[PATCH 1/4] include: Fix DPFLTR_MASK value to 0x80000000.
Signed-off-by: Rémi Bernon <rbernon(a)codeweavers.com> --- This is most likely a typo from MSDN. Supersedes: 196179 include/dpfilter.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/dpfilter.h b/include/dpfilter.h index 5b09dc9c23c..deb8db3fc41 100644 --- a/include/dpfilter.h +++ b/include/dpfilter.h @@ -23,7 +23,7 @@ #define DPFLTR_WARNING_LEVEL 1 #define DPFLTR_TRACE_LEVEL 2 #define DPFLTR_INFO_LEVEL 3 -#define DPFLTR_MASK 0x8000000 +#define DPFLTR_MASK 0x80000000 typedef enum _DPFLTR_TYPE { -- 2.29.2
Signed-off-by: Rémi Bernon <rbernon(a)codeweavers.com> --- dlls/ntdll/tests/rtl.c | 117 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 117 insertions(+) diff --git a/dlls/ntdll/tests/rtl.c b/dlls/ntdll/tests/rtl.c index 7a62670ea05..76288545cc2 100644 --- a/dlls/ntdll/tests/rtl.c +++ b/dlls/ntdll/tests/rtl.c @@ -3483,6 +3483,122 @@ static void test_LdrRegisterDllNotification(void) pLdrUnregisterDllNotification(cookie); } +static BOOL test_dbg_print_except; +static LONG test_dbg_print_except_ret; + +static LONG CALLBACK test_dbg_print_except_handler( EXCEPTION_POINTERS *eptrs ) +{ + if (eptrs->ExceptionRecord->ExceptionCode == DBG_PRINTEXCEPTION_C) + { + ok( eptrs->ExceptionRecord->NumberParameters == 2, + "Unexpected NumberParameters: %d\n", eptrs->ExceptionRecord->NumberParameters ); + ok( eptrs->ExceptionRecord->ExceptionInformation[0] == strlen("test_DbgPrint: Hello World") + 1, + "Unexpected ExceptionInformation[0]: %d\n", (int)eptrs->ExceptionRecord->ExceptionInformation[0] ); + ok( !strcmp((char *)eptrs->ExceptionRecord->ExceptionInformation[1], "test_DbgPrint: Hello World"), + "Unexpected ExceptionInformation[1]: %s\n", wine_dbgstr_a((char *)eptrs->ExceptionRecord->ExceptionInformation[1]) ); + test_dbg_print_except = TRUE; + return test_dbg_print_except_ret; + } + + return (LONG)EXCEPTION_CONTINUE_SEARCH; +} + +static NTSTATUS test_vDbgPrintEx( ULONG id, ULONG level, const char *fmt, ... ) +{ + NTSTATUS status; + va_list args; + va_start( args, fmt ); + status = vDbgPrintEx( id, level, fmt, args ); + va_end( args ); + return status; +} + +static NTSTATUS test_vDbgPrintExWithPrefix( const char *prefix, ULONG id, ULONG level, const char *fmt, ... ) +{ + NTSTATUS status; + va_list args; + va_start( args, fmt ); + status = vDbgPrintExWithPrefix( prefix, id, level, fmt, args ); + va_end( args ); + return status; +} + +static void test_DbgPrint(void) +{ + NTSTATUS status; + void *handler = RtlAddVectoredExceptionHandler( TRUE, test_dbg_print_except_handler ); + PEB *Peb = NtCurrentTeb()->Peb; + BOOL debugged = Peb->BeingDebugged; + + test_dbg_print_except = FALSE; + test_dbg_print_except_ret = (LONG)EXCEPTION_EXECUTE_HANDLER; + status = DbgPrint( "test_DbgPrint: %s", "Hello World" ); + ok( !status, "DbgPrint returned %x\n", status ); + ok( !test_dbg_print_except, "DBG_PRINTEXCEPTION_C received\n" ); + + Peb->BeingDebugged = TRUE; + test_dbg_print_except = FALSE; + test_dbg_print_except_ret = (LONG)EXCEPTION_EXECUTE_HANDLER; + status = DbgPrint( "test_DbgPrint: %s", "Hello World" ); + ok( !status, "DbgPrint returned %x\n", status ); + todo_wine ok( test_dbg_print_except, "DBG_PRINTEXCEPTION_C not received\n" ); + + test_dbg_print_except = FALSE; + test_dbg_print_except_ret = (LONG)EXCEPTION_CONTINUE_EXECUTION; + status = DbgPrint( "test_DbgPrint: %s", "Hello World" ); + ok( !status, "DbgPrint returned %x\n", status ); + todo_wine ok( test_dbg_print_except, "DBG_PRINTEXCEPTION_C not received\n" ); + + test_dbg_print_except = FALSE; + test_dbg_print_except_ret = (LONG)EXCEPTION_CONTINUE_SEARCH; + status = DbgPrint( "test_DbgPrint: %s", "Hello World" ); + ok( !status, "DbgPrint returned %x\n", status ); + todo_wine ok( test_dbg_print_except, "DBG_PRINTEXCEPTION_C not received\n" ); + + + /* FIXME: NtSetDebugFilterState / DbgSetDebugFilterState are probably what's controlling these */ + + test_dbg_print_except = FALSE; + test_dbg_print_except_ret = (LONG)EXCEPTION_EXECUTE_HANDLER; + status = DbgPrintEx( 0, DPFLTR_ERROR_LEVEL, "test_DbgPrint: %s", "Hello World" ); + ok( !status, "DbgPrintEx returned %x\n", status ); + todo_wine ok( test_dbg_print_except, "DBG_PRINTEXCEPTION_C not received\n" ); + + test_dbg_print_except = FALSE; + test_dbg_print_except_ret = (LONG)EXCEPTION_EXECUTE_HANDLER; + status = DbgPrintEx( 0, DPFLTR_WARNING_LEVEL, "test_DbgPrint: %s", "Hello World" ); + ok( !status, "DbgPrintEx returned %x\n", status ); + ok( !test_dbg_print_except, "DBG_PRINTEXCEPTION_C not received\n" ); + + test_dbg_print_except = FALSE; + test_dbg_print_except_ret = (LONG)EXCEPTION_EXECUTE_HANDLER; + status = DbgPrintEx( 0, DPFLTR_MASK|(1 << DPFLTR_ERROR_LEVEL), "test_DbgPrint: %s", "Hello World" ); + ok( !status, "DbgPrintEx returned %x\n", status ); + todo_wine ok( test_dbg_print_except, "DBG_PRINTEXCEPTION_C not received\n" ); + + test_dbg_print_except = FALSE; + test_dbg_print_except_ret = (LONG)EXCEPTION_EXECUTE_HANDLER; + status = DbgPrintEx( 0, DPFLTR_MASK|(1 << DPFLTR_WARNING_LEVEL), "test_DbgPrint: %s", "Hello World" ); + ok( !status, "DbgPrintEx returned %x\n", status ); + ok( !test_dbg_print_except, "DBG_PRINTEXCEPTION_C not received\n" ); + + + test_dbg_print_except = FALSE; + test_dbg_print_except_ret = (LONG)EXCEPTION_EXECUTE_HANDLER; + status = test_vDbgPrintEx( 0, 0xFFFFFFFF, "test_DbgPrint: %s", "Hello World" ); + ok( !status, "vDbgPrintEx returned %x\n", status ); + todo_wine ok( test_dbg_print_except, "DBG_PRINTEXCEPTION_C not received\n" ); + + test_dbg_print_except = FALSE; + test_dbg_print_except_ret = (LONG)EXCEPTION_EXECUTE_HANDLER; + status = test_vDbgPrintExWithPrefix( "test_", 0, 0xFFFFFFFF, "DbgPrint: %s", "Hello World" ); + ok( !status, "vDbgPrintExWithPrefix returned %x\n", status ); + todo_wine ok( test_dbg_print_except, "DBG_PRINTEXCEPTION_C not received\n" ); + + Peb->BeingDebugged = debugged; + RtlRemoveVectoredExceptionHandler( handler ); +} + START_TEST(rtl) { InitFunctionPtrs(); @@ -3523,4 +3639,5 @@ START_TEST(rtl) test_LdrEnumerateLoadedModules(); test_RtlMakeSelfRelativeSD(); test_LdrRegisterDllNotification(); + test_DbgPrint(); } -- 2.29.2
Signed-off-by: Rémi Bernon <rbernon(a)codeweavers.com> --- dlls/ntdll/rtl.c | 56 +++++++++++++++++++++++++++++------------- dlls/ntdll/tests/rtl.c | 14 +++++------ 2 files changed, 46 insertions(+), 24 deletions(-) diff --git a/dlls/ntdll/rtl.c b/dlls/ntdll/rtl.c index ca4fea84209..7876b92188b 100644 --- a/dlls/ntdll/rtl.c +++ b/dlls/ntdll/rtl.c @@ -39,6 +39,7 @@ #include "ddk/ntddk.h" WINE_DEFAULT_DEBUG_CHANNEL(ntdll); +WINE_DECLARE_DEBUG_CHANNEL(debugstr); /* CRC polynomial 0xedb88320 */ static const DWORD CRC_table[256] = @@ -297,21 +298,24 @@ void WINAPI RtlDumpResource(LPRTL_RWLOCK rwl) * misc functions */ +static LONG WINAPI debug_exception_handler( EXCEPTION_POINTERS *eptr ) +{ + EXCEPTION_RECORD *rec = eptr->ExceptionRecord; + return (rec->ExceptionCode == DBG_PRINTEXCEPTION_C) ? EXCEPTION_EXECUTE_HANDLER : EXCEPTION_CONTINUE_SEARCH; +} + /****************************************************************************** * DbgPrint [NTDLL.@] */ NTSTATUS WINAPIV DbgPrint(LPCSTR fmt, ...) { - char buf[512]; - __ms_va_list args; - - __ms_va_start(args, fmt); - _vsnprintf(buf, sizeof(buf), fmt, args); - __ms_va_end(args); + NTSTATUS ret; + __ms_va_list args; - MESSAGE("DbgPrint says: %s",buf); - /* hmm, raise exception? */ - return STATUS_SUCCESS; + __ms_va_start(args, fmt); + ret = vDbgPrintEx(0, DPFLTR_ERROR_LEVEL, fmt, args); + __ms_va_end(args); + return ret; } @@ -342,18 +346,36 @@ NTSTATUS WINAPI vDbgPrintEx( ULONG id, ULONG level, LPCSTR fmt, __ms_va_list arg */ NTSTATUS WINAPI vDbgPrintExWithPrefix( LPCSTR prefix, ULONG id, ULONG level, LPCSTR fmt, __ms_va_list args ) { - char buf[1024]; + ULONG level_mask = level <= 31 ? (1 << level) : level; + SIZE_T len = strlen( prefix ); + char buf[1024], *end; - _vsnprintf(buf, sizeof(buf), fmt, args); + strcpy( buf, prefix ); + len += _vsnprintf( buf + len, sizeof(buf) - len, fmt, args ); + end = buf + len - 1; - switch (level & DPFLTR_MASK) + WARN_(debugstr)(*end == '\n' ? "%08x:%08x: %s" : "%08x:%08x: %s\n", id, level_mask, buf); + + if (level_mask & (1 << DPFLTR_ERROR_LEVEL) && NtCurrentTeb()->Peb->BeingDebugged) { - case DPFLTR_ERROR_LEVEL: ERR("%s%x: %s", prefix, id, buf); break; - case DPFLTR_WARNING_LEVEL: WARN("%s%x: %s", prefix, id, buf); break; - case DPFLTR_TRACE_LEVEL: - case DPFLTR_INFO_LEVEL: - default: TRACE("%s%x: %s", prefix, id, buf); break; + __TRY + { + EXCEPTION_RECORD record; + record.ExceptionCode = DBG_PRINTEXCEPTION_C; + record.ExceptionFlags = 0; + record.ExceptionRecord = NULL; + record.ExceptionAddress = RtlDestroyHeap; + record.NumberParameters = 2; + record.ExceptionInformation[1] = (ULONG_PTR)buf; + record.ExceptionInformation[0] = strlen( buf ) + 1; + RtlRaiseException( &record ); + } + __EXCEPT(debug_exception_handler) + { + } + __ENDTRY } + return STATUS_SUCCESS; } diff --git a/dlls/ntdll/tests/rtl.c b/dlls/ntdll/tests/rtl.c index 76288545cc2..796b98c4e76 100644 --- a/dlls/ntdll/tests/rtl.c +++ b/dlls/ntdll/tests/rtl.c @@ -3541,19 +3541,19 @@ static void test_DbgPrint(void) test_dbg_print_except_ret = (LONG)EXCEPTION_EXECUTE_HANDLER; status = DbgPrint( "test_DbgPrint: %s", "Hello World" ); ok( !status, "DbgPrint returned %x\n", status ); - todo_wine ok( test_dbg_print_except, "DBG_PRINTEXCEPTION_C not received\n" ); + ok( test_dbg_print_except, "DBG_PRINTEXCEPTION_C not received\n" ); test_dbg_print_except = FALSE; test_dbg_print_except_ret = (LONG)EXCEPTION_CONTINUE_EXECUTION; status = DbgPrint( "test_DbgPrint: %s", "Hello World" ); ok( !status, "DbgPrint returned %x\n", status ); - todo_wine ok( test_dbg_print_except, "DBG_PRINTEXCEPTION_C not received\n" ); + ok( test_dbg_print_except, "DBG_PRINTEXCEPTION_C not received\n" ); test_dbg_print_except = FALSE; test_dbg_print_except_ret = (LONG)EXCEPTION_CONTINUE_SEARCH; status = DbgPrint( "test_DbgPrint: %s", "Hello World" ); ok( !status, "DbgPrint returned %x\n", status ); - todo_wine ok( test_dbg_print_except, "DBG_PRINTEXCEPTION_C not received\n" ); + ok( test_dbg_print_except, "DBG_PRINTEXCEPTION_C not received\n" ); /* FIXME: NtSetDebugFilterState / DbgSetDebugFilterState are probably what's controlling these */ @@ -3562,7 +3562,7 @@ static void test_DbgPrint(void) test_dbg_print_except_ret = (LONG)EXCEPTION_EXECUTE_HANDLER; status = DbgPrintEx( 0, DPFLTR_ERROR_LEVEL, "test_DbgPrint: %s", "Hello World" ); ok( !status, "DbgPrintEx returned %x\n", status ); - todo_wine ok( test_dbg_print_except, "DBG_PRINTEXCEPTION_C not received\n" ); + ok( test_dbg_print_except, "DBG_PRINTEXCEPTION_C not received\n" ); test_dbg_print_except = FALSE; test_dbg_print_except_ret = (LONG)EXCEPTION_EXECUTE_HANDLER; @@ -3574,7 +3574,7 @@ static void test_DbgPrint(void) test_dbg_print_except_ret = (LONG)EXCEPTION_EXECUTE_HANDLER; status = DbgPrintEx( 0, DPFLTR_MASK|(1 << DPFLTR_ERROR_LEVEL), "test_DbgPrint: %s", "Hello World" ); ok( !status, "DbgPrintEx returned %x\n", status ); - todo_wine ok( test_dbg_print_except, "DBG_PRINTEXCEPTION_C not received\n" ); + ok( test_dbg_print_except, "DBG_PRINTEXCEPTION_C not received\n" ); test_dbg_print_except = FALSE; test_dbg_print_except_ret = (LONG)EXCEPTION_EXECUTE_HANDLER; @@ -3587,13 +3587,13 @@ static void test_DbgPrint(void) test_dbg_print_except_ret = (LONG)EXCEPTION_EXECUTE_HANDLER; status = test_vDbgPrintEx( 0, 0xFFFFFFFF, "test_DbgPrint: %s", "Hello World" ); ok( !status, "vDbgPrintEx returned %x\n", status ); - todo_wine ok( test_dbg_print_except, "DBG_PRINTEXCEPTION_C not received\n" ); + ok( test_dbg_print_except, "DBG_PRINTEXCEPTION_C not received\n" ); test_dbg_print_except = FALSE; test_dbg_print_except_ret = (LONG)EXCEPTION_EXECUTE_HANDLER; status = test_vDbgPrintExWithPrefix( "test_", 0, 0xFFFFFFFF, "DbgPrint: %s", "Hello World" ); ok( !status, "vDbgPrintExWithPrefix returned %x\n", status ); - todo_wine ok( test_dbg_print_except, "DBG_PRINTEXCEPTION_C not received\n" ); + ok( test_dbg_print_except, "DBG_PRINTEXCEPTION_C not received\n" ); Peb->BeingDebugged = debugged; RtlRemoveVectoredExceptionHandler( handler ); -- 2.29.2
Rémi Bernon <rbernon(a)codeweavers.com> wrote:
+ __TRY + { + EXCEPTION_RECORD record; + record.ExceptionCode = DBG_PRINTEXCEPTION_C; + record.ExceptionFlags = 0; + record.ExceptionRecord = NULL; + record.ExceptionAddress = RtlDestroyHeap;
Using RtlDestroyHeap address is most likely a mistake in general purpose API.
+ record.NumberParameters = 2; + record.ExceptionInformation[1] = (ULONG_PTR)buf; + record.ExceptionInformation[0] = strlen( buf ) + 1; + RtlRaiseException( &record ); + }
-- Dmitry.
On 11/19/20 9:37 AM, Dmitry Timoshkov wrote:
Rémi Bernon <rbernon(a)codeweavers.com> wrote:
+ __TRY + { + EXCEPTION_RECORD record; + record.ExceptionCode = DBG_PRINTEXCEPTION_C; + record.ExceptionFlags = 0; + record.ExceptionRecord = NULL; + record.ExceptionAddress = RtlDestroyHeap;
Using RtlDestroyHeap address is most likely a mistake in general purpose API.
+ record.NumberParameters = 2; + record.ExceptionInformation[1] = (ULONG_PTR)buf; + record.ExceptionInformation[0] = strlen( buf ) + 1; + RtlRaiseException( &record ); + }
Indeed I missed that while moving the code from the previous version. Thanks. -- Rémi Bernon <rbernon(a)codeweavers.com>
And when PEB->BeingDebugged is set to 1. Lords Of The Fallen anti-tamper does this and only continues if a DBG_PRINTEXCEPTION_C is received. Signed-off-by: Rémi Bernon <rbernon(a)codeweavers.com> --- dlls/ntdll/heap.c | 6 ++++ dlls/ntdll/tests/rtl.c | 66 ++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 72 insertions(+) diff --git a/dlls/ntdll/heap.c b/dlls/ntdll/heap.c index 1ac0cb24806..88db935746a 100644 --- a/dlls/ntdll/heap.c +++ b/dlls/ntdll/heap.c @@ -1589,6 +1589,12 @@ HANDLE WINAPI RtlDestroyHeap( HANDLE heap ) void *addr; TRACE("%p\n", heap ); + if (!heapPtr && heap && (((HEAP *)heap)->flags & HEAP_VALIDATE_PARAMS) && + NtCurrentTeb()->Peb->BeingDebugged) + { + DbgPrint( "Attempt to destroy an invalid heap\n" ); + DbgBreakPoint(); + } if (!heapPtr) return heap; if (heap == processHeap) return heap; /* cannot delete the main process heap */ diff --git a/dlls/ntdll/tests/rtl.c b/dlls/ntdll/tests/rtl.c index 796b98c4e76..360bffe5195 100644 --- a/dlls/ntdll/tests/rtl.c +++ b/dlls/ntdll/tests/rtl.c @@ -3599,6 +3599,71 @@ static void test_DbgPrint(void) RtlRemoveVectoredExceptionHandler( handler ); } +static BOOL test_heap_destroy_dbgstr = FALSE; +static BOOL test_heap_destroy_break = FALSE; + +static LONG CALLBACK test_heap_destroy_except_handler( EXCEPTION_POINTERS *eptrs ) +{ + if (eptrs->ExceptionRecord->ExceptionCode == STATUS_BREAKPOINT) + { +#if defined( __i386__ ) + eptrs->ContextRecord->Eip += 1; + test_heap_destroy_break = TRUE; + return (LONG)EXCEPTION_CONTINUE_EXECUTION; +#elif defined( __x86_64__ ) + eptrs->ContextRecord->Rip += 1; + test_heap_destroy_break = TRUE; + return (LONG)EXCEPTION_CONTINUE_EXECUTION; +#endif + } + + if (eptrs->ExceptionRecord->ExceptionCode == DBG_PRINTEXCEPTION_C) + { + test_heap_destroy_dbgstr = TRUE; + return (LONG)EXCEPTION_CONTINUE_EXECUTION; + } + + return (LONG)EXCEPTION_CONTINUE_SEARCH; +} + +/* partially copied from ntdll/heap.c */ +#define HEAP_VALIDATE_PARAMS 0x40000000 + +struct heap +{ + DWORD_PTR unknown1[2]; + DWORD unknown2[2]; + DWORD_PTR unknown3[4]; + DWORD unknown4; + DWORD_PTR unknown5[2]; + DWORD unknown6[3]; + DWORD_PTR unknown7[2]; + DWORD flags; + DWORD force_flags; + DWORD_PTR unknown8[6]; +}; + +static void test_RtlDestroyHeap(void) +{ + const struct heap invalid = {{0, 0}, {0, HEAP_VALIDATE_PARAMS}, {0, 0, 0, 0}, 0, {0, 0}, {0, 0, 0}, {0, 0}, HEAP_VALIDATE_PARAMS, 0, {0}}; + HANDLE heap = (HANDLE)&invalid, ret; + PEB *Peb = NtCurrentTeb()->Peb; + BOOL debugged; + void *handler = RtlAddVectoredExceptionHandler( TRUE, test_heap_destroy_except_handler ); + + test_heap_destroy_dbgstr = FALSE; + test_heap_destroy_break = FALSE; + debugged = Peb->BeingDebugged; + Peb->BeingDebugged = TRUE; + ret = RtlDestroyHeap( heap ); + ok( ret == heap, "RtlDestroyHeap(%p) returned %p\n", heap, ret ); + ok( test_heap_destroy_dbgstr, "HeapDestroy didn't call OutputDebugStrA\n" ); + ok( test_heap_destroy_break, "HeapDestroy didn't call DbgBreakPoint\n" ); + Peb->BeingDebugged = debugged; + + RtlRemoveVectoredExceptionHandler( handler ); +} + START_TEST(rtl) { InitFunctionPtrs(); @@ -3640,4 +3705,5 @@ START_TEST(rtl) test_RtlMakeSelfRelativeSD(); test_LdrRegisterDllNotification(); test_DbgPrint(); + test_RtlDestroyHeap(); } -- 2.29.2
participants (2)
-
Dmitry Timoshkov -
Rémi Bernon