[37298] in bugtraq
Re: BoF in Windows 2000: ddeshare.exe
daemon@ATHENA.MIT.EDU (J. S. Connell)
Wed Nov 10 16:28:23 2004
Date: Wed, 10 Nov 2004 11:19:08 -0800 (PST)
From: "J. S. Connell" <ankh@canuck.gen.nz>
To: bugtraq@securityfocus.com
In-Reply-To: <200411091959.iA9JxKaL009177@turing-police.cc.vt.edu>
Message-ID: <Pine.LNX.4.44.0411101112370.27973-100000@canuck.gen.nz>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
On Tue, 9 Nov 2004 Valdis.Kletnieks@vt.edu wrote:
> Ah, but what if the 2 trailing B's are replaced by 2 Unicode chars that
> together take up 4 bytes? ;)
Or we can realize that in Windows NT, XP, and above, all "characters" are
two-byte-wide UNICODE characters, and that we're not seeing "[NULs]
inserted between characters" but simply UNICODE characters with very low
ordinals.
It's probably worth pointing out that a large fraction of the 16-bit
UNICODE space is taken up with Chinese, Japanese, and Korean characters.
In fact, UNICODE codepoint 0x9090 happens to be the Chinese character for
[li3], "winding" or "meandering". Chinese poetry shellcode, anybody?
--Jeffrey
