GREGO GUARD / RESEARCH REPORT · NOVEMBER 2026
Record Inspector 01 — Out-of-Bounds Write
Scope and finding
A purpose-built Windows x64 record parser accepted a declared payload length that could exceed a destination area with 64 writable bytes. A 128-byte structurally consistent record triggered Windows exception 0xC0000005 (access violation). The issue is consistent with CWE-787, Out-of-bounds Write.
Root cause
Using x64dbg, the faulting operation was identified as mov byte ptr [rax+rcx],dl at RVA 0x15E1, with RCX=0x40. Ghidra analysis showed an allocation of 0x2000 bytes, a second page switched to PAGE_NOACCESS, and a destination placed at offset 0xFC0 of the first page. The copy loop used the input-supplied length without enforcing the 64-byte writable capacity.
Controlled mitigation
A binary hotfix redirected the caller at RVA 0x1447 to a guard at RVA 0x1900. The guard compared the unsigned payload length against 64; valid lengths entered the original routine, while oversized lengths exited with code 7. File changes consisted of two displacement bytes at offsets 0x848–0x849 and 24 bytes at 0xD00–0xD17; the executable remained 4,608 bytes.
Regression results
| Payload length | Patched result |
|---|---|
| 16 bytes | Imported; exit 0 |
| 32 bytes | Imported; exit 0 |
| 64 bytes | Imported; exit 0 |
| 65 bytes | Rejected; exit 7 |
| 128 bytes | Rejected; exit 7 |
Original SHA-256: BBAC0699F7D9771CCEEFB79A2E6288D97E3A1CDCDC3DCFA065533722B3CD3C86
Patched SHA-256: 80A97B2F11658D66FFD9063B40867C719840A00CB929F0A051B764BD60AC372E
Limitation
The guard is a caller-side hotfix; the underlying vulnerable copy loop remains unchecked and should be fixed within the callee in a source-code remediation. Testing establishes the outcomes listed above, not exhaustive safety or exploitability.
Challenge flag
Decoded during static analysis with a repeating XOR key of 0x5A: GRE{b0und4ry_ch3ck5}.