cyberheg
July 6th, 2002, 20:44
More and more protections these days are using SEH's to do various things amoung cleaning debug registers. One of these is Asprotect but I am not limiting myself to this.
I thought I'd try to write a little program which generates a exception and reads out the values of the registers.
The code at the buttom of this post shows the code I used (you can compile it with masm32).
What it does is basicly put the content of the registers dr7, dr1 and dr2 into edx which can be read out with softice if you single step through it.
Now the problem is that it the values it reads out of the registers are not the one softice reports me nor they are correct.
Bpm type of breakpoints should directly be using these registers so I did the following tests under both win98 and win2k.
With both having a bpm breakpoint set in dr1 and also without I got the followin results:
dr7 = 0 under both OS's
dr1 = 0 under win98 and 0xbe7cbd94 under win2k
dr2 = 0 under win98 and 0x7ffd0010 under win2k
So whats the deal with this? At the same time I also used the "CPU" command in softice which also showed different results from the real ones and also different results from mine.
I am thinking it has something to do with Ring0/3 but would it help to get access to the registers under ring0?
I know cdilla uses a sys driver under winNT/2k/XP and in past I read that it uses DR7 to do checking with but I am not sure if thats the reason why a driver was provided.
For these tests I used Softice v4.05 under both OS's.
// CyberHeg
---------------------------------------
Content of seh.asm:
.386
.model flat, stdcall
option casemap:none
include p:\progs\masm32\include\windows.inc
include p:\progs\masm32\include\kernel32.inc
.data
.code
main:
int 3
push Int3Handler
ASSUME FS:nothing
push fs:[0]
mov fs:[0], esp
int 3
nop
pop fs:[0]
add esp, 4
invoke ExitProcess, 0
Int3Handler:
mov eax, [esp+4]
cmp [eax.EXCEPTION_RECORD.ExceptionCode], EXCEPTION_BREAKPOINT
je HandleException
xor eax, eax
inc eax
ret
HandleException:
mov eax, [esp+12]
add [eax.CONTEXT.regEip], 1
mov edx, [eax.CONTEXT.iDr7]
mov edx, [eax.CONTEXT.iDr1]
mov edx, [eax.CONTEXT.iDr2]
xor eax, eax
ret
end main
end
I thought I'd try to write a little program which generates a exception and reads out the values of the registers.
The code at the buttom of this post shows the code I used (you can compile it with masm32).
What it does is basicly put the content of the registers dr7, dr1 and dr2 into edx which can be read out with softice if you single step through it.
Now the problem is that it the values it reads out of the registers are not the one softice reports me nor they are correct.
Bpm type of breakpoints should directly be using these registers so I did the following tests under both win98 and win2k.
With both having a bpm breakpoint set in dr1 and also without I got the followin results:
dr7 = 0 under both OS's
dr1 = 0 under win98 and 0xbe7cbd94 under win2k
dr2 = 0 under win98 and 0x7ffd0010 under win2k
So whats the deal with this? At the same time I also used the "CPU" command in softice which also showed different results from the real ones and also different results from mine.
I am thinking it has something to do with Ring0/3 but would it help to get access to the registers under ring0?
I know cdilla uses a sys driver under winNT/2k/XP and in past I read that it uses DR7 to do checking with but I am not sure if thats the reason why a driver was provided.
For these tests I used Softice v4.05 under both OS's.
// CyberHeg
---------------------------------------
Content of seh.asm:
.386
.model flat, stdcall
option casemap:none
include p:\progs\masm32\include\windows.inc
include p:\progs\masm32\include\kernel32.inc
.data
.code
main:
int 3
push Int3Handler
ASSUME FS:nothing
push fs:[0]
mov fs:[0], esp
int 3
nop
pop fs:[0]
add esp, 4
invoke ExitProcess, 0
Int3Handler:
mov eax, [esp+4]
cmp [eax.EXCEPTION_RECORD.ExceptionCode], EXCEPTION_BREAKPOINT
je HandleException
xor eax, eax
inc eax
ret
HandleException:
mov eax, [esp+12]
add [eax.CONTEXT.regEip], 1
mov edx, [eax.CONTEXT.iDr7]
mov edx, [eax.CONTEXT.iDr1]
mov edx, [eax.CONTEXT.iDr2]
xor eax, eax
ret
end main
end
oops ...
