walied
March 7th, 2012, 14:28
One of the new interesting features introduced in version 2.0 of OllyDbg is the ability to pause on TLS callbacks. Actually, i discussed some flaws of this feature in a previous post, but in this post i will show you a minor bug (not so minor) that i found while playing with OllyDbg, like i sometimes do.
OllyDbg v2.0 assumes that the "Size" field in the TLS data directory is mandatory, but it is actually not. To make things clearer, i will dump the ntdll.dll code responsible for parsing the TLS info.
http://3.bp.blogspot.com/-a5n3eiTGtVU/T1bG_9ZfybI/AAAAAAAAAXA/tM6meA4wDRo/s1600/1.png
As you can see in the image above, the "RtlImageDirectoryEntryToData" function is called to get the absolute address of the "IMAGE_TLS_DIRECTORY32" structure. Its fourth parameter is a pointer to a variable that receives the size of "IMAGE_TLS_DIRECTORY32" structure, which is typically 0x18 bytes. It is easy to notice that no checks are done to verify the size.
To be even more sure, let's check the code that extracts TLS info in the "RtlImageDirectoryEntryToData" function .
http://2.bp.blogspot.com/-_hNVvxq-N24/T1bKHa0I7YI/AAAAAAAAAXI/gYhhjNNTtmw/s1600/2.png
As the two images above imply, the OS loader simply discards the "Size" field and continues invoking TLS callbacks.
On the other side, OllyDbg stops processing the TLS info. if the "Size" field is zero. See the image below.
http://2.bp.blogspot.com/-46EjJ02WZds/T1bTCzaBeYI/AAAAAAAAAXQ/0f38YuZ4Hd0/s1600/3.png
The source code for the image above should be something like this.
http://2.bp.blogspot.com/-IMvHfyTVUHE/T1bZL9Ob3ZI/AAAAAAAAAXY/-bC-YM4YXO8/s1600/44.png
We can easily figure out from the source code that setting the "Size" field to Zero is enough to fool OllyDbg to ignore TLS info. We can also fool OllyDbg by setting the "Size" field to 0xC or abit longer depending on the executable's ImageBase.
http://1.bp.blogspot.com/-wQ_r0adztfM/T1evRLNXbcI/AAAAAAAAAXg/1dnEY9JMmbc/s1600/77.png
Things get more interesting if the "AddressOfCallbacks" member is e.g. 0x01F12200 and the "Size" field is 0xF. In this case, OllyDbg will place the int3 breakpoint at 0xF12200 and since 0xF12200 will never be hit, the breakpoint will be left untouched.
Just play with this demo.
http://ollybugs.googlecode.com/files/fake_tls.exe
N.B. Many file inspectors are also affected by this bug e.g. Stud_PE and exeinfo.
OllyDbg v2.0 assumes that the "Size" field in the TLS data directory is mandatory, but it is actually not. To make things clearer, i will dump the ntdll.dll code responsible for parsing the TLS info.
http://3.bp.blogspot.com/-a5n3eiTGtVU/T1bG_9ZfybI/AAAAAAAAAXA/tM6meA4wDRo/s1600/1.png
As you can see in the image above, the "RtlImageDirectoryEntryToData" function is called to get the absolute address of the "IMAGE_TLS_DIRECTORY32" structure. Its fourth parameter is a pointer to a variable that receives the size of "IMAGE_TLS_DIRECTORY32" structure, which is typically 0x18 bytes. It is easy to notice that no checks are done to verify the size.
To be even more sure, let's check the code that extracts TLS info in the "RtlImageDirectoryEntryToData" function .
http://2.bp.blogspot.com/-_hNVvxq-N24/T1bKHa0I7YI/AAAAAAAAAXI/gYhhjNNTtmw/s1600/2.png
As the two images above imply, the OS loader simply discards the "Size" field and continues invoking TLS callbacks.
On the other side, OllyDbg stops processing the TLS info. if the "Size" field is zero. See the image below.
http://2.bp.blogspot.com/-46EjJ02WZds/T1bTCzaBeYI/AAAAAAAAAXQ/0f38YuZ4Hd0/s1600/3.png
The source code for the image above should be something like this.
http://2.bp.blogspot.com/-IMvHfyTVUHE/T1bZL9Ob3ZI/AAAAAAAAAXY/-bC-YM4YXO8/s1600/44.png
We can easily figure out from the source code that setting the "Size" field to Zero is enough to fool OllyDbg to ignore TLS info. We can also fool OllyDbg by setting the "Size" field to 0xC or abit longer depending on the executable's ImageBase.
http://1.bp.blogspot.com/-wQ_r0adztfM/T1evRLNXbcI/AAAAAAAAAXg/1dnEY9JMmbc/s1600/77.png
Things get more interesting if the "AddressOfCallbacks" member is e.g. 0x01F12200 and the "Size" field is 0xF. In this case, OllyDbg will place the int3 breakpoint at 0xF12200 and since 0xF12200 will never be hit, the breakpoint will be left untouched.
Just play with this demo.
http://ollybugs.googlecode.com/files/fake_tls.exe
N.B. Many file inspectors are also affected by this bug e.g. Stud_PE and exeinfo.