Flag: Tornado! Hurricane!

Blogs >> Dreg's Blog

Created: Thursday, December 11 2008 22:52.45 CST Modified: Sunday, December 14 2008 17:01.24 CST
Printer Friendly ...
AuxLib - Reverse engineering of Auxiliary Windows API Library (x86 and x86_64)
Author: Dreg # Views: 7648

Here my reversing of the Auxiliary Windows API Library (x86 and x86_64), RELEASE 1.0  (MIT License)

This library is useful to avoid deadlocks and other stuff.


/*++

Routine Description:

    This routine is used to determine whether or not the caller is executing
    code while holding a system synchronization primitive. Such a situation
    can arise when the OS temporarily calls into user-specified code as part
    of the DLL load procedure.

    A caller can benefit from this information by avoiding operations that
    could potentially lead to deadlocks, e.g., acquiring a process private lock.

    For example, consider the following case:

        Thread A runs the THREAD_ATTACH routine for DLL X. This routine
            is invoked with OS DLL synchronization held. Suppose further that
            as part of this routine Thread A acquires some lock in DLL X (Lx).

        Thread B runs some code in DLL X that, while holding Lx, calls the OS
            library loader to, e.g. GetModuleHandle. As this routine acquires
            OS DLL synchronization, Thread B will deadlock with Thread A.

        This is an inherent limitation in the design of the OS loader as it
        performs such callouts as THREAD_ATTACH while holding loader
        synchronization. It can be partially ameliorated if Thread A detects
        that it is running with DLL synchronization held and only try-acquires
        other locks (such as Lx) that it may wish to take
    
Arguments:

    SynchronizationHeld - Boolean value which indicates whether or not
        synchronization is held.

Return Value:

    Boolean status. Error code available via GetLastError (). If the routine is
        invoked prior to invoking the initialization routine, the returned error code
        will be ERROR_INVALID_FUNCTION.

--*/

BOOL
WINAPI
AuxUlibIsDLLSynchronizationHeld (
    OUT PBOOL SynchronizationHeld
    );


For example, the easy-hook use the microsoft library to avoid deadlocks in the hooks.

Download the project (binaries and srcs) here: http://www.fr33project.org/projects/AuxLib.zip

In the future I post information about the lowlevel things of the library :-).

Enjoy :-).

Release 1.0:

- News in headers:
-. added structs from ReactOS and undocumented.ntinternals.net
-. new public header and private header
-. ...

- Fixed reversing bugs.

- Improved the code access to OwningThread (of the LoaderLock), now: DllSynchronizationOwnerPtr = \
& NtCurrentTeb()->Peb->LoaderLock->OwningThread;

- Less warnings.

- Code improved.

- All code compile and works in Release mode and Debug mode.

- POCs:
-. poc: poc program which use the Aux Library reversed.
-. poc microsoft: poc like the first which use the Microsoft Aux Library.
-. poc_deadlock: poc which creates deadlock. Try helds LoaderLock from two threads.
-. poc_without_deadlock: poc like poc_deadlock which avoid the deadlock using Aux Library reversed.

- Support x86 and x86_64.

- Documentation added:
-. Windows Auxiliary API library - Internals: Spanish and English
-. CHANGELOG
-. README

- Anything more...


Blog Comments
Dreg Posted: Friday, December 12 2008 19:21.25 CST
To debug, compile with the debug version of the library or add "volatile" to library functions. And you can see in dissasembler the code like the Microsoft Auxiliary Library:

CALL poc.AuxUlibInitialize
PUSH 3                                  
PUSH 2                                  
PUSH 1                                  
CALL poc.AuxUlibSetSystemFileCacheSize  
...

Now, the release optimization of the library makes confuse code, and not easy to debug... :-).



Add New Comment
Comment:









There are 31,311 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
hi!
Jul/01
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit