Improbable Occurrence

We were analyzing a raw thread stack when came upon this symbolic address which we thought was coincidental (Volume 1, page 390):

363b0030 77777777 advapi32!LsaEnumerateAccountRights+0×56

Forward disassembly makes sense here and every instruction has a purpose:

0:000> u 77777777
advapi32!LsaEnumerateAccountRights+0×56:
77777777 a4            movs byte ptr es:[edi],byte ptr [esi]
77777778 fc            cld
77777779 ffc3          inc ebx
7777777b 8b65e8        mov esp,dword ptr [ebp-18h]
7777777e ff75e0        push dword ptr [ebp-20h]
77777781 ff15e4187377  call dword ptr [advapi32!_imp__I_RpcMapWin32Status
(777318e4)]
77777787 50            push eax
77777788 e8c6f6fbff    call advapi32!LsapApiReturnResult (77736e53)
..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset