Self modifying code problem

Submitted by id09542 on Fri, 2008-01-18 18:01. Bug Reports

Running FR 3.11 on Win/XP. Our corporate machines are beginning to strngthen policies on what can run on our machines, the latest victim is FR, we are not allowing code to modfy itself due to some virus attacks use this route. I now receive this meesage when FR runs:

1/18/2008 10:56:44 AM: The process 'D:\Program Files\FeedReader30\feedreader.exe' (as user xxxxxx\yyyyyyy) attempted to call the function CreateThread from a buffer (the return address was 0x404eaf). The code at this address is '0c5250b8 3c4e4000 505653e8 a9c4ffff 5f5e5b5d c20c008b c050e8a2 c4ffffc3' This either happens when a process uses self-modifying code or when a process has been subverted by a buffer overflow attack.

Thoughts anyone?

» login or register to post comments | 3647 reads

Greetings,

Submitted by ingmar on Fri, 2008-01-18 21:30.

Greetings,

FR doesn't modify code at all, we don't do those hacks.
Feedreader uses Firebird database librarys , SSL and embedded IE;
Do you have in FR some feeds that are requiring SSL, maybe something there, but this code is also protected. You could disable such feeds and try again.

Which program gives such error ? DEP or some antivirus heuristics.

Also our products are always scanned with antivirus programs.

Ingmar
------
FR dev

» login or register to post comments

We are using Cisco Security

Submitted by id09542 on Mon, 2008-01-21 13:51.

We are using Cisco Security Agent which monitors Registry changes, code execution etc. The company is turning up the agreesiveness of this function which is causing the above message to appear. Currently, I can bypass, but I fear in the future I will no longer be able to.

» login or register to post comments

Greetings, does this event

Submitted by ingmar on Mon, 2008-01-21 14:02.

Greetings,

does this event occurs every time ? Could you perform test like, leave just 3-4 (non https) feeds and run FR.
Feedreader uses also, embedded Internet Explorer object, is IE with all latest updates.

Could you test FR 3.12, we are using now latest (stable) Firebird dll's.

FR is developed under Delphi with range checking and other datasafe options,
so "buffer overflow attack" is quite unlikely.

Also you could test Feedreader MYSQL edition, this is alfa state product, does this error occours also there.

Ingmar
------
FR dev

» login or register to post comments

Feedreader 3