DynamoRIO / DynamoRIO/dynamorio
[APP CRASH] Missing EIP in SEH Context when application sets trap flag to 1
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 629
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 31
Description
**Describe the bug**
DynamoRIO provides a zero EIP value in the SEH Context for the application handler when the program sets TF=1 using `popf`, while Windows provides the address of the instruction after the one that follows popf.
**To Reproduce**
I have attached both ASM source and EXE (compiled with MASM32 with Console target) of a PoC that saves the EIP value available in the SEH Context and prints to screen the provided and the expected one. To run the program just use `drrun.exe -- trapflag.exe`. No difference observed when `-debug` enabled.
[trapflag.zip](https://github.com/DynamoRIO/dynamorio/files/5625958/trapflag.zip)
**Expected behavior**
DynamoRIO should be providing in Context->EIP the address of the instruction next to the one after `popf` (it is different to the `int 2d` anti-debugger trick that expects a simple `+1` in Context->EIP, so I used a longer instruction here). The detection works also without setting also IF=1 but just TF=1 (i.e. constant `102h` for pushf).
```
PUSH @SehExit
PUSH DWORD PTR fs:[0]
MOV DWORD PTR fs:[0], esp
MOV [SavedESP], esp
PUSH 302h ; or 102h
POPF
MOV eax, 0abcdefh ; any instruction is good here
@AfterInt:
JMP @AfterSeh
NOP
@SehExit:
MOV eax, DWORD PTR ds:[esp + 0ch]
MOV eax, DWORD PTR ds:[eax + 0b8h]
MOV [ContextEIP], eax
CMP eax, @AfterInt
JNZ @AfterSeh
```
**Versions**
I have used v.8.0.0 build 1 as well as the latest build 18585. 32-bit application executed on Windows 7 SP1 x64.
**Additional context**
I did not try to see if the general purpose registers are exposed correctly, but I can easily extend the detection program to track and print some of those too if this may help you. Issue #3783 references a simpler version of this anti-debug trick that is documented for instance [here](https://anti-debug.checkpoint.com/techniques/assembly.html#popf_and_trap_flag). That PoC just looks for a single-step exception being fired, while the one I wrote validates the context as suggested in a detection method proposed by corkami.
Contributor guide
Assessment
This issue has not been assessed yet.