Record Inspector: diagnosing a boundary violation.
A controlled file-parser exercise demonstrating structured-input mutation, crash analysis, Ghidra root-cause identification, binary-level remediation, and regression testing.
Executive summary
The parser successfully imported 16-, 32-, and 64-byte payloads, but a 128-byte payload triggered Windows exception 0xC0000005. Debugging revealed a write at index 64 into an inaccessible page. Static analysis showed an unchecked copy loop using a file-derived length.
Crash evidence
mov byte ptr [rax+rcx],dlRCX = 0x40 (64)...0x10000xC0000005The function committed two memory pages, made the second page inaccessible, and placed the destination 64 bytes before the page boundary. Its copy loop used the supplied payload length without checking that capacity.
Binary hotfix
A code-cave validation stub checks the unsigned payload length against 0x40. Acceptable lengths continue to the original function; oversized lengths terminate with exit code 7.
0x0848–0x08490x0D00–0x0D1780A97B2F11658D66FFD9063B40867C719840A00CB929F0A051B764BD60AC372ERegression results
| Payload bytes | Observed outcome | Exit code |
|---|---|---|
| 16 | Imported | 0 |
| 32 | Imported | 0 |
| 64 | Imported | 0 |
| 65 | Rejected | 7 |
| 128 | Rejected | 7 |
Scope and limits
This was a purpose-built educational binary. The patch protects the tested caller, not the unchecked function itself. A source-level repair would enforce the capacity within the processing routine and include broader tests.
Flag exercise
The hidden 20-byte flag was recovered by XOR-decoding a data array with the constant 0x5A, demonstrating basic string obfuscation analysis. Its flag was GRE{b0und4ry_ch3ck5}.