Crash when throwing exception inside loaded dll. #4

Activity

1. JesseKlugmann commented on Jul 25, 2012

   

   JesseKlugmann

   on Jul 25, 2012

   More actions

   Hi

   A temporary fix is to disable DEP[1] in the Visual Studio build options. Another possibility is to implement the missing parts of the pe loading process in MemoryModule. I'll provide some code, if I get an allowance from my boss.

   [1] DEP: http://en.wikipedia.org/wiki/Data_Execution_Prevention
2. fancycode commented on Oct 29, 2012

   

   fancycode

   on Oct 29, 2012

   Owner

   More actions

   Hi JesseKlugmann, any updates on this? Could you provide some code, or give some hints what parts are missing and maybe describe how they should be implemented?
3. kovidgoyal commented on Dec 1, 2012

   

   kovidgoyal

   on Dec 1, 2012

   More actions

   My guess (and I dont know a lot about the subject) is that you have to load the .SAFESEH section of the dll, otherwise the SafeSeh mechanism will terminate the process when an exception occurs, as it cannot verify that the exception handlers are safe. See http://msdn.microsoft.com/en-us/library/9a89h429(v=vs.90).aspx
4. fancycode commented on Mar 12, 2013

   

   fancycode

   on Mar 12, 2013

   Owner

   More actions

   @JesseKlugmann do you have any hints or links to documentation how this could be implemented?
5. Zorro1 commented on Jun 19, 2013

   

   Zorro1

   on Jun 19, 2013

   More actions

   @fancycode

   1. on x32 the problem in inside RtlIsValidHandler (ntdll.dll). It's check if handler address in module.
      For solve this problem you can disable DEP (that's not so cool because some times you can't do this because you inside another app) OR try to find function RtlInsertInvertedFunctionTable and addr of LdrpInvertedFunctionTable because it's all not exported. And call RtlInsertInvertedFunctionTable(LdrpInvertedFunctionTable, 'imagebase', 'sizeofimage') for manually loaded module.

   2. on x64 problem is in two places

   • first, almost the same as x32. Occurs inside RtlLookupFunctionEntry, because it's module not registered in LdrpInvertedFunctionTable. Solve simple, because on x64 we have exported function RtlAddFunctionTable('addr of exception directory', 'count of handlers', 'imagebase') from ntdll.dll
   • second, inside RtlPcToFileHeader, which search module imagebase of handler addr in list PEB->Ldr->InLoadOrderModuleList. You can forcibly add your module to peb. You already have some implementation of this in https://github.com/fancycode/MemoryModule/tree/jojo_peb_compat

   👍React with 👍2Reacted by ashe and woowloop
6. bigmacattack commented on Dec 30, 2013

   

   bigmacattack

   on Dec 30, 2013

   More actions

   The "DarkMMap" project found here (https://github.com/DarthTon/DarkMMap) loads libraries from memory and according to the project page, has "Exception handling support (SEH and C++), needs more testing though, but seems reliable". Perhaps someone could take a look at how they implement exception handling support and adopt it to work with MemoryModule.
7. Tsury commented on Jun 24, 2014

   

   Tsury

   on Jun 24, 2014

   More actions

   I checked DarkMMap (now deprecated and called Blackbone). It works just fine but doesn't support Windows XP.

   I found the relevant code from their library, can someone help incorporate it into MemoryModule? I'm a not too good at Win32...

   It's in MMap.cpp:550

   ///

   /// Set custom exception handler to bypass SafeSEH under DEP
   ///

   /// image data
   /// true on success
   bool MMap::EnableExceptions( ImageContext* pImage )
   {
   BLACBONE_TRACE( L"ManualMap: Enabling exception support for image '%ls'", pImage->FileName.c_str() );
   #ifdef USE64
   size_t size = pImage->PEImage.DirectorySize( IMAGE_DIRECTORY_ENTRY_EXCEPTION );
   IMAGE_RUNTIME_FUNCTION_ENTRY *pExpTable =
   reinterpret_cast<decltype(pExpTable)>(pImage->PEImage.DirectoryAddress( IMAGE_DIRECTORY_ENTRY_EXCEPTION ));

   // Invoke RtlAddFunctionTable
   if(pExpTable)
   {     
       AsmJitHelper a;
       uint64_t result = 0;
   
       pImage->pExpTableAddr = REBASE( pExpTable, pImage->FileImage.base(), pImage->imgMem.ptr<ptr_t>() );
       auto pAddTable = _process.modules().GetExport( _process.modules().GetModule( L"ntdll.dll", LdrList, pImage->PEImage.mType() ),
                                                      "RtlAddFunctionTable" );
   
       a.GenPrologue();
       a.GenCall( static_cast<size_t>(pAddTable.procAddress), { pImage->pExpTableAddr, 
                                                                 size / sizeof(IMAGE_RUNTIME_FUNCTION_ENTRY),
                                                                 pImage->imgMem.ptr<size_t>() } );
       _process.remote().AddReturnWithEvent( a );
       a.GenEpilogue();
   
       if (_process.remote().ExecInWorkerThread( a->make(), a->getCodeSize(), result ) != STATUS_SUCCESS)
           return false;
   
       if (pImage->flags & CreateLdrRef)
           return true;
       else
           return (MExcept::CreateVEH( pImage->imgMem.ptr<size_t>(), pImage->PEImage.imageSize() ) == STATUS_SUCCESS);
   }
   else
       return false;
   

   #else
   bool safeseh = false;
   _process.nativeLdr().InsertInvertedFunctionTable( pImage->imgMem.ptr<void*>(), pImage->PEImage.imageSize(), safeseh );

   if ((pImage->flags & PartialExcept) || safeseh)
       return true;
   else
       return (MExcept::CreateVEH( pImage->imgMem.ptr<size_t>(), pImage->PEImage.imageSize() ) == STATUS_SUCCESS);
   

   #endif

   }
8. fancycode commented on Jun 24, 2014

   

   fancycode

   on Jun 24, 2014

   Owner

   More actions

   Could you please create a pull request for the changes or provide a proper diff?
9. Tsury commented on Jun 24, 2014

   

   Tsury

   on Jun 24, 2014

   More actions

   This is just code I found on Blackbone's repository which I found relevant. I lack the knowledge to actually add it to your library.

   Here's a direct link to the relevant code:
   https://github.com/DarthTon/Blackbone/blob/master/src/BlackBone/MMap.cpp#L550-L595

   I think that using your knowledge and Zorro1's advice, you can manage to merge it into your library.
12. GR-C commented on Aug 23, 2016

    

    GR-C

    on Aug 23, 2016

    More actions

    Hello, I'm also interessted in a solution.