Flag: Tornado! Hurricane!

Blogs >> Dreg's Blog

Created: Thursday, December 11 2008 22:52.45 CST Modified: Sunday, December 14 2008 17:01.24 CST
Printer Friendly ...
AuxLib - Reverse engineering of Auxiliary Windows API Library (x86 and x86_64)
Author: Dreg # Views: 3308

Here my reversing of the Auxiliary Windows API Library (x86 and x86_64), RELEASE 1.0  (MIT License)

This library is useful to avoid deadlocks and other stuff.


/*++

Routine Description:

    This routine is used to determine whether or not the caller is executing
    code while holding a system synchronization primitive. Such a situation
    can arise when the OS temporarily calls into user-specified code as part
    of the DLL load procedure.

    A caller can benefit from this information by avoiding operations that
    could potentially lead to deadlocks, e.g., acquiring a process private lock.

    For example, consider the following case:

        Thread A runs the THREAD_ATTACH routine for DLL X. This routine
            is invoked with OS DLL synchronization held. Suppose further that
            as part of this routine Thread A acquires some lock in DLL X (Lx).

        Thread B runs some code in DLL X that, while holding Lx, calls the OS
            library loader to, e.g. GetModuleHandle. As this routine acquires
            OS DLL synchronization, Thread B will deadlock with Thread A.

        This is an inherent limitation in the design of the OS loader as it
        performs such callouts as THREAD_ATTACH while holding loader
        synchronization. It can be partially ameliorated if Thread A detects
        that it is running with DLL synchronization held and only try-acquires
        other locks (such as Lx) that it may wish to take
    
Arguments:

    SynchronizationHeld - Boolean value which indicates whether or not
        synchronization is held.

Return Value:

    Boolean status. Error code available via GetLastError (). If the routine is
        invoked prior to invoking the initialization routine, the returned error code
        will be ERROR_INVALID_FUNCTION.

--*/

BOOL
WINAPI
AuxUlibIsDLLSynchronizationHeld (
    OUT PBOOL SynchronizationHeld
    );


For example, the easy-hook use the microsoft library to avoid deadlocks in the hooks.

Download the project (binaries and srcs) here: http://www.fr33project.org/projects/AuxLib.zip

In the future I post information about the lowlevel things of the library :-).

Enjoy :-).

Release 1.0:

- News in headers:
-. added structs from ReactOS and undocumented.ntinternals.net
-. new public header and private header
-. ...

- Fixed reversing bugs.

- Improved the code access to OwningThread (of the LoaderLock), now: DllSynchronizationOwnerPtr = \
& NtCurrentTeb()->Peb->LoaderLock->OwningThread;

- Less warnings.

- Code improved.

- All code compile and works in Release mode and Debug mode.

- POCs:
-. poc: poc program which use the Aux Library reversed.
-. poc microsoft: poc like the first which use the Microsoft Aux Library.
-. poc_deadlock: poc which creates deadlock. Try helds LoaderLock from two threads.
-. poc_without_deadlock: poc like poc_deadlock which avoid the deadlock using Aux Library reversed.

- Support x86 and x86_64.

- Documentation added:
-. Windows Auxiliary API library - Internals: Spanish and English
-. CHANGELOG
-. README

- Anything more...


Blog Comments
Dreg Posted: Friday, December 12 2008 19:21.25 CST
To debug, compile with the debug version of the library or add "volatile" to library functions. And you can see in dissasembler the code like the Microsoft Auxiliary Library:

CALL poc.AuxUlibInitialize
PUSH 3                                  
PUSH 2                                  
PUSH 1                                  
CALL poc.AuxUlibSetSystemFileCacheSize  
...

Now, the release optimization of the library makes confuse code, and not easy to debug... :-).



Add New Comment
Comment:









There are 20,335 total registered users.


Recently Created Topics
Career: Threat Inte...
Jul/30
Career: Security Res...
Jul/30
Library Debugging Pr...
Jul/29
Pydbg attach Vs load?
Jul/29
IDA and MIPS (emulat...
Jul/27
UK Cyber Security ch...
Jul/26
System Service Descr...
Jul/26
LD_PRELOAD Question
Jul/23
Patching Application...
Jul/22
Contract: Research E...
Jul/19


Recent Forum Posts
Pydbg attach Vs load?
aMIr
LD_PRELOAD Question
monarch
LD_PRELOAD Question
justano...
LD_PRELOAD Question
monarch
Patching Application...
hughhan
Patching Application...
jduck
immunity debugger pl...
Malware...
paimei installation ...
wishi
IDA Pro customization
wishi
how to chnage an ins...
ConsoleFx


Recent Blog Entries
ResearchAviator
Jul/28
Installation procedure for ...

artemblagodarenko
Jul/27
Common function prototype

dennis
Jul/24
Dr. Gadget IDAPython plugin

trufae
Jul/23
radare2 0.5 released

AmrThabet
Jul/21
Pokas x86 Emulator for Gene...

More ...


Recent Blog Comments
omeg on:
Jul/29
Windows 7 syscall list

renzosilv on:
Jul/26
Windows 7 syscall list

renzosilv on:
Jul/26
Windows 7 syscall list

Dreg on:
Jul/21
HiperDrop 0.0.1

djnemo on:
Jul/20
HiperDrop 0.0.1

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit