Re: debugging longman dictionary

[Laurent Pinchart]

On Monday 18 March 2002 22:58, Eric Pouech wrote:
> > - it also tries to read/write to the debug registers. this produces an
> >
> > unhandled exception. should be trivial to write an exception handler to
> > support that (right ?)
>
> how does it do the writing exactly ? (I'd suspect more the program wants
> to catch itself a watchpoint)

Here's the C code I wrote from the disassembler output. It might not be 
correct, and might not even compile, but the idea is there.

BOOL ReadWriteDR2 (DWORD command, DWORD * value)
{
    struct {
    	WORD limit;
    	DWORD * base;
    } idtr;

void *int0Handler;
    DWORD int0handlerHigh;
    DWORD int0handlerLow;

DWORD valDR2;
    BOOL  writeDR2;

if ( value == 0 )
    	return FALSE;

if ( command == 0x1010 )
    {
    	writeDR2 = FALSE;
    }
    else if ( command == 0x1011 )
    {
    	writeDR2 = TRUE;
    	valDR2 = *value;
    }
    else
    	return FALSE;

idtr = reg.IDTR;
    int0Handler = idtr.base[4] & 0xffff0000;
    int0Handler |= idtr.base[0];

int0handlerLow = ((DWORD*)int0Handler)[0];
    int0handlerHigh = ((DWORD*)int0Handler)[1];

/* Install the division by 0 handler:
       pop %eax
       pop %eax
       push %cs
       push %ebx
       iret
     */
    ((DWORD*)int0Handler)[0] = 0x530e5858;
    ((DWORD*)int0Handler)[1] = 0x000000cf;

asm ( " movl %%ebx, (%0) " : "=m"(return_label1) );
    asm ( " xorl %%eax, %%eax; div %%eax, %%eax " );

return_label1:
    if ( writeDR2 )
    {
    	reg.DR2 = valDR2;
    }
    else
    {
    	valDR2 = reg.dr2;
    }

idtr = reg.IDTR;
    int0Handler = idtr.base[4] & 0xffff0000;
    int0Handler |= idtr.base[0];

/* Install the division by 0 handler:
       pop %eax
       pop %eax
       push %cs
       push %ebx
       iret
     */
    ((DWORD*)int0Handler)[0] = 0x53515858;
    ((DWORD*)int0Handler)[1] = 0x000000cf;

asm ( " xorl %%ecx, %%ecx; movw %%ecx, %%cs " );
    asm ( " movl %%ebx, (%0) " : "=m"(return_label2) );
    asm ( " xorl %%eax, %%eax; div %%eax, %%eax " );

return_label2:
    ((DWORD*)int0Handler)[0] = int0handlerLow;
    ((DWORD*)int0Handler)[1] = int0handlerHigh;

if ( ! writeDR2 )
    	*value = valDR2;

return TRUE;
}

The only call to the ReadWriteDR2 function I found in the disassembler output 
is a read call, and the DR2 value is compared with 0xffb31146. Hope this 
helps.
> > bool detect_debugger_from_TIB
> > {
> >         char *pTIB;
> >         asm ( "mov %%fs:0x18, %", "=g"(pTIB) );
> >         if ( pTIB[0x20] == 0 )
> >                 return FALSE;
> >         else
> >                 return TRUE;
> > }
>
> fs:0x18 points in memory to the TEB structure
> and offset 0x20 (from thread.h) says:
>    20 Process id (win95: debug context)
> so I assume you run it on Win9x, and got it tested this way
> (I wouldn't be surprised that under nt it did test dword 0x64 and/or
> 0x68)

You're right, that function is for Win9x. I haven't disassembled the NT 
function but I can do if needed.

Where can I find some doc about how the fs and gs registers are used ?

Laurent Pinchart