Hello,

I have an avi file that realplayer can normally play it with no problem, however when I change certain DWORD within the file, application crashes.

I tried to find out what the problem is. so I set a bp on readfile API to catch program when it read DWORD value from the file and then I start tracing of this value usage within application.

my problem is that various functions in realplayer store this DWORD (sometimes results of certain arithmetic that is done based on this DWORD) at various places on stack.
There are just four Hardware breakpoints, so I use memory breakpoint to trace these values on stack, however as olly says:
"You are going to set memory breakpoint on stack. As long as this breakpoint is active, some system calls may fail, terminating.the application or changing its behavior. Do you still want to set this breakpoint?"

So, There is no more Hardware Breakpoint and I can't use memory breakpoints.

any idea from you experts is really appreciated.

Pardon the crazy question, but do you normally change random bytes in your AVI files? Or is this some sort of fuzzing on RealPlayer.

Now, what it sounds like is that you're modifying something that describes the size of the file, or dimensions of the video frames, or something like that. As a starting place, if you haven't already, I would grab documentation of the AVI format, and see what you're changing. If you KNOW what you're changing, then we can move on from there.

Hello frank,

It is the result of fuzzing.
It seems it's the size of something.

please have a look to this thread too:
http://www.woodmann.com/forum/showthread.php?14367-how-to-analyze-a-vulnerability&p=90355#post90355

static.

OK, if this is an AVI file, do you have the spec to know what you're changing?

In a situation like this, tools similar to the following are often quite efficient, without even necessitating tracing the value itself in memory, but rather just find the condition where things start to differ right away:

http://www.woodmann.com/collaborative/tools/Conditional_Branch_Logger