DumpAnalysis.org Wishes Happy New Year 7DA!

2010 (7DA) is The Year of Dump Analysis!

Happy Memories in 2010 (0x7DA)

Try to find 2010 in the corrupt code after committing the greeting to memory:

0:000> u eip
ntdll!KiFastSystemCallRet:
7c90e514 c3 ret
7c90e515 8da42400000000 lea esp,[esp]
7c90e51c 8d642400 lea esp,[esp]
ntdll!KiIntSystemCall:
7c90e520 8d542408 lea edx,[esp+8]
7c90e524 cd2e int 2Eh
7c90e526 c3 ret
7c90e527 90 nop
ntdll!RtlRaiseException:
7c90e528 55 push ebp
0:000> u
ntdll!RtlRaiseException+0x1:
7c90e529 8bec mov ebp,esp
7c90e52b 9c pushfd
7c90e52c 81ecd0020000 sub esp,2D0h
7c90e532 8985dcfdffff mov dword ptr [ebp-224h],eax
7c90e538 898dd8fdffff mov dword ptr [ebp-228h],ecx
7c90e53e 8b4508 mov eax,dword ptr [ebp+8]
7c90e541 8b4d04 mov ecx,dword ptr [ebp+4]
7c90e544 89480c mov dword ptr [eax+0Ch],ecx
0:000> u
ntdll!RtlRaiseException+0x1f:
7c90e547 8d852cfdffff lea eax,[ebp-2D4h]
7c90e54d 8988b8000000 mov dword ptr [eax+0B8h],ecx
7c90e553 8998a4000000 mov dword ptr [eax+0A4h],ebx
7c90e559 8990a8000000 mov dword ptr [eax+0A8h],edx
7c90e55f 89b0a0000000 mov dword ptr [eax+0A0h],esi
7c90e565 89b89c000000 mov dword ptr [eax+9Ch],edi
7c90e56b 8d4d0c lea ecx,[ebp+0Ch]
7c90e56e 8988c4000000 mov dword ptr [eax+0C4h],ecx
0:000> u
ntdll!RtlRaiseException+0x4c:
7c90e574 8b4d00 mov ecx,dword ptr [ebp]
7c90e577 8988b4000000 mov dword ptr [eax+0B4h],ecx
7c90e57d 8b4dfc mov ecx,dword ptr [ebp-4]
7c90e580 48 dec eax
7c90e581 61 popad
7c90e582 7070 jo ntdll!_CIcos+0xe (7c90e5f4)
7c90e584 7920 jns ntdll!RtlRaiseException+0x7e (7c90e5a6)
7c90e586 4d dec ebp
0:000> u
ntdll!RtlRaiseException+0x5f:
7c90e587 656d ins dword ptr es:[edi],dx
7c90e589 6f outs dx,dword ptr [esi]
7c90e58a 7269 jb ntdll!_CIcos+0xf (7c90e5f5)
7c90e58c 657320 jae ntdll!RtlRaiseException+0x87 (7c90e5af)
7c90e58f 696e202020da07 imul ebp,dword ptr [esi+20h],7DA2020h
7c90e596 0000 add byte ptr [eax],al
7c90e598 2121 and dword ptr [ecx],esp
7c90e59a 2121 and dword ptr [ecx],esp
0:000> u
ntdll!RtlRaiseException+0x74:
7c90e59c 0000 add byte ptr [eax],al
7c90e59e 8ca88c000000 mov word ptr [eax+8Ch],gs
7c90e5a4 8c90c8000000 mov word ptr [eax+0C8h],ss
7c90e5aa c70007000100 mov dword ptr [eax],10007h
7c90e5b0 6a01 push 1
7c90e5b2 50 push eax
7c90e5b3 ff7508 push dword ptr [ebp+8]
7c90e5b6 e8f3f3ffff call ntdll!NtRaiseException (7c90d9ae)