DynamoRIO / DynamoRIO/dynamorio

[APP CRASH] int 2d not handled correctly when run under debugger that marks exception as handled

Open
#4,569 4 comments 0 reactions 0 assignees View on GitHub
help wanted OpSys-Windows
Dominant language
C
Stars
3.2k
Forks
629
Avg merge
2d 15h
Merged PRs (30d)
31

Description

**Describe the bug**
DynamoRIO does not adjust EIP by +1 byte as expected on Windows for an `int 2d` instruction in an application with custom SEH debugger-like code, but execution rather gets stuck and the program never completes.

**To Reproduce**
I have attached both ASM source and EXE (compiled with MASM32 with Console target) of the original [debugger detection](http://www.openrce.org/reference_library/anti_reversing_view/34/INT%202D%20Debugger%20Detection/) by Rolf Rolles from OpenRCE and a minified version that I obtained for it. To run the program just use `drrun.exe -- int2d-min.exe`. The program does not get to execute MessageBox.

[int2d.zip](https://github.com/DynamoRIO/dynamorio/files/5619455/int2d.zip)

**Expected behavior**
The program should skip the `inc esi` instruction after `int 2d` and print in a MessageBox that ESI is 0.

```
start:

assume fs:nothing
mov esi, 0
push offset _seh ;\ see ASM file for handler
push fs:[0] ; > set SEH
mov fs:[0], esp ;/
int 2dh ;
inc esi ; 1 byte or it will jump halfway in pop fs:[0]

pop fs:[0] ;\ clear SEH
add esp, 4 ;/

push esi
[...] ; part that turns it into a wchar_t
call MessageBox
```

**Versions**
I have used v.8.0.0 build 1 as well as the latest build 18585. 32-bit application executed on Windows 7 SP1 x64.

**Additional context**
I am poking DynamoRIO for DBI detection methods research and saw that fixes done in the past (e.g. #2218 and #2250) work with other variants of `int 2d` that I have been trying (I can share them if useful). Attached also a log for `drrun.exe -verbose -s 30 -debug -loglevel 4`, couldn't see information related to the problem in it.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.