Flag: Tornado! Hurricane!

Blogs >> Dreg's Blog

Created: Thursday, December 11 2008 22:52.45 CST Modified: Sunday, December 14 2008 17:01.24 CST
Printer Friendly ...
AuxLib - Reverse engineering of Auxiliary Windows API Library (x86 and x86_64)
Author: Dreg # Views: 3028

Here my reversing of the Auxiliary Windows API Library (x86 and x86_64), RELEASE 1.0  (MIT License)

This library is useful to avoid deadlocks and other stuff.


/*++

Routine Description:

    This routine is used to determine whether or not the caller is executing
    code while holding a system synchronization primitive. Such a situation
    can arise when the OS temporarily calls into user-specified code as part
    of the DLL load procedure.

    A caller can benefit from this information by avoiding operations that
    could potentially lead to deadlocks, e.g., acquiring a process private lock.

    For example, consider the following case:

        Thread A runs the THREAD_ATTACH routine for DLL X. This routine
            is invoked with OS DLL synchronization held. Suppose further that
            as part of this routine Thread A acquires some lock in DLL X (Lx).

        Thread B runs some code in DLL X that, while holding Lx, calls the OS
            library loader to, e.g. GetModuleHandle. As this routine acquires
            OS DLL synchronization, Thread B will deadlock with Thread A.

        This is an inherent limitation in the design of the OS loader as it
        performs such callouts as THREAD_ATTACH while holding loader
        synchronization. It can be partially ameliorated if Thread A detects
        that it is running with DLL synchronization held and only try-acquires
        other locks (such as Lx) that it may wish to take
    
Arguments:

    SynchronizationHeld - Boolean value which indicates whether or not
        synchronization is held.

Return Value:

    Boolean status. Error code available via GetLastError (). If the routine is
        invoked prior to invoking the initialization routine, the returned error code
        will be ERROR_INVALID_FUNCTION.

--*/

BOOL
WINAPI
AuxUlibIsDLLSynchronizationHeld (
    OUT PBOOL SynchronizationHeld
    );


For example, the easy-hook use the microsoft library to avoid deadlocks in the hooks.

Download the project (binaries and srcs) here: http://www.fr33project.org/projects/AuxLib.zip

In the future I post information about the lowlevel things of the library :-).

Enjoy :-).

Release 1.0:

- News in headers:
-. added structs from ReactOS and undocumented.ntinternals.net
-. new public header and private header
-. ...

- Fixed reversing bugs.

- Improved the code access to OwningThread (of the LoaderLock), now: DllSynchronizationOwnerPtr = \
& NtCurrentTeb()->Peb->LoaderLock->OwningThread;

- Less warnings.

- Code improved.

- All code compile and works in Release mode and Debug mode.

- POCs:
-. poc: poc program which use the Aux Library reversed.
-. poc microsoft: poc like the first which use the Microsoft Aux Library.
-. poc_deadlock: poc which creates deadlock. Try helds LoaderLock from two threads.
-. poc_without_deadlock: poc like poc_deadlock which avoid the deadlock using Aux Library reversed.

- Support x86 and x86_64.

- Documentation added:
-. Windows Auxiliary API library - Internals: Spanish and English
-. CHANGELOG
-. README

- Anything more...


Blog Comments
Dreg Posted: Friday, December 12 2008 19:21.25 CST
To debug, compile with the debug version of the library or add "volatile" to library functions. And you can see in dissasembler the code like the Microsoft Auxiliary Library:

CALL poc.AuxUlibInitialize
PUSH 3                                  
PUSH 2                                  
PUSH 1                                  
CALL poc.AuxUlibSetSystemFileCacheSize  
...

Now, the release optimization of the library makes confuse code, and not easy to debug... :-).



Add New Comment
Comment:









Active in Last 5 Minutes
HellScream

There are 16,670 total registered users.


Recently Created Topics
Process Snapshot
Mar/16
SSL keyfindert plugi...
Mar/15
ApiHooks.com down
Mar/15
how to crate a PATC...
Mar/10
wsnpoem audio.dll
Mar/09
suggestions - RE tra...
Mar/09
Requesting Suggestio...
Mar/06
Force enable debug p...
Mar/05
upgrading new image ...
Mar/03
upgrading new image ...
Mar/03


Recent Forum Posts
ApiHooks.com down
hkjack
how to crate a PATC...
comrade
ApiHooks.com down
comrade
suggestions - RE tra...
enm16
wsnpoem audio.dll
zhane
suggestions - RE tra...
Silkut
how to crate a PATC...
Silkut
suggestions - RE tra...
RolfRolles
wsnpoem audio.dll
debbie
Requesting Suggestio...
secursig


Recent Blog Entries
RolfRolles
Mar/08
Compiler Optimizations for ...

ReWolf
Mar/04
When memory management goes...

thesprawler
Feb/20
log1949.txt -- Wondering ho...

thesprawler
Feb/20
log1949.log -- created on C...

thesprawler
Feb/17
Trying to reverse the firmw...

More ...


Recent Blog Comments
Boken on:
Mar/12
Compiler Optimizations for ...

wildinto on:
Mar/10
Compiler Optimizations for ...

Orr on:
Mar/10
Compiler Optimizations for ...

bughoho on:
Mar/09
Compiler Optimizations for ...

cliffwolf on:
Mar/08
Compiler Optimizations for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit