blabberer
May 27th, 2012, 17:25
i was poking around some csrss stuff and i happened to notice some thing peculiar
in ollydbg 1.10 as well as ollydbg 2.01(alpha 4) the latest release
it seems if i run a console app inside ollydbg the console app gets a Different CsrPortHandle and if i run the same app out of ollydbg it gets a different CsrPortHandle
ms debuggers viz cdb or windbg does not display this phenomenon
googled around for an explanation but cant find one
so this phenomenon can possibly be used as an anti debug measure ?? targeting ollydbg
i mailed oleh about the phenomenon
below is a snippet that shows the phenomenon compile and
run the exe out of ollydbg will get CsrPortHandle as 0x7ec
run within ollydbg CsrPortHandle will be 0x18
for windows xp - sp3 (haven't checked in any other os )
also attached a screen shot of different outcomes
in ollydbg 1.10 as well as ollydbg 2.01(alpha 4) the latest release
it seems if i run a console app inside ollydbg the console app gets a Different CsrPortHandle and if i run the same app out of ollydbg it gets a different CsrPortHandle
ms debuggers viz cdb or windbg does not display this phenomenon
googled around for an explanation but cant find one
so this phenomenon can possibly be used as an anti debug measure ?? targeting ollydbg
i mailed oleh about the phenomenon
below is a snippet that shows the phenomenon compile and
run the exe out of ollydbg will get CsrPortHandle as 0x7ec
run within ollydbg CsrPortHandle will be 0x18
for windows xp - sp3 (haven't checked in any other os )
also attached a screen shot of different outcomes
Code:
#define UNICODE
#include <stdio.h>
#include <tchar.h>
#include <windows.h>
#include <winternl.h>
typedef struct _CLIENT_ID {
HANDLE UniqueProcess;
HANDLE UniqueThread;
} CLIENT_ID, *PCLIENT_ID;
typedef struct _WRITE_CONSOLEA_SUPPORT {
USHORT DataLength;
USHORT TotalLength;
USHORT Type;
USHORT DataInfoOffset;
CLIENT_ID ClientId;
ULONG64 DoNotUseThisField;
ULONG MessageId;
ULONG CallBackId;
ULONG64 NoUse;
ULONG ConsoleHandle;
HANDLE StdHandle;
char MsgBuff[0x50];
PCHAR MsgBuffAddress;
ULONG MsgBuffSize;
ULONG NoUse1;
BYTE Flag;
BYTE Pad0;
BYTE Pad1;
BYTE Pad2;
ULONG NoUse2;
ULONG NoUse3;
} WRITE_CONSOLEA_SUPPORT, *PWRITE_CONSOLEA_SUPPORT;
typedef
__kernel_entry
NTSTATUS
(NTAPI *pfnNtQueryInformationProcess ) (
IN HANDLE ProcessHandle,
IN PROCESSINFOCLASS ProcessInformationClass,
OUT PVOID ProcessInformation,
IN ULONG ProcessInformationLength,
OUT PULONG ReturnLength OPTIONAL
);
typedef
__kernel_entry
NTSTATUS
( NTAPI *pfnNtRequestWaitReplyPort ) (
IN HANDLE CsrPortHandle,
IN PWRITE_CONSOLEA_SUPPORT wcsin,
OUT PWRITE_CONSOLEA_SUPPORT wcsout
);
typedef
__kernel_entry
NTSTATUS
( NTAPI *pfnCsrNewThread ) (
void
);
int _tmain(void)
{
printf(
"lets call some syscall and see it in kd\n"
);
HANDLE CurrentStdHandle;
if ( ( CurrentStdHandle = GetStdHandle(
STD_OUTPUT_HANDLE
) ) == INVALID_HANDLE_VALUE) {
printf(
"GetStdHandle Failed with %08x \n" ,
GetLastError()
);
return 0;
}
printf (
"CurrentStdHandle is %08x\n",
CurrentStdHandle
);
DWORD CurrentPid = GetCurrentProcessId();
printf(
"current process id is %08x\n",
CurrentPid
);
HANDLE CurrentProcess;
if ( ( CurrentProcess = OpenProcess (
PROCESS_QUERY_INFORMATION,
FALSE,
CurrentPid
)) == NULL ) {
printf (
"OpenProcess(CurrentPid) Failed with %08x\n",
GetLastError()
);
CloseHandle(
CurrentStdHandle
);
return 0;
}
printf (
"OpenProcess Returned Handle %08x\n",
CurrentProcess
);
pfnNtQueryInformationProcess NtQueryInformationProcess;
pfnNtRequestWaitReplyPort NtRequestWaitReplyPort;
pfnCsrNewThread CsrNewThread;
if (( NtQueryInformationProcess = ( pfnNtQueryInformationProcess )GetProcAddress(
LoadLibrary(L"ntdll.dll",
"NtQueryInformationProcess"
) ) == NULL ) {
printf (
"Getproc NtQueryInfo Failed returned %08x\n",
GetLastError()
);
CloseHandle(
CurrentStdHandle
);
CloseHandle(
CurrentProcess
);
return 0;
}
printf(
"ntQueryInformationProcess is found at %x\n",
NtQueryInformationProcess
);
if (( NtRequestWaitReplyPort = (pfnNtRequestWaitReplyPort ) GetProcAddress (
LoadLibrary(L"ntdll.dll"
"NtRequestWaitReplyPort"
) ) == NULL ) {
printf (
"Getproc NtQueryInfo Failed returned %08x\n",
GetLastError()
);
CloseHandle(
CurrentStdHandle
);
CloseHandle(
CurrentProcess
);
return 0;
}
printf(
"NtRequestWaitReplyPort is found at %x\n",
NtRequestWaitReplyPort
);
if (( CsrNewThread = ( pfnCsrNewThread )GetProcAddress(
LoadLibrary(L"ntdll.dll"
"CsrNewThread"
) ) == NULL ) {
printf (
"Getproc CsrNewThread Failed returned %08x\n",
GetLastError()
);
CloseHandle(
CurrentStdHandle
);
CloseHandle(
CurrentProcess
);
return 0;
}
printf(
"CsrNewThread is found at %x\n",
CsrNewThread
);
HANDLE PortHandle = (**(PHANDLE *)((ULONG)CsrNewThread + 2));
printf (
"CsrPortHandle is %08x\n",
PortHandle
);
PROCESS_BASIC_INFORMATION PBasicInfo;
ULONG ReturnLength;
NTSTATUS Status;
Status = NtQueryInformationProcess(
CurrentProcess,
ProcessBasicInformation,
&PBasicInfo,
sizeof(PBasicInfo),
&ReturnLength
);
if( !NT_SUCCESS(Status) ) {
printf(
"NtQueryInformationProcess Failed With %08x\n",
Status
);
CloseHandle(
CurrentStdHandle
);
CloseHandle(
CurrentProcess
);
return 0;
}
printf(
"RTL_PROCESS_PARAMETERS For Current Process is at %08x\n"
"Console Handle as per windbg display type info is %08x\n",
PBasicInfo.PebBaseAddress->ProcessParameters,
PBasicInfo.PebBaseAddress->ProcessParameters->Reserved2[0]
);
if (( SetConsoleTextAttribute (
CurrentStdHandle,
FOREGROUND_RED | FOREGROUND_INTENSITY
) ) == 0) {
printf(
"SetConsoleTextAttribute Failed Returned %08x\n"
"Following text wont have colours\n"
);
}
WRITE_CONSOLEA_SUPPORT wcs;
memset(
&wcs,
0,
sizeof(wcs)
);
wcs.DataLength = 0x7c;
wcs.TotalLength = 0x98;
wcs.CallBackId = 0x2021e;
wcs.ConsoleHandle = (ULONG)PBasicInfo.PebBaseAddress->ProcessParameters->Reserved2[0];
wcs.StdHandle = CurrentStdHandle;
strcpy_s (
wcs.MsgBuff ,
80,
"Put on Black Helmets Entering a CoalMine Can be Fatal Blue Screen Anytime\n"
);
wcs.MsgBuffAddress = (PCHAR)&wcs.MsgBuff;
wcs.MsgBuffSize = sizeof("Put on Black Helmets Entering a CoalMine Can be Fatal Blue Screen Anytime\n"
wcs.Flag =1;
Status = NtRequestWaitReplyPort(
PortHandle,
&wcs,
&wcs
);
if( !NT_SUCCESS(Status) ) {
printf(
"NtRequestReplyPortWith Handle %08x Failed\n",
PortHandle
);
CloseHandle(
CurrentStdHandle
);
CloseHandle(
CurrentProcess
);
return 0;
}
CloseHandle(
CurrentStdHandle
);
CloseHandle(
CurrentProcess
);
return 0;
}
