mandiant / mandiant/speakeasy

Error with Vector Exception Handler

Open
#222 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
2.1k
Forks
289
Avg merge
20h 1m
Merged PRs (30d)
6

Description

With this sample: 16d1d189a2bdcff3389b83dcf767152722cf66d445990c4d8dd1bde4ab6aec57
It install vector exception handler, by RemoveVectoredExceptionHandler, then AddVectoredExceptionHandler, and execute int 3 to redirect execution to new VectorExceptionHandler
In speaky easy code, speakeasy\windows\winemu.py, class WindowsEmulator, method _hook_interrupt don't check VectorExceptionHandler list and call proc in that list to handler interrupt.
I have made some changes in kernel32.py and win32.py to add RemoveVectoredExceptionHandler API:
```
@apihook('RemoveVectoredExceptionHandler', argc=1)
def RemoveVectoredExceptionHandler(self, emu, argv, ctx={}):
'''
ULONG RemoveVectoredExceptionHandler(
PVOID Handle);
'''
Handler = argv
emu.remove_vectored_exception_handler(Handler)
return 1

```
And:
```
def remove_vectored_exception_handler(self, handler):
"""
Remove a vectored exception handler
"""
if handler in self.veh_handlers: # check the handler existed in the self.veh_handlers list
self.veh_handlers.remove(handler)

```
Hope you will fix this bug in method _hook_interrupt soon
Thanks

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in speakeasy/windows/winemu.py at WindowsEmulator._hook_interrupt, then read the vectored exception handler APIs in kernel32.py and win32.py. Reproduce the behavior with sample 16d1d189a2bdcff3389b83dcf767152722cf66d445990c4d8dd1bde4ab6aec57 and verify that registered handlers receive the interrupt and removed handlers no longer do.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
operating-systems
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.