DynamoRIO / DynamoRIO/dynamorio

[APP CRASH] Missing EIP in SEH Context when application sets trap flag to 1

Open
#4,576 3 comments 0 reactions 0 assignees View on GitHub
Bug-AppFail help wanted OpSys-Windows
Dominant language
C
Stars
3.2k
Forks
629
Avg merge
2d 15h
Merged PRs (30d)
31

Description

**Describe the bug**
DynamoRIO provides a zero EIP value in the SEH Context for the application handler when the program sets TF=1 using `popf`, while Windows provides the address of the instruction after the one that follows popf.

**To Reproduce**
I have attached both ASM source and EXE (compiled with MASM32 with Console target) of a PoC that saves the EIP value available in the SEH Context and prints to screen the provided and the expected one. To run the program just use `drrun.exe -- trapflag.exe`. No difference observed when `-debug` enabled.

[trapflag.zip](https://github.com/DynamoRIO/dynamorio/files/5625958/trapflag.zip)

**Expected behavior**
DynamoRIO should be providing in Context->EIP the address of the instruction next to the one after `popf` (it is different to the `int 2d` anti-debugger trick that expects a simple `+1` in Context->EIP, so I used a longer instruction here). The detection works also without setting also IF=1 but just TF=1 (i.e. constant `102h` for pushf).

```
PUSH @SehExit
PUSH DWORD PTR fs:[0]
MOV DWORD PTR fs:[0], esp
MOV [SavedESP], esp

PUSH 302h ; or 102h
POPF
MOV eax, 0abcdefh ; any instruction is good here
@AfterInt:
JMP @AfterSeh

NOP
@SehExit:
MOV eax, DWORD PTR ds:[esp + 0ch]
MOV eax, DWORD PTR ds:[eax + 0b8h]
MOV [ContextEIP], eax
CMP eax, @AfterInt
JNZ @AfterSeh
```

**Versions**
I have used v.8.0.0 build 1 as well as the latest build 18585. 32-bit application executed on Windows 7 SP1 x64.

**Additional context**
I did not try to see if the general purpose registers are exposed correctly, but I can easily extend the detection program to track and print some of those too if this may help you. Issue #3783 references a simpler version of this anti-debug trick that is documented for instance [here](https://anti-debug.checkpoint.com/techniques/assembly.html#popf_and_trap_flag). That PoC just looks for a single-step exception being fired, while the one I wrote validates the context as suggested in a detection method proposed by corkami.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.