Notepad.exe fail fast while accessing ADS streams

Posted on : by : Lion

Today i want to share with you a “bug” in notepad.exe that you might want to play around with and look what really happens, might be a intersting little reversing project. My limited time currently does not allow me to dig deeper into it, therefore it just reported it as a potential security related crash to Microsoft. Today i got the answer that this is a self-induced fail fast, therefore they not gonna change anything.

Maybe someone wants to play around with it 🙂

  1. Open command line
  2. Create and save a new file (Example: cmd.exe -> notepad.exe test.txt)
  3. Create a ADS stream for that file containing /../ like notepad.exe test.txt:AAAAAAAAAAAAA[As many as possible]/../AAAAAAAAAA
  4. Watch notepad dying
  5. Attach a debugger and have fun 😉

On some machines it does crashes and on others it does not, don’t know why. I still have to play around with hiding stuff trough that mechanism if possible. When it does not crash, in the upper example it returns “The file .txt can not be found”.

Small video showing the crash:

Company Reviews

Leave a Reply

Your email address will not be published. Required fields are marked *