Flag: Tornado! Hurricane!

Blogs >> Dreg's Blog

Created: Thursday, December 11 2008 22:52.45 CST Modified: Sunday, December 14 2008 17:01.24 CST
Printer Friendly ...
AuxLib - Reverse engineering of Auxiliary Windows API Library (x86 and x86_64)
Author: Dreg # Views: 2949

Here my reversing of the Auxiliary Windows API Library (x86 and x86_64), RELEASE 1.0  (MIT License)

This library is useful to avoid deadlocks and other stuff.


/*++

Routine Description:

    This routine is used to determine whether or not the caller is executing
    code while holding a system synchronization primitive. Such a situation
    can arise when the OS temporarily calls into user-specified code as part
    of the DLL load procedure.

    A caller can benefit from this information by avoiding operations that
    could potentially lead to deadlocks, e.g., acquiring a process private lock.

    For example, consider the following case:

        Thread A runs the THREAD_ATTACH routine for DLL X. This routine
            is invoked with OS DLL synchronization held. Suppose further that
            as part of this routine Thread A acquires some lock in DLL X (Lx).

        Thread B runs some code in DLL X that, while holding Lx, calls the OS
            library loader to, e.g. GetModuleHandle. As this routine acquires
            OS DLL synchronization, Thread B will deadlock with Thread A.

        This is an inherent limitation in the design of the OS loader as it
        performs such callouts as THREAD_ATTACH while holding loader
        synchronization. It can be partially ameliorated if Thread A detects
        that it is running with DLL synchronization held and only try-acquires
        other locks (such as Lx) that it may wish to take
    
Arguments:

    SynchronizationHeld - Boolean value which indicates whether or not
        synchronization is held.

Return Value:

    Boolean status. Error code available via GetLastError (). If the routine is
        invoked prior to invoking the initialization routine, the returned error code
        will be ERROR_INVALID_FUNCTION.

--*/

BOOL
WINAPI
AuxUlibIsDLLSynchronizationHeld (
    OUT PBOOL SynchronizationHeld
    );


For example, the easy-hook use the microsoft library to avoid deadlocks in the hooks.

Download the project (binaries and srcs) here: http://www.fr33project.org/projects/AuxLib.zip

In the future I post information about the lowlevel things of the library :-).

Enjoy :-).

Release 1.0:

- News in headers:
-. added structs from ReactOS and undocumented.ntinternals.net
-. new public header and private header
-. ...

- Fixed reversing bugs.

- Improved the code access to OwningThread (of the LoaderLock), now: DllSynchronizationOwnerPtr = \
& NtCurrentTeb()->Peb->LoaderLock->OwningThread;

- Less warnings.

- Code improved.

- All code compile and works in Release mode and Debug mode.

- POCs:
-. poc: poc program which use the Aux Library reversed.
-. poc microsoft: poc like the first which use the Microsoft Aux Library.
-. poc_deadlock: poc which creates deadlock. Try helds LoaderLock from two threads.
-. poc_without_deadlock: poc like poc_deadlock which avoid the deadlock using Aux Library reversed.

- Support x86 and x86_64.

- Documentation added:
-. Windows Auxiliary API library - Internals: Spanish and English
-. CHANGELOG
-. README

- Anything more...


Blog Comments
Dreg Posted: Friday, December 12 2008 19:21.25 CST
To debug, compile with the debug version of the library or add "volatile" to library functions. And you can see in dissasembler the code like the Microsoft Auxiliary Library:

CALL poc.AuxUlibInitialize
PUSH 3                                  
PUSH 2                                  
PUSH 1                                  
CALL poc.AuxUlibSetSystemFileCacheSize  
...

Now, the release optimization of the library makes confuse code, and not easy to debug... :-).



Add New Comment
Comment:









Active in Last 5 Minutes
Wannabe

There are 15,871 total registered users.


Recently Created Topics
Career: Technical Pr...
Feb/04
Help needed with: ge...
Feb/04
A question regarding...
Feb/01
Compiler infector an...
Jan/29
Yahoo autoupdater vi...
Jan/27
Solidshield VM Analyse
Jan/27
Tuto about unpacking...
Jan/25
IDA Pro plugins don'...
Jan/20
Bug -- proc_peek_rec...
Jan/17
SYSTEM_INFORMATION_C...
Jan/16


Recent Forum Posts
IDA Pro plugins don'...
Cluster
RECON
hugo
A question regarding...
ronnie2...
A question regarding...
lallous
A question regarding...
detlef
RECON
hugo
Tuto about unpacking...
jumpzero
Yahoo autoupdater vi...
invisghost
Kindle for PC DRM
clarknova
Stack tracing with I...
Hanumaan


Recent Blog Entries
mjobin
Feb/08
Malware Research Analyst Op...

lin0xx
Feb/04
User-supplied Array Index E...

cyphunk
Feb/03
JTAG Enumeration (tool)

dragula
Jan/29
Reversing compiler infector...

GynvaelColdwind
Jan/26
The tale of Syndicate Wars ...

More ...


Recent Blog Comments
cyphunk on:
Feb/03
JTAG Enumeration (tool)

GynvaelColdwind on:
Feb/03
JTAG Enumeration (tool)

suirp on:
Feb/02
Administrator account VS. S...

DelightedZuk on:
Jan/31
GDT / LDT Windows Kernel Ex...

DelightedZuk on:
Jan/31
Administrator account VS. S...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit