#######################################################################

                             Luigi Auriemma

Application:  Microsoft Reader
              http://www.microsoft.com/reader
Versions:     <= 2.1.1.3143 (PC version)
              <= 2.6.1.7169 (Origami version)
              the non-PC versions have not been tested
Platforms:    Windows, Windows Mobile, Tablet PC and UMPC devices
Bug:          heap overflow
Date:         11 Apr 2011
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Microsoft Reader is a software needed to read and catalog the ebooks in
LIT format and the Audible audio books bought via internet, indeed the
homepage acts also as online store for these protected contents.


#######################################################################

======
2) Bug
======


Heap overflow caused by the allocation of a certain amount of memory
and the copying of arbitrary data during the decompression of the
sections.

A quick trace of the sum operations performed with the entry
size/offset values and then the function that performs the copying:

  0107F517  |> 8B85 E0FDFFFF  MOV EAX,DWORD PTR SS:[EBP-220]    ; second 64bit number (entry->size)
  0107F51D  |. 0B85 E4FDFFFF  OR EAX,DWORD PTR SS:[EBP-21C]
  0107F523  |. 74 12          JE SHORT msreader.0107F537
  0107F525  |. 8B46 60        MOV EAX,DWORD PTR DS:[ESI+60]     ; 64bit total size
  0107F528  |. 8B4E 64        MOV ECX,DWORD PTR DS:[ESI+64]
  0107F52B  |. 0185 D8FDFFFF  ADD DWORD PTR SS:[EBP-228],EAX    ; added to the first 64bit number (entry->offset)
  0107F531  |. 118D DCFDFFFF  ADC DWORD PTR SS:[EBP-224],ECX
  0107F537  |> FF75 18        PUSH DWORD PTR SS:[EBP+18]
  0107F53A  |. 8D85 D8FDFFFF  LEA EAX,DWORD PTR SS:[EBP-228]
  0107F540  |. FF75 14        PUSH DWORD PTR SS:[EBP+14]
  0107F543  |. 50             PUSH EAX
  0107F544  |. FF76 74        PUSH DWORD PTR DS:[ESI+74]
  0107F547  |. 56             PUSH ESI
  0107F548  |. FF75 0C        PUSH DWORD PTR SS:[EBP+C]
  0107F54B  |. E8 DEBEFEFF    CALL msreader.0106B42E
  ...
  0106B596  |. 8B71 48        MOV ESI,DWORD PTR DS:[ECX+48]     ; second 64bit number (entry->size)
  0106B599  |. 897D F0        MOV DWORD PTR SS:[EBP-10],EDI
  0106B59C  |. 13C2           ADC EAX,EDX
  0106B59E  |. 03F3           ADD ESI,EBX                       ; added to the 64bit total size
  0106B5A0  |. 8975 0C        MOV DWORD PTR SS:[EBP+C],ESI
  0106B5A3  |. 8B71 4C        MOV ESI,DWORD PTR DS:[ECX+4C]
  0106B5A6  |. 1371 44        ADC ESI,DWORD PTR DS:[ECX+44]
  0106B5A9  |. 5B             POP EBX
  0106B5AA  |. 3BD6           CMP EDX,ESI
  0106B5AC  |. 72 1C          JB SHORT msreader.0106B5CA
  0106B5AE  |. 77 08          JA SHORT msreader.0106B5B8
  ...
  01092A02  /. 55             PUSH EBP                          ; copying function
  ...skip...
    examples specific for the PoC msreader_2a.lit
    LocalAlloc  000a6f68    = 01610020
    ReadFile    000a6f68    (file offset 0x22f5d)
    LocalAlloc  000a6f68    = 016c0020
    DES decryption of the data read by the file with output in the second allocated buffer
    memcpy esi is 016c0020
    memcpy edi is 0022a008
  ...skip...
  01092B50  |. 8B45 FC        MOV EAX,DWORD PTR SS:[EBP-4]
  01092B53  |. 8B55 F4        MOV EDX,DWORD PTR SS:[EBP-C]
  01092B56  |. 8B7D 14        MOV EDI,DWORD PTR SS:[EBP+14]
  01092B59  |. 8BCB           MOV ECX,EBX
  01092B5B  |. 8D3410         LEA ESI,DWORD PTR DS:[EAX+EDX]
  01092B5E  |. 8BD1           MOV EDX,ECX
  01092B60  |. C1E9 02        SHR ECX,2
  01092B63  |. F3:A5          REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS>

The data copied in the heap buffer is exactly the one coming from the
file and decrypted with DES, that's why the bytes visible during the
copying can't be seen in the file.

I have provided two proof-of-concepts where the first shows the exact
location of the memcpy while the second will cause an exception during
the "call [ret+num]" instruction (could take some seconds to be
reached).

Modified bytes for msreader_2a.lit:
000005F6   84       40  ; from 0x230 to 0x40
000005F7   30       5F  ; modified only to keep the size of the subsequent entry string

Modified bytes for msreader_2b.lit:
000005F7   30       00  ; from 0x230 to 0x200


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/msreader_2.zip


#######################################################################

======
4) Fix
======


No fix.


#######################################################################