: 772108f9:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
300 | TID: 2:IP: 772108fc:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
301 | TID: 2:IP: 772108fe:Disasm mov edx, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c3538: ds: 23: si: 5c3538: :Read Flags: :Read Memory: 5c3538 [T] 5c3539 [T] 5c353a [T] 5c353b [T] :
302 | TID: 2:IP: 77210903:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
303 | TID: 2:IP: 77210908:Disasm jnz 0x7721958c:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
304 | TID: 2:IP: 7721090e:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edi: 5c4948: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 5c4948: :Read Flags: :Read Memory: :
305 | TID: 2:IP: 772108f5:Disasm mov eax, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c353c: ds: 23: si: 5c353c: :Read Flags: :Read Memory: 5c353c [T] 5c353d [T] 5c353e [T] 5c353f [T] :
306 | TID: 2:IP: 772108f7:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
307 | TID: 2:IP: 772108f9:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
308 | TID: 2:IP: 772108fc:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
309 | TID: 2:IP: 772108fe:Disasm mov edx, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c353c: ds: 23: si: 5c353c: :Read Flags: :Read Memory: 5c353c [T] 5c353d [T] 5c353e [T] 5c353f [T] :
310 | TID: 2:IP: 77210903:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
311 | TID: 2:IP: 77210908:Disasm jnz 0x7721958c:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
312 | TID: 2:IP: 7721090e:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edi: 5c494c: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 5c494c: :Read Flags: :Read Memory: :
313 | TID: 2:IP: 772108f5:Disasm mov eax, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c3540: ds: 23: si: 5c3540: :Read Flags: :Read Memory: 5c3540 [T] 5c3541 [T] 5c3542 [T] 5c3543 [T] :
314 | TID: 2:IP: 772108f7:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
315 | TID: 2:IP: 772108f9:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
316 | TID: 2:IP: 772108fc:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
317 | TID: 2:IP: 772108fe:Disasm mov edx, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c3540: ds: 23: si: 5c3540: :Read Flags: :Read Memory: 5c3540 [T] 5c3541 [T] 5c3542 [T] 5c3543 [T] :
318 | TID: 2:IP: 77210903:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
319 | TID: 2:IP: 77210908:Disasm jnz 0x7721958c:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
320 | TID: 2:IP: 7721090e:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edi: 5c4950: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 5c4950: :Read Flags: :Read Memory: :
321 | TID: 2:IP: 772108f5:Disasm mov eax, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c3544: ds: 23: si: 5c3544: :Read Flags: :Read Memory: 5c3544 [T] 5c3545 [T] 5c3546 [T] 5c3547 [T] :
322 | TID: 2:IP: 772108f7:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
323 | TID: 2:IP: 772108f9:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
324 | TID: 2:IP: 772108fc:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
325 | TID: 2:IP: 772108fe:Disasm mov edx, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c3544: ds: 23: si: 5c3544: :Read Flags: :Read Memory: 5c3544 [T] 5c3545 [T] 5c3546 [T] 5c3547 [T] :
326 | TID: 2:IP: 77210903:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
327 | TID: 2:IP: 77210908:Disasm jnz 0x7721958c:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
328 | TID: 2:IP: 7721090e:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edi: 5c4954: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 5c4954: :Read Flags: :Read Memory: :
329 | TID: 2:IP: 772108f5:Disasm mov eax, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c3548: ds: 23: si: 5c3548: :Read Flags: :Read Memory: 5c3548 [T] 5c3549 [T] 5c354a [T] 5c354b [T] :
330 | TID: 2:IP: 772108f7:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
331 | TID: 2:IP: 772108f9:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
332 | TID: 2:IP: 772108fc:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
333 | TID: 2:IP: 772108fe:Disasm mov edx, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c3548: ds: 23: si: 5c3548: :Read Flags: :Read Memory: 5c3548 [T] 5c3549 [T] 5c354a [T] 5c354b [T] :
334 | TID: 2:IP: 77210903:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
335 | TID: 2:IP: 77210908:Disasm jnz 0x7721958c:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
336 | TID: 2:IP: 7721090e:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edi: 5c4958: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 5c4958: :Read Flags: :Read Memory: :
337 | TID: 2:IP: 772108f5:Disasm mov eax, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c354c: ds: 23: si: 5c354c: :Read Flags: :Read Memory: 5c354c [T] 5c354d [T] 5c354e [T] 5c354f [T] :
338 | TID: 2:IP: 772108f7:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
339 | TID: 2:IP: 772108f9:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
340 | TID: 2:IP: 772108fc:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
341 | TID: 2:IP: 772108fe:Disasm mov edx, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c354c: ds: 23: si: 5c354c: :Read Flags: :Read Memory: 5c354c [T] 5c354d [T] 5c354e [T] 5c354f [T] :
342 | TID: 2:IP: 77210903:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
343 | TID: 2:IP: 77210908:Disasm jnz 0x7721958c:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
344 | TID: 2:IP: 7721090e:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edi: 5c495c: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 5c495c: :Read Flags: :Read Memory: :
345 | TID: 2:IP: 772108f5:Disasm mov eax, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c3550: ds: 23: si: 5c3550: :Read Flags: :Read Memory: 5c3550 [T] 5c3551 [T] 5c3552 [T] 5c3553 [T] :
346 | TID: 2:IP: 772108f7:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
347 | TID: 2:IP: 772108f9:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
348 | TID: 2:IP: 772108fc:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
349 | TID: 2:IP: 772108fe:Disasm mov edx, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c3550: ds: 23: si: 5c3550: :Read Flags: :Read Memory: 5c3550 [T] 5c3551 [T] 5c3552 [T] 5c3553 [T] :
350 | TID: 2:IP: 77210903:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
351 | TID: 2:IP: 77210908:Disasm jnz 0x7721958c:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
352 | TID: 2:IP: 7721090e:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edi: 5c4960: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 5c4960: :Read Flags: :Read Memory: :
353 | TID: 2:IP: 772108f5:Disasm mov eax, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c3554: ds: 23: si: 5c3554: :Read Flags: :Read Memory: 5c3554 [T] 5c3555 [T] 5c3556 [T] 5c3557 [T] :
354 | TID: 2:IP: 772108f7:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
355 | TID: 2:IP: 772108f9:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
356 | TID: 2:IP: 772108fc:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
357 | TID: 2:IP: 772108fe:Disasm mov edx, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c3554: ds: 23: si: 5c3554: :Read Flags: :Read Memory: 5c3554 [T] 5c3555 [T] 5c3556 [T] 5c3557 [T] :
358 | TID: 2:IP: 77210903:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
359 | TID: 2:IP: 77210908:Disasm jnz 0x7721958c:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
360 | TID: 2:IP: 7721090e:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edi: 5c4964: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 5c4964: :Read Flags: :Read Memory: :
361 | TID: 2:IP: 772108f5:Disasm mov eax, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c3558: ds: 23: si: 5c3558: :Read Flags: :Read Memory: 5c3558 [T] 5c3559 [T] 5c355a [T] 5c355b [T] :
362 | TID: 2:IP: 772108f7:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
363 | TID: 2:IP: 772108f9:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
364 | TID: 2:IP: 772108fc:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
365 | TID: 2:IP: 772108fe:Disasm mov edx, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c3558: ds: 23: si: 5c3558: :Read Flags: :Read Memory: 5c3558 [T] 5c3559 [T] 5c355a [T] 5c355b [T] :
366 | TID: 2:IP: 77210903:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
367 | TID: 2:IP: 77210908:Disasm jnz 0x7721958c:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
368 | TID: 2:IP: 7721090e:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edi: 5c4968: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 5c4968: :Read Flags: :Read Memory: :
369 | TID: 2:IP: 772108f5:Disasm mov eax, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c355c: ds: 23: si: 5c355c: :Read Flags: :Read Memory: 5c355c [T] 5c355d [T] 5c355e [T] 5c355f [T] :
370 | TID: 2:IP: 772108f7:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
371 | TID: 2:IP: 772108f9:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
372 | TID: 2:IP: 772108fc:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
373 | TID: 2:IP: 772108fe:Disasm mov edx, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c355c: ds: 23: si: 5c355c: :Read Flags: :Read Memory: 5c355c [T] 5c355d [T] 5c355e [T] 5c355f [T] :
374 | TID: 2:IP: 77210903:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
375 | TID: 2:IP: 77210908:Disasm jnz 0x7721958c:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
376 | TID: 2:IP: 7721090e:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edi: 5c496c: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 5c496c: :Read Flags: :Read Memory: :
377 | TID: 2:IP: 772108f5:Disasm mov eax, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c3560: ds: 23: si: 5c3560: :Read Flags: :Read Memory: 5c3560 [T] 5c3561 [T] 5c3562 [T] 5c3563 [T] :
378 | TID: 2:IP: 772108f7:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
379 | TID: 2:IP: 772108f9:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
380 | TID: 2:IP: 772108fc:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
381 | TID: 2:IP: 772108fe:Disasm mov edx, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c3560: ds: 23: si: 5c3560: :Read Flags: :Read Memory: 5c3560 [T] 5c3561 [T] 5c3562 [T] 5c3563 [T] :
382 | TID: 2:IP: 77210903:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
383 | TID: 2:IP: 77210908:Disasm jnz 0x7721958c:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
384 | TID: 2:IP: 7721090e:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edi: 5c4970: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 5c4970: :Read Flags: :Read Memory: :
385 | TID: 2:IP: 772108f5:Disasm mov eax, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c3564: ds: 23: si: 5c3564: :Read Flags: :Read Memory: 5c3564 [T] 5c3565 [T] 5c3566 [T] 5c3567 [T] :
386 | TID: 2:IP: 772108f7:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
387 | TID: 2:IP: 772108f9:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
388 | TID: 2:IP: 772108fc:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
389 | TID: 2:IP: 772108fe:Disasm mov edx, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c3564: ds: 23: si: 5c3564: :Read Flags: :Read Memory: 5c3564 [T] 5c3565 [T] 5c3566 [T] 5c3567 [T] :
390 | TID: 2:IP: 77210903:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
391 | TID: 2:IP: 77210908:Disasm jnz 0x7721958c:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
392 | TID: 2:IP: 7721090e:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edi: 5c4974: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 5c4974: :Read Flags: :Read Memory: :
393 | TID: 2:IP: 772108f5:Disasm mov eax, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c3568: ds: 23: si: 5c3568: :Read Flags: :Read Memory: 5c3568 [T] 5c3569 [T] 5c356a [T] 5c356b [T] :
394 | TID: 2:IP: 772108f7:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
395 | TID: 2:IP: 772108f9:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
396 | TID: 2:IP: 772108fc:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
397 | TID: 2:IP: 772108fe:Disasm mov edx, dword ptr [esi]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: esi: 5c3568: ds: 23: si: 5c3568: :Read Flags: :Read Memory: 5c3568 [T] 5c3569 [T] 5c356a [T] 5c356b [T] :
398 | TID: 2:IP: 77210903:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
399 | TID: 2:IP: 77210908:Disasm jnz 0x7721958c:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
400 | TID: 2:IP: 7721090e:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strncpy:Read Regs: edi: 5c4978: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 5c4978: :Read Flags: :Read Memory: :
401 | TID: 2:IP: 77218dbd:Disasm mov eax, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c4918: ds: 23: cl: 5c4918: ch: 5c4918: cx: 5c4918: :Read Flags: :Read Memory: 5c4918 [T] 5c4919 [T] 5c491a [T] 5c491b [T] :
402 | TID: 2:IP: 77218dbf:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx: 7efefeff: eax[T]: 4554534b: al[T]: 4554534b: ah[T]: 4554534b: ax[T]: 4554534b: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
403 | TID: 2:IP: 77218dc1:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 4554534b: al[T]: 4554534b: ah[T]: 4554534b: ax[T]: 4554534b: :Read Flags: :Read Memory: :
404 | TID: 2:IP: 77218dc4:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx[T]: c453524a: eax[T]: baabacb4: al[T]: baabacb4: ah[T]: baabacb4: ax[T]: baabacb4: dl[T]: c453524a: dh[T]: c453524a: dx[T]: c453524a: :Read Flags: :Read Memory: :
405 | TID: 2:IP: 77218dc6:Disasm mov edx, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c4918: ds: 23: cl: 5c4918: ch: 5c4918: cx: 5c4918: :Read Flags: :Read Memory: 5c4918 [T] 5c4919 [T] 5c491a [T] 5c491b [T] :
406 | TID: 2:IP: 77218dcb:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 7ef8fefe: al[T]: 7ef8fefe: ah[T]: 7ef8fefe: ax[T]: 7ef8fefe: :Read Flags: :Read Memory: :
407 | TID: 2:IP: 77218dd0:Disasm jnz 0x77218dd9:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
408 | TID: 2:IP: 77218dd2:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edi: 345f990: edx[T]: 4554534b: ds: 23: dl[T]: 4554534b: dh[T]: 4554534b: dx[T]: 4554534b: di: 345f990: :Read Flags: :Read Memory: :
409 | TID: 2:IP: 77218dbd:Disasm mov eax, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c491c: ds: 23: cl: 5c491c: ch: 5c491c: cx: 5c491c: :Read Flags: :Read Memory: 5c491c [T] 5c491d [T] 5c491e [T] 5c491f [T] :
410 | TID: 2:IP: 77218dbf:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx: 7efefeff: eax[T]: 61612054: al[T]: 61612054: ah[T]: 61612054: ax[T]: 61612054: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
411 | TID: 2:IP: 77218dc1:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 61612054: al[T]: 61612054: ah[T]: 61612054: ax[T]: 61612054: :Read Flags: :Read Memory: :
412 | TID: 2:IP: 77218dc4:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx[T]: e0601f53: eax[T]: 9e9edfab: al[T]: 9e9edfab: ah[T]: 9e9edfab: ax[T]: 9e9edfab: dl[T]: e0601f53: dh[T]: e0601f53: dx[T]: e0601f53: :Read Flags: :Read Memory: :
413 | TID: 2:IP: 77218dc6:Disasm mov edx, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c491c: ds: 23: cl: 5c491c: ch: 5c491c: cx: 5c491c: :Read Flags: :Read Memory: 5c491c [T] 5c491d [T] 5c491e [T] 5c491f [T] :
414 | TID: 2:IP: 77218dcb:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 7efec0f8: al[T]: 7efec0f8: ah[T]: 7efec0f8: ax[T]: 7efec0f8: :Read Flags: :Read Memory: :
415 | TID: 2:IP: 77218dd0:Disasm jnz 0x77218dd9:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
416 | TID: 2:IP: 77218dd2:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edi: 345f994: edx[T]: 61612054: ds: 23: dl[T]: 61612054: dh[T]: 61612054: dx[T]: 61612054: di: 345f994: :Read Flags: :Read Memory: :
417 | TID: 2:IP: 77218dbd:Disasm mov eax, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c4920: ds: 23: cl: 5c4920: ch: 5c4920: cx: 5c4920: :Read Flags: :Read Memory: 5c4920 [T] 5c4921 [T] 5c4922 [T] 5c4923 [T] :
418 | TID: 2:IP: 77218dbf:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
419 | TID: 2:IP: 77218dc1:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
420 | TID: 2:IP: 77218dc4:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
421 | TID: 2:IP: 77218dc6:Disasm mov edx, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c4920: ds: 23: cl: 5c4920: ch: 5c4920: cx: 5c4920: :Read Flags: :Read Memory: 5c4920 [T] 5c4921 [T] 5c4922 [T] 5c4923 [T] :
422 | TID: 2:IP: 77218dcb:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
423 | TID: 2:IP: 77218dd0:Disasm jnz 0x77218dd9:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
424 | TID: 2:IP: 77218dd2:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edi: 345f998: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 345f998: :Read Flags: :Read Memory: :
425 | TID: 2:IP: 77218dbd:Disasm mov eax, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c4924: ds: 23: cl: 5c4924: ch: 5c4924: cx: 5c4924: :Read Flags: :Read Memory: 5c4924 [T] 5c4925 [T] 5c4926 [T] 5c4927 [T] :
426 | TID: 2:IP: 77218dbf:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
427 | TID: 2:IP: 77218dc1:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
428 | TID: 2:IP: 77218dc4:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
429 | TID: 2:IP: 77218dc6:Disasm mov edx, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c4924: ds: 23: cl: 5c4924: ch: 5c4924: cx: 5c4924: :Read Flags: :Read Memory: 5c4924 [T] 5c4925 [T] 5c4926 [T] 5c4927 [T] :
430 | TID: 2:IP: 77218dcb:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
431 | TID: 2:IP: 77218dd0:Disasm jnz 0x77218dd9:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
432 | TID: 2:IP: 77218dd2:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edi: 345f99c: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 345f99c: :Read Flags: :Read Memory: :
433 | TID: 2:IP: 77218dbd:Disasm mov eax, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c4928: ds: 23: cl: 5c4928: ch: 5c4928: cx: 5c4928: :Read Flags: :Read Memory: 5c4928 [T] 5c4929 [T] 5c492a [T] 5c492b [T] :
434 | TID: 2:IP: 77218dbf:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
435 | TID: 2:IP: 77218dc1:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
436 | TID: 2:IP: 77218dc4:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
437 | TID: 2:IP: 77218dc6:Disasm mov edx, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c4928: ds: 23: cl: 5c4928: ch: 5c4928: cx: 5c4928: :Read Flags: :Read Memory: 5c4928 [T] 5c4929 [T] 5c492a [T] 5c492b [T] :
438 | TID: 2:IP: 77218dcb:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
439 | TID: 2:IP: 77218dd0:Disasm jnz 0x77218dd9:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
440 | TID: 2:IP: 77218dd2:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edi: 345f9a0: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 345f9a0: :Read Flags: :Read Memory: :
441 | TID: 2:IP: 77218dbd:Disasm mov eax, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c492c: ds: 23: cl: 5c492c: ch: 5c492c: cx: 5c492c: :Read Flags: :Read Memory: 5c492c [T] 5c492d [T] 5c492e [T] 5c492f [T] :
442 | TID: 2:IP: 77218dbf:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
443 | TID: 2:IP: 77218dc1:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
444 | TID: 2:IP: 77218dc4:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
445 | TID: 2:IP: 77218dc6:Disasm mov edx, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c492c: ds: 23: cl: 5c492c: ch: 5c492c: cx: 5c492c: :Read Flags: :Read Memory: 5c492c [T] 5c492d [T] 5c492e [T] 5c492f [T] :
446 | TID: 2:IP: 77218dcb:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
447 | TID: 2:IP: 77218dd0:Disasm jnz 0x77218dd9:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
448 | TID: 2:IP: 77218dd2:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edi: 345f9a4: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 345f9a4: :Read Flags: :Read Memory: :
449 | TID: 2:IP: 77218dbd:Disasm mov eax, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c4930: ds: 23: cl: 5c4930: ch: 5c4930: cx: 5c4930: :Read Flags: :Read Memory: 5c4930 [T] 5c4931 [T] 5c4932 [T] 5c4933 [T] :
450 | TID: 2:IP: 77218dbf:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
451 | TID: 2:IP: 77218dc1:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
452 | TID: 2:IP: 77218dc4:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
453 | TID: 2:IP: 77218dc6:Disasm mov edx, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c4930: ds: 23: cl: 5c4930: ch: 5c4930: cx: 5c4930: :Read Flags: :Read Memory: 5c4930 [T] 5c4931 [T] 5c4932 [T] 5c4933 [T] :
454 | TID: 2:IP: 77218dcb:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
455 | TID: 2:IP: 77218dd0:Disasm jnz 0x77218dd9:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
456 | TID: 2:IP: 77218dd2:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edi: 345f9a8: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 345f9a8: :Read Flags: :Read Memory: :
457 | TID: 2:IP: 77218dbd:Disasm mov eax, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c4934: ds: 23: cl: 5c4934: ch: 5c4934: cx: 5c4934: :Read Flags: :Read Memory: 5c4934 [T] 5c4935 [T] 5c4936 [T] 5c4937 [T] :
458 | TID: 2:IP: 77218dbf:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
459 | TID: 2:IP: 77218dc1:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
460 | TID: 2:IP: 77218dc4:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
461 | TID: 2:IP: 77218dc6:Disasm mov edx, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c4934: ds: 23: cl: 5c4934: ch: 5c4934: cx: 5c4934: :Read Flags: :Read Memory: 5c4934 [T] 5c4935 [T] 5c4936 [T] 5c4937 [T] :
462 | TID: 2:IP: 77218dcb:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
463 | TID: 2:IP: 77218dd0:Disasm jnz 0x77218dd9:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
464 | TID: 2:IP: 77218dd2:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edi: 345f9ac: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 345f9ac: :Read Flags: :Read Memory: :
465 | TID: 2:IP: 77218dbd:Disasm mov eax, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c4938: ds: 23: cl: 5c4938: ch: 5c4938: cx: 5c4938: :Read Flags: :Read Memory: 5c4938 [T] 5c4939 [T] 5c493a [T] 5c493b [T] :
466 | TID: 2:IP: 77218dbf:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
467 | TID: 2:IP: 77218dc1:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
468 | TID: 2:IP: 77218dc4:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
469 | TID: 2:IP: 77218dc6:Disasm mov edx, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c4938: ds: 23: cl: 5c4938: ch: 5c4938: cx: 5c4938: :Read Flags: :Read Memory: 5c4938 [T] 5c4939 [T] 5c493a [T] 5c493b [T] :
470 | TID: 2:IP: 77218dcb:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
471 | TID: 2:IP: 77218dd0:Disasm jnz 0x77218dd9:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
472 | TID: 2:IP: 77218dd2:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edi: 345f9b0: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 345f9b0: :Read Flags: :Read Memory: :
473 | TID: 2:IP: 77218dbd:Disasm mov eax, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c493c: ds: 23: cl: 5c493c: ch: 5c493c: cx: 5c493c: :Read Flags: :Read Memory: 5c493c [T] 5c493d [T] 5c493e [T] 5c493f [T] :
474 | TID: 2:IP: 77218dbf:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
475 | TID: 2:IP: 77218dc1:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
476 | TID: 2:IP: 77218dc4:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
477 | TID: 2:IP: 77218dc6:Disasm mov edx, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c493c: ds: 23: cl: 5c493c: ch: 5c493c: cx: 5c493c: :Read Flags: :Read Memory: 5c493c [T] 5c493d [T] 5c493e [T] 5c493f [T] :
478 | TID: 2:IP: 77218dcb:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
479 | TID: 2:IP: 77218dd0:Disasm jnz 0x77218dd9:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
480 | TID: 2:IP: 77218dd2:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edi: 345f9b4: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 345f9b4: :Read Flags: :Read Memory: :
481 | TID: 2:IP: 77218dbd:Disasm mov eax, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c4940: ds: 23: cl: 5c4940: ch: 5c4940: cx: 5c4940: :Read Flags: :Read Memory: 5c4940 [T] 5c4941 [T] 5c4942 [T] 5c4943 [T] :
482 | TID: 2:IP: 77218dbf:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
483 | TID: 2:IP: 77218dc1:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
484 | TID: 2:IP: 77218dc4:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
485 | TID: 2:IP: 77218dc6:Disasm mov edx, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c4940: ds: 23: cl: 5c4940: ch: 5c4940: cx: 5c4940: :Read Flags: :Read Memory: 5c4940 [T] 5c4941 [T] 5c4942 [T] 5c4943 [T] :
486 | TID: 2:IP: 77218dcb:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
487 | TID: 2:IP: 77218dd0:Disasm jnz 0x77218dd9:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
488 | TID: 2:IP: 77218dd2:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edi: 345f9b8: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 345f9b8: :Read Flags: :Read Memory: :
489 | TID: 2:IP: 77218dbd:Disasm mov eax, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c4944: ds: 23: cl: 5c4944: ch: 5c4944: cx: 5c4944: :Read Flags: :Read Memory: 5c4944 [T] 5c4945 [T] 5c4946 [T] 5c4947 [T] :
490 | TID: 2:IP: 77218dbf:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
491 | TID: 2:IP: 77218dc1:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
492 | TID: 2:IP: 77218dc4:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
493 | TID: 2:IP: 77218dc6:Disasm mov edx, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c4944: ds: 23: cl: 5c4944: ch: 5c4944: cx: 5c4944: :Read Flags: :Read Memory: 5c4944 [T] 5c4945 [T] 5c4946 [T] 5c4947 [T] :
494 | TID: 2:IP: 77218dcb:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
495 | TID: 2:IP: 77218dd0:Disasm jnz 0x77218dd9:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
496 | TID: 2:IP: 77218dd2:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edi: 345f9bc: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 345f9bc: :Read Flags: :Read Memory: :
497 | TID: 2:IP: 77218dbd:Disasm mov eax, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c4948: ds: 23: cl: 5c4948: ch: 5c4948: cx: 5c4948: :Read Flags: :Read Memory: 5c4948 [T] 5c4949 [T] 5c494a [T] 5c494b [T] :
498 | TID: 2:IP: 77218dbf:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
499 | TID: 2:IP: 77218dc1:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
500 | TID: 2:IP: 77218dc4:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
501 | TID: 2:IP: 77218dc6:Disasm mov edx, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c4948: ds: 23: cl: 5c4948: ch: 5c4948: cx: 5c4948: :Read Flags: :Read Memory: 5c4948 [T] 5c4949 [T] 5c494a [T] 5c494b [T] :
502 | TID: 2:IP: 77218dcb:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
503 | TID: 2:IP: 77218dd0:Disasm jnz 0x77218dd9:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
504 | TID: 2:IP: 77218dd2:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edi: 345f9c0: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 345f9c0: :Read Flags: :Read Memory: :
505 | TID: 2:IP: 77218dbd:Disasm mov eax, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c494c: ds: 23: cl: 5c494c: ch: 5c494c: cx: 5c494c: :Read Flags: :Read Memory: 5c494c [T] 5c494d [T] 5c494e [T] 5c494f [T] :
506 | TID: 2:IP: 77218dbf:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
507 | TID: 2:IP: 77218dc1:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
508 | TID: 2:IP: 77218dc4:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
509 | TID: 2:IP: 77218dc6:Disasm mov edx, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c494c: ds: 23: cl: 5c494c: ch: 5c494c: cx: 5c494c: :Read Flags: :Read Memory: 5c494c [T] 5c494d [T] 5c494e [T] 5c494f [T] :
510 | TID: 2:IP: 77218dcb:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
511 | TID: 2:IP: 77218dd0:Disasm jnz 0x77218dd9:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
512 | TID: 2:IP: 77218dd2:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edi: 345f9c4: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 345f9c4: :Read Flags: :Read Memory: :
513 | TID: 2:IP: 77218dbd:Disasm mov eax, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c4950: ds: 23: cl: 5c4950: ch: 5c4950: cx: 5c4950: :Read Flags: :Read Memory: 5c4950 [T] 5c4951 [T] 5c4952 [T] 5c4953 [T] :
514 | TID: 2:IP: 77218dbf:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
515 | TID: 2:IP: 77218dc1:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
516 | TID: 2:IP: 77218dc4:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
517 | TID: 2:IP: 77218dc6:Disasm mov edx, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c4950: ds: 23: cl: 5c4950: ch: 5c4950: cx: 5c4950: :Read Flags: :Read Memory: 5c4950 [T] 5c4951 [T] 5c4952 [T] 5c4953 [T] :
518 | TID: 2:IP: 77218dcb:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
519 | TID: 2:IP: 77218dd0:Disasm jnz 0x77218dd9:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
520 | TID: 2:IP: 77218dd2:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edi: 345f9c8: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 345f9c8: :Read Flags: :Read Memory: :
521 | TID: 2:IP: 77218dbd:Disasm mov eax, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c4954: ds: 23: cl: 5c4954: ch: 5c4954: cx: 5c4954: :Read Flags: :Read Memory: 5c4954 [T] 5c4955 [T] 5c4956 [T] 5c4957 [T] :
522 | TID: 2:IP: 77218dbf:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
523 | TID: 2:IP: 77218dc1:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
524 | TID: 2:IP: 77218dc4:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
525 | TID: 2:IP: 77218dc6:Disasm mov edx, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c4954: ds: 23: cl: 5c4954: ch: 5c4954: cx: 5c4954: :Read Flags: :Read Memory: 5c4954 [T] 5c4955 [T] 5c4956 [T] 5c4957 [T] :
526 | TID: 2:IP: 77218dcb:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
527 | TID: 2:IP: 77218dd0:Disasm jnz 0x77218dd9:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
528 | TID: 2:IP: 77218dd2:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edi: 345f9cc: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 345f9cc: :Read Flags: :Read Memory: :
529 | TID: 2:IP: 77218dbd:Disasm mov eax, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c4958: ds: 23: cl: 5c4958: ch: 5c4958: cx: 5c4958: :Read Flags: :Read Memory: 5c4958 [T] 5c4959 [T] 5c495a [T] 5c495b [T] :
530 | TID: 2:IP: 77218dbf:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
531 | TID: 2:IP: 77218dc1:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
532 | TID: 2:IP: 77218dc4:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
533 | TID: 2:IP: 77218dc6:Disasm mov edx, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c4958: ds: 23: cl: 5c4958: ch: 5c4958: cx: 5c4958: :Read Flags: :Read Memory: 5c4958 [T] 5c4959 [T] 5c495a [T] 5c495b [T] :
534 | TID: 2:IP: 77218dcb:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
535 | TID: 2:IP: 77218dd0:Disasm jnz 0x77218dd9:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
536 | TID: 2:IP: 77218dd2:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edi: 345f9d0: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 345f9d0: :Read Flags: :Read Memory: :
537 | TID: 2:IP: 77218dbd:Disasm mov eax, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c495c: ds: 23: cl: 5c495c: ch: 5c495c: cx: 5c495c: :Read Flags: :Read Memory: 5c495c [T] 5c495d [T] 5c495e [T] 5c495f [T] :
538 | TID: 2:IP: 77218dbf:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
539 | TID: 2:IP: 77218dc1:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
540 | TID: 2:IP: 77218dc4:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
541 | TID: 2:IP: 77218dc6:Disasm mov edx, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c495c: ds: 23: cl: 5c495c: ch: 5c495c: cx: 5c495c: :Read Flags: :Read Memory: 5c495c [T] 5c495d [T] 5c495e [T] 5c495f [T] :
542 | TID: 2:IP: 77218dcb:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
543 | TID: 2:IP: 77218dd0:Disasm jnz 0x77218dd9:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
544 | TID: 2:IP: 77218dd2:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edi: 345f9d4: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 345f9d4: :Read Flags: :Read Memory: :
545 | TID: 2:IP: 77218dbd:Disasm mov eax, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c4960: ds: 23: cl: 5c4960: ch: 5c4960: cx: 5c4960: :Read Flags: :Read Memory: 5c4960 [T] 5c4961 [T] 5c4962 [T] 5c4963 [T] :
546 | TID: 2:IP: 77218dbf:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
547 | TID: 2:IP: 77218dc1:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
548 | TID: 2:IP: 77218dc4:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
549 | TID: 2:IP: 77218dc6:Disasm mov edx, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c4960: ds: 23: cl: 5c4960: ch: 5c4960: cx: 5c4960: :Read Flags: :Read Memory: 5c4960 [T] 5c4961 [T] 5c4962 [T] 5c4963 [T] :
550 | TID: 2:IP: 77218dcb:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
551 | TID: 2:IP: 77218dd0:Disasm jnz 0x77218dd9:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
552 | TID: 2:IP: 77218dd2:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edi: 345f9d8: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 345f9d8: :Read Flags: :Read Memory: :
553 | TID: 2:IP: 77218dbd:Disasm mov eax, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c4964: ds: 23: cl: 5c4964: ch: 5c4964: cx: 5c4964: :Read Flags: :Read Memory: 5c4964 [T] 5c4965 [T] 5c4966 [T] 5c4967 [T] :
554 | TID: 2:IP: 77218dbf:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
555 | TID: 2:IP: 77218dc1:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
556 | TID: 2:IP: 77218dc4:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
557 | TID: 2:IP: 77218dc6:Disasm mov edx, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c4964: ds: 23: cl: 5c4964: ch: 5c4964: cx: 5c4964: :Read Flags: :Read Memory: 5c4964 [T] 5c4965 [T] 5c4966 [T] 5c4967 [T] :
558 | TID: 2:IP: 77218dcb:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
559 | TID: 2:IP: 77218dd0:Disasm jnz 0x77218dd9:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
560 | TID: 2:IP: 77218dd2:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edi: 345f9dc: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 345f9dc: :Read Flags: :Read Memory: :
561 | TID: 2:IP: 77218dbd:Disasm mov eax, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c4968: ds: 23: cl: 5c4968: ch: 5c4968: cx: 5c4968: :Read Flags: :Read Memory: 5c4968 [T] 5c4969 [T] 5c496a [T] 5c496b [T] :
562 | TID: 2:IP: 77218dbf:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
563 | TID: 2:IP: 77218dc1:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
564 | TID: 2:IP: 77218dc4:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
565 | TID: 2:IP: 77218dc6:Disasm mov edx, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c4968: ds: 23: cl: 5c4968: ch: 5c4968: cx: 5c4968: :Read Flags: :Read Memory: 5c4968 [T] 5c4969 [T] 5c496a [T] 5c496b [T] :
566 | TID: 2:IP: 77218dcb:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
567 | TID: 2:IP: 77218dd0:Disasm jnz 0x77218dd9:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
568 | TID: 2:IP: 77218dd2:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edi: 345f9e0: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 345f9e0: :Read Flags: :Read Memory: :
569 | TID: 2:IP: 77218dbd:Disasm mov eax, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c496c: ds: 23: cl: 5c496c: ch: 5c496c: cx: 5c496c: :Read Flags: :Read Memory: 5c496c [T] 5c496d [T] 5c496e [T] 5c496f [T] :
570 | TID: 2:IP: 77218dbf:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
571 | TID: 2:IP: 77218dc1:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
572 | TID: 2:IP: 77218dc4:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
573 | TID: 2:IP: 77218dc6:Disasm mov edx, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c496c: ds: 23: cl: 5c496c: ch: 5c496c: cx: 5c496c: :Read Flags: :Read Memory: 5c496c [T] 5c496d [T] 5c496e [T] 5c496f [T] :
574 | TID: 2:IP: 77218dcb:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
575 | TID: 2:IP: 77218dd0:Disasm jnz 0x77218dd9:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
576 | TID: 2:IP: 77218dd2:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edi: 345f9e4: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 345f9e4: :Read Flags: :Read Memory: :
577 | TID: 2:IP: 77218dbd:Disasm mov eax, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c4970: ds: 23: cl: 5c4970: ch: 5c4970: cx: 5c4970: :Read Flags: :Read Memory: 5c4970 [T] 5c4971 [T] 5c4972 [T] 5c4973 [T] :
578 | TID: 2:IP: 77218dbf:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
579 | TID: 2:IP: 77218dc1:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
580 | TID: 2:IP: 77218dc4:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
581 | TID: 2:IP: 77218dc6:Disasm mov edx, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c4970: ds: 23: cl: 5c4970: ch: 5c4970: cx: 5c4970: :Read Flags: :Read Memory: 5c4970 [T] 5c4971 [T] 5c4972 [T] 5c4973 [T] :
582 | TID: 2:IP: 77218dcb:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
583 | TID: 2:IP: 77218dd0:Disasm jnz 0x77218dd9:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
584 | TID: 2:IP: 77218dd2:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edi: 345f9e8: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 345f9e8: :Read Flags: :Read Memory: :
585 | TID: 2:IP: 77218dbd:Disasm mov eax, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c4974: ds: 23: cl: 5c4974: ch: 5c4974: cx: 5c4974: :Read Flags: :Read Memory: 5c4974 [T] 5c4975 [T] 5c4976 [T] 5c4977 [T] :
586 | TID: 2:IP: 77218dbf:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
587 | TID: 2:IP: 77218dc1:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
588 | TID: 2:IP: 77218dc4:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
589 | TID: 2:IP: 77218dc6:Disasm mov edx, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c4974: ds: 23: cl: 5c4974: ch: 5c4974: cx: 5c4974: :Read Flags: :Read Memory: 5c4974 [T] 5c4975 [T] 5c4976 [T] 5c4977 [T] :
590 | TID: 2:IP: 77218dcb:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
591 | TID: 2:IP: 77218dd0:Disasm jnz 0x77218dd9:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
592 | TID: 2:IP: 77218dd2:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edi: 345f9ec: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 345f9ec: :Read Flags: :Read Memory: :
593 | TID: 2:IP: 77218dbd:Disasm mov eax, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c4978: ds: 23: cl: 5c4978: ch: 5c4978: cx: 5c4978: :Read Flags: :Read Memory: 5c4978 [T] 5c4979 [T] 5c497a [T] 5c497b [T] :
594 | TID: 2:IP: 77218dbf:Disasm add edx, eax:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx: 7efefeff: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: dl: 7efefeff: dh: 7efefeff: dx: 7efefeff: :Read Flags: :Read Memory: :
595 | TID: 2:IP: 77218dc1:Disasm xor eax, 0xffffffff:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 61616161: al[T]: 61616161: ah[T]: 61616161: ax[T]: 61616161: :Read Flags: :Read Memory: :
596 | TID: 2:IP: 77218dc4:Disasm xor eax, edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edx[T]: e0606060: eax[T]: 9e9e9e9e: al[T]: 9e9e9e9e: ah[T]: 9e9e9e9e: ax[T]: 9e9e9e9e: dl[T]: e0606060: dh[T]: e0606060: dx[T]: e0606060: :Read Flags: :Read Memory: :
597 | TID: 2:IP: 77218dc6:Disasm mov edx, dword ptr [ecx]:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: ecx: 5c4978: ds: 23: cl: 5c4978: ch: 5c4978: cx: 5c4978: :Read Flags: :Read Memory: 5c4978 [T] 5c4979 [T] 5c497a [T] 5c497b [T] :
598 | TID: 2:IP: 77218dcb:Disasm test eax, 0x81010100:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eax[T]: 7efefefe: al[T]: 7efefefe: ah[T]: 7efefefe: ax[T]: 7efefefe: :Read Flags: :Read Memory: :
599 | TID: 2:IP: 77218dd0:Disasm jnz 0x77218dd9:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: eflags[T]: 246: :Read Flags: 0:[T 40:zf ]:Values:246:Read Memory: :
600 | TID: 2:IP: 77218dd2:Disasm mov dword ptr [edi], edx:IMG: C:\Windows\system32\msvcrt.dll:RTN: strcat:Read Regs: edi: 345f9f0: edx[T]: 61616161: ds: 23: dl[T]: 61616161: dh[T]: 61616161: dx[T]: 61616161: di: 345f9f0: :Read Flags: :Read Memory: :
601 | TID: 2:IP: 401806:Disasm leave :IMG: C:\Users\sunirge\Downloads\vulnserver\vulnserver.exe:RTN: unnamedImageEntryPoint:Read Regs: ebp: 345f9d8: esp: 345f980: ss: 23: bp: 345f9d8: sp: 345f980: :Read Flags: :Read Memory: 345f9d8 [T] 345f9d9 [T] 345f9da [T] 345f9db [T] :
602 | TID: 2:IP: 401807:Disasm ret :IMG: C:\Users\sunirge\Downloads\vulnserver\vulnserver.exe:RTN: unnamedImageEntryPoint:Read Regs: esp: 345f9dc: ss: 23: sp: 345f9dc: :Read Flags: :Read Memory: 345f9dc [T] 345f9dd [T] 345f9de [T] 345f9df [T] :
603 | TID: 2 Exception reason:  Exception code c0000005 Value: 00000000
604 | Unhandled Exception Thread 2: name UnhandledExceptionFilter: exception code c0000005: Is not continuable? 0: address 61616161
605 | Exception param 0: 0
606 | Exception param 1: 61616161
607 | Access Violation
608 | Read exception
609 | @ address : 61616161
610 | EIP: 61616161
611 | EBP: 61616161
612 | ESP: 345f9e0
613 | EFlags: 246
614 | SegCs: 1b
615 | SegSs: 23
616 | ESI: 0
617 | EDI: 0
618 | Eax: 345f990
619 | Ebx: 7c
620 | Ecx: 5c4980
621 | Edx: 0
622 | SegDs: 23
623 | SegEs: 23
624 | SegFs: 3b
625 | SegGs: 0
626 | IMG name:: Unknown
627 | IMG StartAddress: 0
628 | RTN name: Unknown
629 | CrashRVA:: 61616161
630 | Exception, exiting application
631 | 


--------------------------------------------------------------------------------