Skip to content

Commit 9e9fd2a

Browse files
bb107bb107
committed
fixed a bug when processing tls
1 parent b72afcf commit 9e9fd2a

10 files changed

Lines changed: 295 additions & 260 deletions

File tree

‎MemoryModule/MmpTls.cpp‎

Lines changed: 18 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -454,7 +454,7 @@ BOOL NTAPI PreHookNtSetInformationProcess() {
454454
}
455455

456456
NTSTATUS NTAPI HookNtSetInformationProcess(
457-
_In_ HANDLE ProcessHandle,
457+
_In_opt_ HANDLE ProcessHandle,
458458
_In_ PROCESSINFOCLASS ProcessInformationClass,
459459
_In_reads_bytes_(ProcessInformationLength) PVOID ProcessInformation,
460460
_In_ ULONG ProcessInformationLength) {
@@ -468,7 +468,6 @@ NTSTATUS NTAPI HookNtSetInformationProcess(
468468
);
469469
}
470470

471-
472471
auto ProcessTlsInformation = PPROCESS_TLS_INFORMATION(ProcessInformation);
473472
auto hProcess = ProcessHandle ? ProcessHandle : NtCurrentProcess();
474473
auto TlsLength = ProcessInformationLength;
@@ -556,9 +555,12 @@ NTSTATUS NTAPI HookNtSetInformationProcess(
556555
PMMP_TLSP_RECORD j = CONTAINING_RECORD(entry, MMP_TLSP_RECORD, InMmpThreadLocalStoragePointer);
557556

558557
if (ProcessTlsInformation->OperationType == ProcessTlsReplaceVector) {
559-
if (j->TlspMmpBlock[ProcessTlsInformation->TlsVectorLength] == ProcessTlsInformation->ThreadData->TlsVector[ProcessTlsInformation->TlsVectorLength]) {
558+
if (j->TlspMmpBlock[ProcessTlsInformation->TlsVectorLength] == ProcessTlsInformation->ThreadData[i].TlsVector[ProcessTlsInformation->TlsVectorLength]) {
560559
found = true;
561560

561+
//auto tlsp = CONTAINING_RECORD(ProcessTlsInformation->ThreadData[i].TlsVector, TLS_VECTOR, TLS_VECTOR::ModuleTlsData);
562+
//assert(tlsp->Length >= ProcessTlsInformation->TlsVectorLength);
563+
562564
// Copy old data to new pointer
563565
RtlCopyMemory(
564566
ProcessTlsInformation->ThreadData[i].TlsVector,
@@ -767,17 +769,29 @@ NTSTATUS NTAPI MmpHandleTlsData(_In_ PLDR_DATA_TABLE_ENTRY lpModuleEntry) {
767769
return STATUS_NO_MEMORY;
768770
}
769771

770-
status = NtSetInformationProcess(
772+
status = HookNtSetInformationProcess(
771773
nullptr, // hack
772774
PROCESSINFOCLASS::ProcessTlsInformation,
773775
ProcessTlsInformation,
774776
(ULONG)Length
775777
);
776778

779+
ThreadCount = 0;
777780
for (DWORD i = 0; i < ProcessTlsInformation->ThreadDataCount; ++i) {
781+
if (!ProcessTlsInformation->ThreadData[i].Flags) {
782+
++ThreadCount;
783+
}
784+
778785
RtlFreeHeap(RtlProcessHeap(), 0, ProcessTlsInformation->ThreadData[i].TlsModulePointer);
779786
}
780787

788+
if (ThreadCount) {
789+
EnterCriticalSection(&MmpGlobalDataPtr->MmpTls->MmpTlspLock);
790+
MmpGlobalDataPtr->MmpTls->MmpActiveThreadCount -= ThreadCount;
791+
assert(MmpGlobalDataPtr->MmpTls->MmpActiveThreadCount > 0);
792+
LeaveCriticalSection(&MmpGlobalDataPtr->MmpTls->MmpTlspLock);
793+
}
794+
781795
RtlFreeHeap(RtlProcessHeap(), 0, ProcessTlsInformation);
782796
return status;
783797
}

‎a/a.vcxproj‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -172,7 +172,11 @@
172172
</ItemDefinitionGroup>
173173
<ItemGroup>
174174
<ClCompile Include="dllmain.cpp" />
175+
<ClCompile Include="exception.cpp" />
176+
<ClCompile Include="gdiplus.cpp" />
175177
<ClCompile Include="load.cpp" />
178+
<ClCompile Include="thread.cpp" />
179+
<ClCompile Include="unhandled_exception.cpp" />
176180
</ItemGroup>
177181
<ItemGroup>
178182
<ClInclude Include="resource.h" />

‎a/a.vcxproj.filters‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,18 @@
2121
<ClCompile Include="load.cpp">
2222
<Filter>Source Files</Filter>
2323
</ClCompile>
24+
<ClCompile Include="thread.cpp">
25+
<Filter>Source Files</Filter>
26+
</ClCompile>
27+
<ClCompile Include="exception.cpp">
28+
<Filter>Source Files</Filter>
29+
</ClCompile>
30+
<ClCompile Include="unhandled_exception.cpp">
31+
<Filter>Source Files</Filter>
32+
</ClCompile>
33+
<ClCompile Include="gdiplus.cpp">
34+
<Filter>Source Files</Filter>
35+
</ClCompile>
2436
</ItemGroup>
2537
<ItemGroup>
2638
<ClInclude Include="resource.h">

‎a/dllmain.cpp‎

Lines changed: 0 additions & 160 deletions
Original file line numberDiff line numberDiff line change
@@ -1,46 +1,10 @@
1-
// dllmain.cpp : Defines the entry point for the DLL application.
21
#include <cstdio>
3-
#include <exception>
42
#include <Windows.h>
5-
#include <string>
6-
#include <stdexcept>
73

84
#pragma comment(lib,"ws2_32.lib")
95
#pragma comment(lib,"wintrust.lib")
106
#pragma comment(lib,"ntdll.lib")
117

12-
typedef NTSTATUS(NTAPI* PUSER_THREAD_START_ROUTINE)(_In_ PVOID ThreadParameter);
13-
14-
#define NtCurrentProcess() (HANDLE)-1
15-
16-
#ifdef _WIN64
17-
#define NtCurrentThreadLocalStoragePointer() *(LPVOID*)(LPBYTE(NtCurrentTeb()) + 0x58)
18-
#else
19-
#define NtCurrentThreadLocalStoragePointer() *(LPVOID*)(LPBYTE(NtCurrentTeb()) + 0x2C)
20-
#endif
21-
22-
typedef struct _CLIENT_ID {
23-
VOID* UniqueProcess;
24-
VOID* UniqueThread;
25-
}CLIENT_ID, * PCLIENT_ID;
26-
27-
extern "C"
28-
NTSYSAPI
29-
NTSTATUS
30-
NTAPI
31-
RtlCreateUserThread(
32-
_In_ HANDLE Process,
33-
_In_opt_ PSECURITY_DESCRIPTOR ThreadSecurityDescriptor,
34-
_In_ BOOLEAN CreateSuspended,
35-
_In_opt_ ULONG ZeroBits,
36-
_In_opt_ SIZE_T MaximumStackSize,
37-
_In_opt_ SIZE_T CommittedStackSize,
38-
_In_ PUSER_THREAD_START_ROUTINE StartAddress,
39-
_In_opt_ PVOID Parameter,
40-
_Out_opt_ PHANDLE Thread,
41-
_Out_opt_ PCLIENT_ID ClientId
42-
);
43-
448
BOOL APIENTRY DllMain( HMODULE hModule,
459
DWORD ul_reason_for_call,
4610
LPVOID lpReserved
@@ -60,131 +24,7 @@ BOOL APIENTRY DllMain( HMODULE hModule,
6024
return TRUE;
6125
}
6226

63-
/*
64-
exception type
65-
0 int
66-
1 char
67-
2 std::exception
68-
... DWORD64
69-
*/
70-
71-
int exception(int exception_type) {
72-
//int a = 0;
73-
//__try {
74-
// *(PDWORD)(nullptr) = -1;
75-
// a = 2;
76-
//}
77-
//__except (EXCEPTION_EXECUTE_HANDLER) {
78-
// printf("-----------\n");
79-
// getchar();
80-
// a = 1;
81-
//}
82-
try {
83-
switch (exception_type) {
84-
case 0:
85-
throw 0;
86-
case 1:
87-
throw '1';
88-
case 2:
89-
throw std::exception("2");
90-
case 3:
91-
{
92-
std::string s = "foo";
93-
s.at(10);
94-
}
95-
default:
96-
throw (DWORD64)-1;
97-
}
98-
return 0;
99-
}
100-
catch (int val) {
101-
printf("exception code = %d\n", val);
102-
return val;
103-
}
104-
catch (char val) {
105-
printf("exception code = %c\n", val);
106-
return val - '0';
107-
}
108-
catch (const std::out_of_range& e) {
109-
printf("%s\n", e.what());
110-
return 3;
111-
}
112-
catch (std::exception val) {
113-
printf("exception code = %s\n", val.what());
114-
return 2;
115-
}
116-
catch (...) {
117-
printf("exception catched!!\n");
118-
return 0;
119-
}
120-
//return a;
121-
}
122-
12327
int __test__() {
12428
printf("HelloWorld!\n");
12529
return 0;
12630
}
127-
128-
static thread_local int x = 0xffccffdd;
129-
NTSTATUS WINAPI Thread(PVOID) {
130-
printf("[1] ThreadLocalStoragePointer = %p\n", NtCurrentThreadLocalStoragePointer());
131-
return x == 0xffccffdd ? 0 : 1;
132-
}
133-
134-
int thread() {
135-
x = 2;
136-
printf("[0] ThreadLocalStoragePointer = %p\n", NtCurrentThreadLocalStoragePointer());
137-
HANDLE hThread;// = CreateThread(nullptr, 0, Thread, nullptr, 0, nullptr);
138-
RtlCreateUserThread(NtCurrentProcess(), nullptr, FALSE, 0, 0, 0, Thread, nullptr, &hThread, nullptr);
139-
DWORD ret = -1;
140-
if (hThread) {
141-
WaitForSingleObject(hThread, 0xffffffff);
142-
GetExitCodeThread(hThread, &ret);
143-
CloseHandle(hThread);
144-
return ret;
145-
}
146-
return -1;
147-
}
148-
149-
DWORD Value;
150-
volatile LPDWORD lpAddr;
151-
152-
LONG WINAPI Filter(_In_ struct _EXCEPTION_POINTERS* ExceptionInfo) {
153-
154-
if (ExceptionInfo->ExceptionRecord->ExceptionCode == STATUS_ACCESS_VIOLATION) {
155-
156-
lpAddr = &Value;
157-
158-
// +++++++
159-
// begin compiler specific
160-
// +++++++
161-
162-
//ExceptionInfo->ContextRecord->Rip -= 7;
163-
ExceptionInfo->ContextRecord->Rax = (ULONG_PTR)lpAddr;
164-
165-
// +++++++
166-
// end compiler specific
167-
// +++++++
168-
169-
return EXCEPTION_CONTINUE_EXECUTION;
170-
}
171-
172-
return EXCEPTION_CONTINUE_SEARCH;
173-
}
174-
175-
int unhandled_exception() {
176-
auto filter = SetUnhandledExceptionFilter(Filter);
177-
auto ff = SetUnhandledExceptionFilter(filter);
178-
179-
if (ff != Filter) {
180-
printf("%p\t%p\t%p\nfailed\n", filter, ff, Filter);
181-
return 0;
182-
}
183-
184-
filter = SetUnhandledExceptionFilter(Filter);
185-
lpAddr = nullptr;
186-
*lpAddr = 1;
187-
SetUnhandledExceptionFilter(filter);
188-
189-
return 1234;
190-
}

‎a/exception.cpp‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
#include <Windows.h>
2+
#include <string>
3+
#include <stdexcept>
4+
5+
/*
6+
exception type
7+
0 int
8+
1 char
9+
2 std::exception
10+
... DWORD64
11+
*/
12+
13+
int exception(int exception_type) {
14+
//int a = 0;
15+
//__try {
16+
// *(PDWORD)(nullptr) = -1;
17+
// a = 2;
18+
//}
19+
//__except (EXCEPTION_EXECUTE_HANDLER) {
20+
// printf("-----------\n");
21+
// getchar();
22+
// a = 1;
23+
//}
24+
try {
25+
switch (exception_type) {
26+
case 0:
27+
throw 0;
28+
case 1:
29+
throw '1';
30+
case 2:
31+
throw std::exception("2");
32+
case 3:
33+
{
34+
std::string s = "foo";
35+
s.at(10);
36+
}
37+
default:
38+
throw (DWORD64)-1;
39+
}
40+
return 0;
41+
}
42+
catch (int val) {
43+
printf("exception code = %d\n", val);
44+
return val;
45+
}
46+
catch (char val) {
47+
printf("exception code = %c\n", val);
48+
return val - '0';
49+
}
50+
catch (const std::out_of_range& e) {
51+
printf("%s\n", e.what());
52+
return 3;
53+
}
54+
catch (std::exception val) {
55+
printf("exception code = %s\n", val.what());
56+
return 2;
57+
}
58+
catch (...) {
59+
printf("exception catched!!\n");
60+
return 0;
61+
}
62+
//return a;
63+
}

0 commit comments

Comments
 (0)