{"action":"opened","issue":{"url":"https://api.github.com/repos/CERTCC-Vulnerability-Analysis/certfuzz/issues/2","repository_url":"https://api.github.com/repos/CERTCC-Vulnerability-Analysis/certfuzz","labels_url":"https://api.github.com/repos/CERTCC-Vulnerability-Analysis/certfuzz/issues/2/labels{/name}","comments_url":"https://api.github.com/repos/CERTCC-Vulnerability-Analysis/certfuzz/issues/2/comments","events_url":"https://api.github.com/repos/CERTCC-Vulnerability-Analysis/certfuzz/issues/2/events","html_url":"https://github.com/CERTCC-Vulnerability-Analysis/certfuzz/issues/2","id":140144087,"number":2,"title":"drillresults.py 's pc_in_mapped_address function doesn't handle 'None' types.","user":{"login":"redknight99","id":7261636,"avatar_url":"https://avatars.githubusercontent.com/u/7261636?v=3","gravatar_id":"","url":"https://api.github.com/users/redknight99","html_url":"https://github.com/redknight99","followers_url":"https://api.github.com/users/redknight99/followers","following_url":"https://api.github.com/users/redknight99/following{/other_user}","gists_url":"https://api.github.com/users/redknight99/gists{/gist_id}","starred_url":"https://api.github.com/users/redknight99/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/redknight99/subscriptions","organizations_url":"https://api.github.com/users/redknight99/orgs","repos_url":"https://api.github.com/users/redknight99/repos","events_url":"https://api.github.com/users/redknight99/events{/privacy}","received_events_url":"https://api.github.com/users/redknight99/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-03-11T10:05:22Z","updated_at":"2016-03-11T10:05:22Z","closed_at":null,"body":"Hey there,\r\n\r\nI've been fuzzing a program that sometimes crashes with a Read Access Violation on Instruction Pointer . (ECX sometimes controls EIP). This sometimes causes !exploitable to be unable to disassemble the faulting instruction . See below as an example.\r\n\r\n```\r\neax=03dfb3d0 ebx=03d6a6e0 ecx=9801a089 edx=e9529e5a esi=9801a089 edi=03d6a670\r\neip=9801a089 esp=08f0f8c4 ebp=08f0f8e8 iopl=0         nv up ei pl zr na pe nc\r\ncs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246\r\n9801a089 ??              ???\r\nHostMachine\\HostUser\r\nExecuting Processor Architecture is x86\r\nDebuggee is in User Mode\r\nDebuggee is a live user mode debugging session on the local machine\r\nEvent Type: Exception\r\n*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\\WINDOWS\\SysWOW64\\KERNELBASE.dll - \r\n*** ERROR: Symbol file could not be found.  Defaulted to export symbols for ntdll.dll - \r\n*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\\WINDOWS\\SysWOW64\\KERNEL32.DLL - \r\nException Faulting Address: 0x9801a089\r\nSecond Chance Exception Type: STATUS_ACCESS_VIOLATION (0xC0000005)\r\nException Sub-Type: Read Access Violation\r\n\r\nError: Unable to disassemble the faulting instruction.\r\nError: Gather Rule #23 in !exploitable failed\r\nquit:\r\n```\r\n\r\nThese .msec entries will cause drillresults.py to crash . I've implemented a local fix to let drillresults.py to fail gracefully , letting me know which entries to remove. I can put in a pull request if you'd like.  "}}