PVDasm v1.7b (32Bit / 64Bit) [Archive] - RCE Messageboard's Regroupment

Bengaly

March 27th, 2011, 03:49

Hey guys,

Last build was last year! I feel so bad for keeping you guys (PVDasm fans or not) for so long haha, but Kayaker reminded me it was time to make a new build, so here we go!

Since PVDasm site has been removed, I will try get a new homepage for it, so meanwhile, I will upload new builds here.

here is what's new as for 27.03.2011:

Quote:

* Fixed a nasty bug in the PE Import scanner which caused PVDasm to crash.

Quote:

* Known Issues:

1. in x64 PVDasm, the menu items are bad! I know.. I'm trying to figure it out, It seems VisualStudio doesn't load the BMP list correctly.

2. PVdasm may on several PCs not run, due to missing Distributibal x86/x64 vc++ packages, In case it happens, please let me know!

Hashes:

Code:



PVDasm.exe (32Bit) MD5 hash    : e9e321f11004fbb5901aed1b26a88c5b

PVDasm.exe (64Bit) MD5 hash    : 47cf654bcb6b01e991e8526d7a0fd2c0



PVDasm.v1.7b.32Bit.zip MD5 hash    : eaaf4c45a2fd7f10fd2a11fe2c61f136

PVDasm.v1.7b.64Bit.zip MD5 hash    : 0fb4e27c94a09ae8631a60619f006e47

Downloads:

2447
2448

Also included is the new PVDasm Open Sourced Disasm Core Engine v1.05:

2449

Enjoy Guys

Maximus

March 27th, 2011, 05:10

Hi ben,

congratulations for the code - a VERY clean disassembler.

Bengaly

March 27th, 2011, 08:57

Quote:

[Originally Posted by Maximus;89904]Hi ben,

congratulations for the code - a VERY clean disassembler.

Thanks! It was always meant to be fairly easy to read/learn from!

dELTA

April 21st, 2011, 08:55

Thanks Bengaly, I created a separate CRCETL entry for the disassembly engine too.

http://www.woodmann.com/collaborative/tools/PVDasm_Disassembly_Core_Engine

Bengaly

May 18th, 2011, 09:01

Quote:

[Originally Posted by dELTA;90098]Thanks Bengaly, I created a separate CRCETL entry for the disassembly engine too.

http://www.woodmann.com/collaborative/tools/PVDasm_Disassembly_Core_Engine

That's cool, thanks dELTA

Bengaly

June 28th, 2011, 05:34

Just a quick update,
PVDasm has now a new homepage:

http://www.pvdasm.tk-labs.com

With the courtesy and generosity of Darkelf.

ReaL|sty

December 6th, 2011, 01:24

bug found in latest version... please your PM inbox

My Best Regards

blabberer

December 20th, 2011, 11:04

hi bengaly

i was replying to the chip8 disassembler thread and i remembered your pvdasm was able to disassemble it so wanted to confirm and i downloaded the latest 32bit version
and tried to disassemble a tetris game that i found in net

it seemed to be disassemble it but pvdasm crashed so i am posting a windbg !analyze -v below for your referance

Code:





Microsoft (R) Windows Debugger Version 6.12.0002.633 X86

Copyright (c) Microsoft Corporation. All rights reserved.



*** wait with pending attach

Symbol search path is: SRV*F:\symbols*http://msdl.microsoft.com/download/symbols

Executable search path is: 

ModLoad: 00400000 00472000   C:\Documents and Settings\Admin\Desktop\PVDasm.v1.7d.32Bit\PVDasm.exe

ModLoad: 7c900000 7c9b2000   C:\WINDOWS\system32\ntdll.dll

ModLoad: 7c800000 7c8f6000   C:\WINDOWS\system32\kernel32.dll

ModLoad: 64d00000 64d34000   C:\Program Files\Alwil Software\Avast5\snxhk.dll

ModLoad: 5d090000 5d12a000   C:\WINDOWS\system32\COMCTL32.dll

ModLoad: 77dd0000 77e6b000   C:\WINDOWS\system32\ADVAPI32.dll

ModLoad: 77e70000 77f02000   C:\WINDOWS\system32\RPCRT4.dll

ModLoad: 77fe0000 77ff1000   C:\WINDOWS\system32\Secur32.dll

ModLoad: 77f10000 77f59000   C:\WINDOWS\system32\GDI32.dll

ModLoad: 7e410000 7e4a1000   C:\WINDOWS\system32\USER32.dll

ModLoad: 763b0000 763f9000   C:\WINDOWS\system32\COMDLG32.dll

ModLoad: 7c9c0000 7d1d7000   C:\WINDOWS\system32\SHELL32.dll

ModLoad: 77c10000 77c68000   C:\WINDOWS\system32\msvcrt.dll

ModLoad: 77f60000 77fd6000   C:\WINDOWS\system32\SHLWAPI.dll

ModLoad: 774e0000 7761d000   C:\WINDOWS\system32\ole32.dll

ModLoad: 77120000 771ab000   C:\WINDOWS\system32\OLEAUT32.dll

ModLoad: 76390000 763ad000   C:\WINDOWS\system32\IMM32.DLL

ModLoad: 773d0000 774d3000   C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll

ModLoad: 10000000 1000e000   C:\Documents and Settings\Admin\Desktop\PVDasm.v1.7d.32Bit\AddIns\RAHexEd.dll

ModLoad: 00990000 00999000   C:\Documents and Settings\Admin\Desktop\PVDasm.v1.7d.32Bit\Plugins\CLD.dll

ModLoad: 5ad70000 5ada8000   C:\WINDOWS\system32\uxtheme.dll

ModLoad: 74720000 7476c000   C:\WINDOWS\system32\MSCTF.dll

ModLoad: 77b40000 77b62000   C:\WINDOWS\system32\apphelp.dll

ModLoad: 755c0000 755ee000   C:\WINDOWS\system32\msctfime.ime

ModLoad: 605d0000 605d9000   C:\WINDOWS\system32\mslbui.dll

ModLoad: 76fd0000 7704f000   C:\WINDOWS\system32\CLBCATQ.DLL

ModLoad: 77050000 77115000   C:\WINDOWS\system32\COMRes.dll

ModLoad: 77c00000 77c08000   C:\WINDOWS\system32\VERSION.dll

ModLoad: 64e40000 64e62000   C:\Program Files\Alwil Software\Avast5\ashShell.dll

ModLoad: 3fde0000 40221000   C:\WINDOWS\system32\msi.dll

ModLoad: 62830000 62856000   C:\WINDOWS\system32\AcSignIcon.dll

ModLoad: 73000000 73026000   C:\WINDOWS\system32\WINSPOOL.DRV

ModLoad: 74c80000 74cac000   C:\WINDOWS\system32\OLEACC.dll

ModLoad: 76080000 760e5000   C:\WINDOWS\system32\MSVCP60.dll

ModLoad: 769c0000 76a74000   C:\WINDOWS\system32\USERENV.dll

ModLoad: 77920000 77a13000   C:\WINDOWS\system32\SETUPAPI.dll

ModLoad: 76990000 769b5000   C:\WINDOWS\system32\ntshrui.dll

ModLoad: 76b20000 76b31000   C:\WINDOWS\system32\ATL.DLL

ModLoad: 5b860000 5b8b5000   C:\WINDOWS\system32\NETAPI32.dll

ModLoad: 76980000 76988000   C:\WINDOWS\system32\LINKINFO.dll

ModLoad: 013e0000 016a5000   C:\WINDOWS\system32\xpsp2res.dll

(874.c40): Access violation - code c0000005 (!!! second chance !!!)

eax=ffffffff ebx=00050474 ecx=0096e000 edx=0096dff0 esi=0013e188 edi=012e0a74

eip=004014ed esp=0013dd08 ebp=0013dd58 iopl=0         nv up ei pl nz ac pe nc

cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000216

*** WARNING: Unable to verify checksum for C:\Documents and Settings\Admin\Desktop\PVDasm.v1.7d.32Bit\PVDasm.exe

*** ERROR: Module load completed but symbols could not be loaded for C:\Documents and Settings\Admin\Desktop\PVDasm.v1.7d.32Bit\PVDasm.exe

PVDasm+0x14ed:

004014ed 0f6f01          movq    mm0,mmword ptr [ecx] ds:0023:0096e000=????????????????

0:000> !analyze -v

*******************************************************************************

*                                                                             *

*                        Exception Analysis                                   *

*                                                                             *

*******************************************************************************





FAULTING_IP: 

PVDasm+14ed

004014ed 0f6f01          movq    mm0,mmword ptr [ecx]



EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)

ExceptionAddress: 004014ed (PVDasm+0x000014ed)

   ExceptionCode: c0000005 (Access violation)

  ExceptionFlags: 00000000

NumberParameters: 2

   Parameter[0]: 00000000

   Parameter[1]: 0096e000

Attempt to read from address 0096e000



FAULTING_THREAD:  00000c40



PROCESS_NAME:  PVDasm.exe



ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".



EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".



EXCEPTION_PARAMETER1:  00000000



EXCEPTION_PARAMETER2:  0096e000



READ_ADDRESS:  0096e000 



FOLLOWUP_IP: 

PVDasm+14ed

004014ed 0f6f01          movq    mm0,mmword ptr [ecx]



MOD_LIST: <ANALYSIS/>



NTGLOBALFLAG:  0



APPLICATION_VERIFIER_FLAGS:  0



BUGCHECK_STR:  APPLICATION_FAULT_INVALID_POINTER_READ_FILL_PATTERN_ffffffff



PRIMARY_PROBLEM_CLASS:  INVALID_POINTER_READ_FILL_PATTERN_ffffffff



DEFAULT_BUCKET_ID:  INVALID_POINTER_READ_FILL_PATTERN_ffffffff



LAST_CONTROL_TRANSFER:  from 0040f98b to 004014ed



STACK_TEXT:  

WARNING: Stack unwind information not available. Following frames may be wrong.

0013dd58 0040f98b 0096dff0 efa1138a 0013df4c PVDasm+0x14ed

0013dee4 7e418734 00050474 0000004e 00000430 PVDasm+0xf98b

0013df10 7e423ce4 0040f840 00050474 0000004e USER32!InternalCallWinProc+0x28

0013df7c 7e423b30 00000000 0040f840 00050474 USER32!UserCallDlgProcCheckWow+0x146

0013dfc4 7e43e599 00000000 0000004e 00000430 USER32!DefDlgProcWorker+0xa8

0013dfe0 7e418734 00050474 0000004e 00000430 USER32!DefDlgProcA+0x22

0013e00c 7e418816 7e43e577 00050474 0000004e USER32!InternalCallWinProc+0x28

0013e074 7e42927b 00000000 7e43e577 00050474 USER32!UserCallWinProcCheckWow+0x150

0013e0b0 7e4292e3 006cbc28 006c7200 00000430 USER32!SendMessageWorker+0x4a5

0013e0d0 5d096751 00050474 0000004e 00000430 USER32!SendMessageW+0x7f

0013e168 5d0ac53f 0016a5f0 ffffff4f 0013e188 COMCTL32!CCSendNotify+0x748

0013e1c4 5d0a6ee6 0016a5f0 0000001b 0013e580 COMCTL32!ListView_OnGetItem+0x26b

0013e504 5d0a6adb 0013e568 0013e610 0000005d COMCTL32!ListView_RDrawItem+0x17e

0013e520 5d09af22 0013e568 2d011082 0016a5f0 COMCTL32!ListView_DrawItem+0x206

0013e5d4 5d09add8 0000005d 2d011082 0013e610 COMCTL32!ListView_Redraw+0x1f1

0013e64c 5d09872e 0016a5f0 00000000 0013e828 COMCTL32!ListView_OnPaint+0x10f

0013e7c0 7e418734 0004046e 0000000f 00000000 COMCTL32!ListView_WndProc+0x7ec

0013e7ec 7e418816 5d096e16 0004046e 0000000f USER32!InternalCallWinProc+0x28

0013e854 7e42a013 00000000 5d096e16 0004046e USER32!UserCallWinProcCheckWow+0x150

0013e884 7e42a998 ffff05a7 0004046e 0000000f USER32!CallWindowProcAorW+0x98

0013e8a4 0040c1c9 ffff05a7 0004046e 0000000f USER32!CallWindowProcA+0x1b

0013e954 7e418734 0004046e 0000000f 00000000 PVDasm+0xc1c9

0013e980 7e418816 0040bdf0 0004046e 0000000f USER32!InternalCallWinProc+0x28

0013e9e8 7e428ea0 00000000 0040bdf0 0004046e USER32!UserCallWinProcCheckWow+0x150

0013ea3c 7e428eec 006cd5b0 0000000f 00000000 USER32!DispatchClientMessage+0xa3

0013ea64 7c90e473 0013ea74 00000018 006cd5b0 USER32!__fnDWORD+0x24

0013ea88 7e42aef1 7e42aedc 0004046e 0000005e ntdll!KiUserCallbackDispatcher+0x13

0013ea9c 5d0f200a 0004046e 00000005 0016a5f0 USER32!NtUserCallHwndLock+0xc

0013ead4 5d0f5136 0016a5f0 00000005 00000036 COMCTL32!ListView_ComOnScroll+0x10a

0013eaf4 5d0ed824 0016a5f0 00000005 00000036 COMCTL32!ListView_ROnScroll+0x25

0013eb30 5d0ed88e 0016a5f0 00000005 00000036 COMCTL32!ListView_OnHVScroll+0x5f

0013eb48 5d099021 0016a5f0 00000000 00000005 COMCTL32!ListView_OnVScroll+0x15

0013ecc4 7e418734 0004046e 00000115 00360005 COMCTL32!ListView_WndProc+0x637

0013ecf0 7e418816 5d096e16 0004046e 00000115 USER32!InternalCallWinProc+0x28

0013ed58 7e42a013 00000000 5d096e16 0004046e USER32!UserCallWinProcCheckWow+0x150

0013ed88 7e42a998 ffff05a7 0004046e 00000115 USER32!CallWindowProcAorW+0x98

0013eda8 0040c1c9 ffff05a7 0004046e 00000115 USER32!CallWindowProcA+0x1b

0013ee58 7e418734 0004046e 00000115 00360005 PVDasm+0xc1c9

0013ee84 7e418816 0040bdf0 0004046e 00000115 USER32!InternalCallWinProc+0x28

0013eeec 7e42927b 00000000 0040bdf0 0004046e USER32!UserCallWinProcCheckWow+0x150

0013ef28 7e4292e3 006cd5b0 006c6040 00360005 USER32!SendMessageWorker+0x4a5

0013ef48 5ad99b1e 0004046e 00000115 00360005 USER32!SendMessageW+0x7f

0013ef6c 5ad9a2fb 0004046e 00000005 00000036 uxtheme!CUxScrollBar:oScroll+0x4d

0013ef9c 5ad9a657 0004046e 0013f02c 00000086 uxtheme!xxxMoveThumb+0x4d

0013efbc 5ad9a0eb 0004046e 00000200 00000001 uxtheme!_TrackThumb+0x89

0013f00c 5ad9abfa 003e4f18 00a304ea 0013f02c uxtheme!xxxSBTrackLoop+0x154

0013f094 5ad9ac3e 0004046e 00a304ea 00000000 uxtheme!_SBTrackInit+0x32d

0013f0ac 5ad90236 0004046e 0000f087 00f504e6 uxtheme!HandleScrollCmd+0x28

0013f0c4 5ad71ac7 003e4a98 0013f0e0 00f504e6 uxtheme!OnDwpSysCommand+0x34

0013f114 5ad71b3d 5ad8c7cb 00000000 0000f087 uxtheme!_ThemeDefWindowProc+0x13a

0013f130 7e4294ed 0004046e 00000112 0000f087 uxtheme!ThemeDefWindowProcW+0x18

0013f178 5d096f83 0004046e 00000112 0000f087 USER32!DefWindowProcW+0x6b

0013f2f4 7e418734 0004046e 00000112 0000f087 COMCTL32!ListView_WndProc+0xb4

0013f320 7e418816 5d096e16 0004046e 00000112 USER32!InternalCallWinProc+0x28

0013f388 7e42a013 00000000 5d096e16 0004046e USER32!UserCallWinProcCheckWow+0x150

0013f3b8 7e42a998 ffff05a7 0004046e 00000112 USER32!CallWindowProcAorW+0x98

0013f3d8 0040c1c9 ffff05a7 0004046e 00000112 USER32!CallWindowProcA+0x1b

0013f488 7e418734 0004046e 00000112 0000f087 PVDasm+0xc1c9

0013f4b4 7e42bdf1 0040bdf0 0004046e 00000112 USER32!InternalCallWinProc+0x28

0013f51c 7e42927b 00000000 0040bdf0 0004046e USER32!UserCallWinProcCheckWow+0xea

0013f558 7e4292e3 006cd5b0 006c6040 0000f087 USER32!SendMessageWorker+0x4a5

0013f578 5ad98895 0004046e 00000112 0000f087 USER32!SendMessageW+0x7f

0013f59c 5ad71ac7 003e4a98 0013f5b8 00f504e6 uxtheme!OnDwpNcLButtonDown+0xa8

0013f5ec 5ad71b3d 5ad987ed 00000000 00000007 uxtheme!_ThemeDefWindowProc+0x13a

0013f608 7e4294ed 0004046e 000000a1 00000007 uxtheme!ThemeDefWindowProcW+0x18

0013f650 5d096f83 0004046e 000000a1 00000007 USER32!DefWindowProcW+0x6b

0013f7cc 7e418734 0004046e 000000a1 00000007 COMCTL32!ListView_WndProc+0xb4

0013f7f8 7e418816 5d096e16 0004046e 000000a1 USER32!InternalCallWinProc+0x28

0013f860 7e42a013 00000000 5d096e16 0004046e USER32!UserCallWinProcCheckWow+0x150

0013f890 7e42a998 ffff05a7 0004046e 000000a1 USER32!CallWindowProcAorW+0x98

0013f8b0 0040c1c9 ffff05a7 0004046e 000000a1 USER32!CallWindowProcA+0x1b

0013f960 7e418734 0004046e 000000a1 00000007 PVDasm+0xc1c9

0013f98c 7e418816 0040bdf0 0004046e 000000a1 USER32!InternalCallWinProc+0x28

0013f9f4 7e4189cd 00000000 0040bdf0 0004046e USER32!UserCallWinProcCheckWow+0x150

0013fa54 7e4196c7 00455e48 00000001 0013fbf0 USER32!DispatchMessageWorker+0x306

0013fa64 00410f79 00455e48 efa1369e 00000000 USER32!DispatchMessageA+0xf

0013fbf0 7e418734 00050474 00000110 0004046e PVDasm+0x10f79

0013fc1c 7e42413c 0040f840 00050474 00000110 USER32!InternalCallWinProc+0x28

0013fc88 7e423b30 00000000 0040f840 00050474 USER32!UserCallDlgProcCheckWow+0xf0

0013fcd0 7e43e599 00000000 00000110 0004046e USER32!DefDlgProcWorker+0xa8

0013fcec 7e418734 00050474 00000110 0004046e USER32!DefDlgProcA+0x22

0013fd18 7e418816 7e43e577 00050474 00000110 USER32!InternalCallWinProc+0x28

0013fd80 7e42927b 00000000 7e43e577 00050474 USER32!UserCallWinProcCheckWow+0x150

0013fdbc 7e42651a 006cbc28 006c7200 0004046e USER32!SendMessageWorker+0x4a5

0013fe74 7e4249b1 00000000 006cbc28 00000000 USER32!InternalCreateDialog+0x9df

0013fea8 7e424a06 00400000 0045a050 00000000 USER32!InternalDialogBox+0xa9

0013fec8 7e43b190 00400000 0045a050 00000000 USER32!DialogBoxIndirectParamAorW+0x37

0013fef4 00411820 00400000 00000065 00000000 USER32!DialogBoxParamA+0x4c

0013ff30 0043b18c 00400000 00000000 001623f8 PVDasm+0x11820

0013ffc0 7c817077 0343d708 7c90d96e 7ffdf000 PVDasm+0x3b18c

0013fff0 00000000 0043b1df 00000000 78746341 kernel32!BaseProcessStart+0x23





SYMBOL_STACK_INDEX:  0



SYMBOL_NAME:  PVDasm+14ed



FOLLOWUP_NAME:  MachineOwner



MODULE_NAME: PVDasm



DEBUG_FLR_IMAGE_TIMESTAMP:  4e47f6f2



STACK_COMMAND:  dt ntdll!LdrpLastDllInitializer BaseDllName ; dt ntdll!LdrpFailureData ; ~0s ; kb



BUCKET_ID:  APPLICATION_FAULT_INVALID_POINTER_READ_FILL_PATTERN_ffffffff_PVDasm+14ed



IMAGE_NAME:  C:\Documents and Settings\Admin\Desktop\PVDasm.v1.7d.32Bit\PVDasm.exe



FAILURE_BUCKET_ID:  INVALID_POINTER_READ_FILL_PATTERN_ffffffff_c0000005_C:_Documents_and_Settings_Admin_Desktop_PVDasm.v 1.7d.32Bit_PVDasm.exe!Unknown



Followup: MachineOwner

---------

Bengaly

January 15th, 2012, 03:28

Thanks I will check the Chip8 cpu module for the crash