Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
35 commits
Select commit Hold shift + click to select a range
f141b73
Add HeapReAlloc hook
JFarAur Mar 23, 2025
742630f
Add _realloc_base hook
JFarAur Mar 23, 2025
8101061
Add RtlPcToFileHeader hook
JFarAur Mar 23, 2025
fb8128f
Remove _initterm and _initterm_e hooks
JFarAur Mar 23, 2025
84b02ee
Remove __acrt_iob_func hook
JFarAur Mar 23, 2025
69a6906
Add function table parsing and lookup to the PE loader
JFarAur Mar 27, 2025
1f45f9b
Adjust segment descriptors for x86_64
JFarAur Mar 27, 2025
27db58d
Add hooks for function table lookup functions in ntdll
JFarAur Mar 27, 2025
22a4b49
Make RaiseException hook passthru
JFarAur Mar 27, 2025
ce03a8a
Add ProcessCookie case for NtQueryInformationProcess hook
JFarAur Mar 28, 2025
4ac6458
Remove Encode/DecodePointer hooks
JFarAur Mar 28, 2025
54564b0
Add support for forwarded exports to the PE loader
JFarAur Mar 28, 2025
37288e6
Add user32 to DllMain blacklist
JFarAur Mar 28, 2025
52a3910
Fix some typos in ntdll hook code
JFarAur Mar 28, 2025
9661ad6
Add ZwRaiseException hook, move unhandled exception logic
JFarAur Mar 29, 2025
32e9fe3
Fix unhandled exception filter not being called correctly
JFarAur Mar 30, 2025
0ed8885
Add 64-bit msvcp140 DLLs to dllscollector script
JFarAur Mar 30, 2025
51fc085
Add abort hook
JFarAur Mar 30, 2025
273b46b
Add 32-bit msvcp140 DLLs to dllscollector script
JFarAur Mar 30, 2025
cf23ef9
Small changes in ZwRaiseException hook
JFarAur Mar 30, 2025
2b42466
Make some requested changes in ntdll hooks
JFarAur Mar 30, 2025
7dd9fcd
Add C++ runtime and exception-related tests
JFarAur Mar 30, 2025
4ea1a0a
Make requested change in GDTManager
JFarAur Mar 30, 2025
b895748
Make requested changes in PE loader
JFarAur Mar 30, 2025
c0daea1
Refactor hooks in ntdll
JFarAur Mar 31, 2025
8f92c73
Add source for C++ and exception-related test programs
JFarAur Mar 31, 2025
462f68a
Add note to ZwRaiseException hook
JFarAur Mar 31, 2025
15e3c00
Add hook for EtwNotificationRegister
JFarAur Apr 1, 2025
92cd2d4
Fix an issue with forwarded symbols, and improve readability
JFarAur Apr 1, 2025
6adafd5
Unify heap API hooks, address debug CRT init issues
JFarAur Apr 2, 2025
a3bccf5
Fix buffer overrun issue in LCMapString implementation
JFarAur Apr 2, 2025
fe51b28
Make requested change in PE loader
JFarAur Apr 2, 2025
68aae4d
Add __dllonexit hook
JFarAur Apr 2, 2025
4bd7459
Add passthru exception-related hooks
JFarAur Apr 2, 2025
f390b47
Restore old RaiseException hook, add special case for x86
JFarAur Apr 2, 2025
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions examples/scripts/dllscollector.bat
Original file line number Diff line number Diff line change
Expand Up @@ -94,6 +94,9 @@ CALL :collect_dll32 wininet.dll
CALL :collect_dll32 winmm.dll
CALL :collect_dll32 ws2_32.dll
CALL :collect_dll32 wsock32.dll
CALL :collect_dll32 msvcp140.dll
CALL :collect_dll32 msvcp140_1.dll
CALL :collect_dll32 msvcp140_2.dll

CALL :collect_dll32 downlevel\api-ms-win-core-fibers-l1-1-1.dll
CALL :collect_dll32 downlevel\api-ms-win-core-localization-l1-2-1.dll
Expand Down Expand Up @@ -131,6 +134,9 @@ CALL :collect_dll64 win32u.dll
CALL :collect_dll64 winhttp.dll
CALL :collect_dll64 wininet.dll
CALL :collect_dll64 ws2_32.dll
CALL :collect_dll64 msvcp140.dll
CALL :collect_dll64 msvcp140_1.dll
CALL :collect_dll64 msvcp140_2.dll

CALL :collect_dll64 downlevel\api-ms-win-crt-heap-l1-1-0.dll
CALL :collect_dll64 downlevel\api-ms-win-crt-locale-l1-1-0.dll
Expand Down
11 changes: 11 additions & 0 deletions examples/src/windows/except/CppHelloWorld.cpp
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
// This is the default Hello World program generated by Visual Studio 2022.

#include <iostream>

int main()
{
std::cout << "Hello World!\n";

return 0;
}

3 changes: 3 additions & 0 deletions examples/src/windows/except/README
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
In this folder: Sources for programs intended to help test C++ features and software exceptions.

Compile with MSVC (Visual Studio 2022)
95 changes: 95 additions & 0 deletions examples/src/windows/except/TestCppEx.cpp
Original file line number Diff line number Diff line change
@@ -0,0 +1,95 @@
#include <iostream>
#include <cstdlib>

/*
* Test simple try..catch.
*/
void test1()
{
std::cout << "y";

try {
std::cout << "y";
throw (unsigned int)0x12345678;
std::cout << "n";
}
catch(unsigned int n) {
n;
std::cout << "y";
}

std::cout << "y";
}

/*
* Test simple try..catch with throw.
*/
void test2()
{
std::cout << "y";

try {
std::cout << "y";
throw (unsigned int)0x12345679;
std::cout << "n";
}
catch (unsigned int n) {
n;
if (n == 0x12345679) {
std::cout << "y";
}
else {
std::cout << "n";
}
}

std::cout << "y";
}

/*
* Test nested try..catch with throw.
*/
void test3()
{
std::cout << "y";

try {
std::cout << "y";

try {
std::cout << "y";
throw (unsigned int)0x1234567A;
std::cout << "n";
}
catch (unsigned int n) {
n;
if (n == 0x1234567A) {
std::cout << "y";
}
else {
std::cout << "n";
}
}

std::cout << "y";
}
catch (unsigned int n) {
n;
std::cout << "n";
}

std::cout << "y";
}

int main()
{
/*
* For this program, all subtests successful will print:
* - 14 'y'
* - 0 'n'
*/

test1();
test2();
test3();
}
46 changes: 46 additions & 0 deletions examples/src/windows/except/TestCppExUnhandled.cpp
Original file line number Diff line number Diff line change
@@ -0,0 +1,46 @@
#include <windows.h>
#include <cstdio>

LONG WINAPI CustomExceptionFilter(EXCEPTION_POINTERS* ExceptionInfo) {
printf("Inside exception filter (GOOD)\n");
DWORD exceptionCode = (DWORD)ExceptionInfo->ExceptionRecord->ExceptionCode;
printf("Exception Code: 0x%X\n", exceptionCode);

if (exceptionCode == 0xE06D7363) { // code for C++ exception
printf("Exception code DOES match, GOOD\n");
}
else {
printf("Exception code DOES NOT match, BAD\n");
}

printf("Exception Address: 0x%llx\n", (ULONGLONG)ExceptionInfo->ExceptionRecord->ExceptionAddress);

printf("After printing exception: (GOOD)\n");

return EXCEPTION_EXECUTE_HANDLER;
}

int main() {
/*
* For this program, all subtests successful will print:
* - 3 'GOOD'
* - 0 'BAD'
*
* It is expected that the program terminates abnormally
* with status code 0xE06D7363 (C++ exception)
*/

// Set the custom top-level exception filter
SetUnhandledExceptionFilter(CustomExceptionFilter);

// Throw an unhandled exception.
// It should be caught by our filter.
throw (unsigned int)5;

// We should never reach this point, because the exception
// dispatcher should terminate the program after our unhandled
// exception filter is called.
printf("After exception filter (BAD)\n");

return 0;
}
21 changes: 21 additions & 0 deletions examples/src/windows/except/TestCppExUnhandled2.cpp
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
#include <iostream>
#include <cstdio>

int main()
{
/*
* For this program, all subtests successful will print:
* - 1 'GOOD'
* - 0 'BAD'
*
* It is expected that the program terminates abnormally
* with status code 0xC0000409 (stack buffer overrun/security
* check failure)
*/

printf("Before throw (GOOD)\n");

throw (unsigned int)5;

printf("After throw (BAD)\n");
}
93 changes: 93 additions & 0 deletions examples/src/windows/except/TestCppTypes.cpp
Original file line number Diff line number Diff line change
@@ -0,0 +1,93 @@
#include <iostream>

struct TestStruct {
float q;
};

class TestClass {
public:
int x, y;
virtual ~TestClass() {
std::cout << "TestClass destructor, GOOD" << std::endl;
};
void yyy() {
std::cout << "REALLY GOOD" << std::endl;
}
};

class Something {
public:
char z;
virtual ~Something() {
std::cout << "Something destructor, GOOD" << std::endl;
};
virtual void zzz() {
std::cout << "BAD" << std::endl;
};
};

class TestClass2 : public TestClass, public Something {
public:
int z;
virtual ~TestClass2() {
std::cout << "TestClass2 destructor, GOOD" << std::endl;
};
virtual void zzz() {
std::cout << "GOOD" << std::endl;
};
};

int main()
{
/*
* For this program, all subtests successful will print:
* - 12 'GOOD'
* - 0 'BAD'
*/

int x = 5;
TestClass p;
TestStruct s;

std::cout << typeid(x).name() << std::endl;
if (strcmp(typeid(x).name(), "int") == 0) {
std::cout << "typeid(x) is int, GOOD" << std::endl;
}
else {
std::cout << "typeid(x) is NOT int, BAD" << std::endl;
}

std::cout << typeid(p).name() << std::endl;
if (strcmp(typeid(p).name(), "class TestClass") == 0) {
std::cout << "typeid(p) is \"class TestClass\", GOOD" << std::endl;
}
else {
std::cout << "typeid(p) is NOT \"class TestClass\", BAD" << std::endl;
}

std::cout << typeid(s).name() << std::endl;
if (strcmp(typeid(s).name(), "struct TestStruct") == 0) {
std::cout << "typeid(s) is \"struct TestStruct\", GOOD" << std::endl;
}
else {
std::cout << "typeid(s) is NOT \"struct TestStruct\", BAD" << std::endl;
}

std::cout << "Reached virtual methods and dynamic_cast test. GOOD" << std::endl;

TestClass2* kz = new TestClass2;

Something* ks = static_cast<Something*>(kz);

ks->zzz();

TestClass* pk = dynamic_cast<TestClass*>(ks);

pk->yyy();

std::cout << "Reached virtual destructor test. GOOD" << std::endl;

delete pk;

std::cout << "Finished all tests. GOOD" << std::endl;
}
45 changes: 45 additions & 0 deletions examples/src/windows/except/TestSoftSEH.cpp
Original file line number Diff line number Diff line change
@@ -0,0 +1,45 @@
#include <windows.h>
#include <cstdio>

void test1() {
__try {
printf("Inside __try block. (GOOD)\n");

RaiseException(
0xE0000001,
0,
0,
nullptr
);

printf("After RaiseException. (BAD)\n");
}
__except (EXCEPTION_EXECUTE_HANDLER) {
printf("In __except block. (GOOD)\n");

unsigned long excepCode = GetExceptionCode();

printf("Exception code=0x%x\n", excepCode);

if (excepCode == 0xE0000001) {
printf("Exception code IS same, GOOD\n");
}
else {
printf("Exception code DOES NOT MATCH, BAD\n");
}
}

printf("After __except block. (GOOD)\n");
}

int main() {
/*
* For this program, all subtests successful will print:
* - 4 'GOOD'
* - 0 'BAD'
*/

test1();

return 0;
}
Loading