Comments (14)
-
on x32 the problem in inside RtlIsValidHandler (ntdll.dll). It's check if handler address in module.
For solve this problem you can disable DEP (that's not so cool because some times you can't do this because you inside another app) OR try to find function RtlInsertInvertedFunctionTable and addr of LdrpInvertedFunctionTable because it's all not exported. And call RtlInsertInvertedFunctionTable(LdrpInvertedFunctionTable, 'imagebase', 'sizeofimage') for manually loaded module. -
on x64 problem is in two places
- first, almost the same as x32. Occurs inside RtlLookupFunctionEntry, because it's module not registered in LdrpInvertedFunctionTable. Solve simple, because on x64 we have exported function RtlAddFunctionTable('addr of exception directory', 'count of handlers', 'imagebase') from ntdll.dll
- second, inside RtlPcToFileHeader, which search module imagebase of handler addr in list PEB->Ldr->InLoadOrderModuleList. You can forcibly add your module to peb. You already have some implementation of this in https://github.com/fancycode/MemoryModule/tree/jojo_peb_compat
from memorymodule.
I have found a working solution to the problem!
https://github.com/nettitude/SimplePELoader
I have confirmed that an exception can be thrown and caught within the loaded library. I have also confirmed that an exception can be thrown inside the library and caught in the executable that loaded it. This is explicitly handled on 64 bit builds but has not be implemented for 32 bit builds. However the disabling DEP solution is a viable workaround for 32 bit builds.
Notes:
- You cannot use the '/EHsc' compiler flag without causing a crash
- You must use the '/NXCOMPAT:NO' linker flag on 32 bit builds
Edit:
This solution will only allow you to catch exceptions with a catch all block on 64 bit builds.
catch(...){
// You can do whatever you want here.. but you can't know what the exception is
}
The moment you try to define the exception the program will crash as usual.
from memorymodule.
Hi
A temporary fix is to disable DEP[1] in the Visual Studio build options. Another possibility is to implement the missing parts of the pe loading process in MemoryModule. I'll provide some code, if I get an allowance from my boss.
[1] DEP: http://en.wikipedia.org/wiki/Data_Execution_Prevention
from memorymodule.
Hi JesseKlugmann, any updates on this? Could you provide some code, or give some hints what parts are missing and maybe describe how they should be implemented?
from memorymodule.
My guess (and I dont know a lot about the subject) is that you have to load the .SAFESEH section of the dll, otherwise the SafeSeh mechanism will terminate the process when an exception occurs, as it cannot verify that the exception handlers are safe. See http://msdn.microsoft.com/en-us/library/9a89h429(v=vs.90).aspx
from memorymodule.
@JesseKlugmann do you have any hints or links to documentation how this could be implemented?
from memorymodule.
The "DarkMMap" project found here (https://github.com/DarthTon/DarkMMap) loads libraries from memory and according to the project page, has "Exception handling support (SEH and C++), needs more testing though, but seems reliable". Perhaps someone could take a look at how they implement exception handling support and adopt it to work with MemoryModule.
from memorymodule.
I checked DarkMMap (now deprecated and called Blackbone). It works just fine but doesn't support Windows XP.
I found the relevant code from their library, can someone help incorporate it into MemoryModule? I'm a not too good at Win32...
It's in MMap.cpp:550
///
/// Set custom exception handler to bypass SafeSEH under DEP
///
/// image data
/// true on success
bool MMap::EnableExceptions( ImageContext* pImage )
{
BLACBONE_TRACE( L"ManualMap: Enabling exception support for image '%ls'", pImage->FileName.c_str() );
#ifdef USE64
size_t size = pImage->PEImage.DirectorySize( IMAGE_DIRECTORY_ENTRY_EXCEPTION );
IMAGE_RUNTIME_FUNCTION_ENTRY *pExpTable =
reinterpret_cast<decltype(pExpTable)>(pImage->PEImage.DirectoryAddress( IMAGE_DIRECTORY_ENTRY_EXCEPTION ));
// Invoke RtlAddFunctionTable
if(pExpTable)
{
AsmJitHelper a;
uint64_t result = 0;
pImage->pExpTableAddr = REBASE( pExpTable, pImage->FileImage.base(), pImage->imgMem.ptr<ptr_t>() );
auto pAddTable = _process.modules().GetExport( _process.modules().GetModule( L"ntdll.dll", LdrList, pImage->PEImage.mType() ),
"RtlAddFunctionTable" );
a.GenPrologue();
a.GenCall( static_cast<size_t>(pAddTable.procAddress), { pImage->pExpTableAddr,
size / sizeof(IMAGE_RUNTIME_FUNCTION_ENTRY),
pImage->imgMem.ptr<size_t>() } );
_process.remote().AddReturnWithEvent( a );
a.GenEpilogue();
if (_process.remote().ExecInWorkerThread( a->make(), a->getCodeSize(), result ) != STATUS_SUCCESS)
return false;
if (pImage->flags & CreateLdrRef)
return true;
else
return (MExcept::CreateVEH( pImage->imgMem.ptr<size_t>(), pImage->PEImage.imageSize() ) == STATUS_SUCCESS);
}
else
return false;
#else
bool safeseh = false;
_process.nativeLdr().InsertInvertedFunctionTable( pImage->imgMem.ptr<void*>(), pImage->PEImage.imageSize(), safeseh );
if ((pImage->flags & PartialExcept) || safeseh)
return true;
else
return (MExcept::CreateVEH( pImage->imgMem.ptr<size_t>(), pImage->PEImage.imageSize() ) == STATUS_SUCCESS);
#endif
}
from memorymodule.
Could you please create a pull request for the changes or provide a proper diff?
from memorymodule.
This is just code I found on Blackbone's repository which I found relevant. I lack the knowledge to actually add it to your library.
Here's a direct link to the relevant code:
https://github.com/DarthTon/Blackbone/blob/master/src/BlackBone/MMap.cpp#L550-L595
I think that using your knowledge and Zorro1's advice, you can manage to merge it into your library.
from memorymodule.
Hi, have you had any luck implementing try/catch support? I tried to understand the code linked to above (Blackbone) but it deals with a lot of assembly that I can't really follow.
Thanks
from memorymodule.
I found an article on how SEH and VEH exceptions are handled and it seems to expand on what Zorro1 posted.
https://hackmag.com/uncategorized/exceptions-for-hardcore-users/
I will be trying to figure this out but in the mean time maybe someone else can use what I found.
from memorymodule.
Hello, I'm also interessted in a solution.
from memorymodule.
I have located another possible source for a solution. It is designed to load windows DLLs on linux and it supports exception handling.
https://github.com/taviso/loadlibrary
from memorymodule.
Related Issues (20)
- Create Activation Context Implementation (with code)
- Bug results in crash when loading some DLLs. (with code fix!) HOT 4
- Starting Calc.exe fails (partial fix with code) HOT 2
- PDB Files Not Loaded for DLL's
- running the FARPROC type function fails
- Memory on kernel
- can MemoryCallEntryPoint accept parameters? just like a command line with parameters?
- c# compiled exe load supported ? HOT 1
- 64-bit DLL compiled by G++ failed to load. HOT 1
- cannot load DLL that use OpenSSL? HOT 2
- Link with dllloader
- new failed to allocate memory
- BUG in FinalizeSection
- .pyd files from Python - MemoryModule HOT 5
- Use Unicode version of LoadLibrary HOT 2
- Support for VirtualMachine Libraries
- Can not use CString in vs2015 and newer version , it seems like dynamiclly load Thread Local Storage can not be supported in MemmoryModule??
- Creation of Rust bindings
- MemoryGetProcAddress fails to import a function by ordinal number if dll has no exported names HOT 1
- Need to use it in C# with and unmanaged dll HOT 8
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from memorymodule.