Flag: Tornado! Hurricane!

Blogs >> Dreg's Blog

Created: Thursday, December 11 2008 22:52.45 CST Modified: Sunday, December 14 2008 17:01.24 CST
Printer Friendly ...
AuxLib - Reverse engineering of Auxiliary Windows API Library (x86 and x86_64)
Author: Dreg # Views: 3377

Here my reversing of the Auxiliary Windows API Library (x86 and x86_64), RELEASE 1.0  (MIT License)

This library is useful to avoid deadlocks and other stuff.


/*++

Routine Description:

    This routine is used to determine whether or not the caller is executing
    code while holding a system synchronization primitive. Such a situation
    can arise when the OS temporarily calls into user-specified code as part
    of the DLL load procedure.

    A caller can benefit from this information by avoiding operations that
    could potentially lead to deadlocks, e.g., acquiring a process private lock.

    For example, consider the following case:

        Thread A runs the THREAD_ATTACH routine for DLL X. This routine
            is invoked with OS DLL synchronization held. Suppose further that
            as part of this routine Thread A acquires some lock in DLL X (Lx).

        Thread B runs some code in DLL X that, while holding Lx, calls the OS
            library loader to, e.g. GetModuleHandle. As this routine acquires
            OS DLL synchronization, Thread B will deadlock with Thread A.

        This is an inherent limitation in the design of the OS loader as it
        performs such callouts as THREAD_ATTACH while holding loader
        synchronization. It can be partially ameliorated if Thread A detects
        that it is running with DLL synchronization held and only try-acquires
        other locks (such as Lx) that it may wish to take
    
Arguments:

    SynchronizationHeld - Boolean value which indicates whether or not
        synchronization is held.

Return Value:

    Boolean status. Error code available via GetLastError (). If the routine is
        invoked prior to invoking the initialization routine, the returned error code
        will be ERROR_INVALID_FUNCTION.

--*/

BOOL
WINAPI
AuxUlibIsDLLSynchronizationHeld (
    OUT PBOOL SynchronizationHeld
    );


For example, the easy-hook use the microsoft library to avoid deadlocks in the hooks.

Download the project (binaries and srcs) here: http://www.fr33project.org/projects/AuxLib.zip

In the future I post information about the lowlevel things of the library :-).

Enjoy :-).

Release 1.0:

- News in headers:
-. added structs from ReactOS and undocumented.ntinternals.net
-. new public header and private header
-. ...

- Fixed reversing bugs.

- Improved the code access to OwningThread (of the LoaderLock), now: DllSynchronizationOwnerPtr = \
& NtCurrentTeb()->Peb->LoaderLock->OwningThread;

- Less warnings.

- Code improved.

- All code compile and works in Release mode and Debug mode.

- POCs:
-. poc: poc program which use the Aux Library reversed.
-. poc microsoft: poc like the first which use the Microsoft Aux Library.
-. poc_deadlock: poc which creates deadlock. Try helds LoaderLock from two threads.
-. poc_without_deadlock: poc like poc_deadlock which avoid the deadlock using Aux Library reversed.

- Support x86 and x86_64.

- Documentation added:
-. Windows Auxiliary API library - Internals: Spanish and English
-. CHANGELOG
-. README

- Anything more...


Blog Comments
Dreg Posted: Friday, December 12 2008 19:21.25 CST
To debug, compile with the debug version of the library or add "volatile" to library functions. And you can see in dissasembler the code like the Microsoft Auxiliary Library:

CALL poc.AuxUlibInitialize
PUSH 3                                  
PUSH 2                                  
PUSH 1                                  
CALL poc.AuxUlibSetSystemFileCacheSize  
...

Now, the release optimization of the library makes confuse code, and not easy to debug... :-).



Add New Comment
Comment:









Active in Last 5 Minutes
timtoady

There are 21,677 total registered users.


Recently Created Topics
PyEmu error when cal...
Sep/02
Restore Themida/Winl...
Sep/02
Anti-olly technique
Aug/30
RAR Password
Aug/29
Heap protection on W...
Aug/23
Why Inline asm in C+...
Aug/20
Bypassing OllyAdvance
Aug/17
Error in logic for g...
Aug/17
Has anyone seen this...
Aug/17
ARM Executable - Pat...
Aug/16


Recent Forum Posts
reverse engineering ...
raiden56
pydbg, memory breakp...
Researc...
RAR Password
Ineedhelp
RAR Password
cod
Heap protection on W...
voila
Heap protection on W...
j00ru
Heap protection on W...
voila
Heap protection on W...
j00ru
Heap protection on W...
psylocn
Why Inline asm in C+...
ronnie2...


Recent Blog Entries
meshmesh
Sep/01
Is it legal??

waleedassar
Aug/30
Anti-olly technique

QvasiModo
Aug/24
WinAppDbg 1.4 is out!

artemblagodarenko
Aug/18
Dataflow-0.2.0 released. Ne...

grzonu
Aug/17
Bypassing OllyAdvanced

More ...


Recent Blog Comments
tosanjay on:
Sep/02
PyEmu 0.0.2

GynvaelColdwind on:
Sep/01
Is it legal??

PeterFerrie on:
Aug/31
Anti-olly technique

dennis on:
Aug/26
Dr. Gadget IDAPython plugin

halsten on:
Aug/19
Dataflow-0.2.0 released. Ne...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit