Format string and other vulnerabilities on Win32

["Andrew Thomas" <andrewt () nmh co za>]

Hi,

I'm wondering if anyone has discovered and successfully exploited any format
string vulnerabilites on Win32?

I've played around with code in DJGPP environment, and broken the code, but not
been able to dedicate the time and effort to figuring out exactly what I was
getting out/in, and *where*.

Also, to find vulnerabilities in win32, Halvar Flake discussed using IDA Pro
with scripts to search for badly formed function calls. Has anyone used scripts
to do blackbox analysis on major products?

Lastly, considering that MS VC++ designed products use a standard library, would
it not be possible to investigate closed source applications and find e.g.
strcpy calls by setting breakpoints with SoftIce or some other debugger?

Regards,
  Andrew Thomas.