📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.





About Articles Book Store Distributed RCE Downloads Event Calendar Forums Live Discussion Reference Library RSS Feeds Search Users What's New


Customize Theme

Flag: Tornado! Hurricane!

 Forums >>  Debuggers  >>  LOAD_DLL_DEBUG_EVENT

Topic created on: April 5, 2007 13:33 CDT by anonymouse .

does anyone have any information on the pointer returned by

lpImagename member of the struct below
i was parsing and i always get a 7FFDE014 value

which always shows NULL
7FFDE014  00 00 00 00 00 E0 FD 7F                          .....��

is this Imagename Really filled up by system when a debugger gets this DEBUG_EVENT ? can i rely on it or is it another bogus unreliable value ?


typedef struct _LOAD_DLL_DEBUG_INFO {
    HANDLE hFile;
    LPVOID lpBaseOfDll;
    DWORD dwDebugInfoFileOffset;
    DWORD nDebugInfoSize;
    LPVOID lpImageName;
    WORD fUnicode;
} LOAD_DLL_DEBUG_INFO, *LPLOAD_DLL_DEBUG_INFO;


Structure, item 22
Address=0012F54C
Name=u.LoadDll.lpImageName
Type=DWORD
Value=7FFDE014


here is the filled up structure


Structure
Address          Name                                                                                  Type      Value                              Hex Dump
0012F530         dwDebugEventCode                                                                      DWORD     00000006
0012F534         dwProcessId                                                                           DWORD     000001D0
0012F538         dwThreadId                                                                            DWORD     0000076C
0012F53C         u.CreateThread.hThread                                                                DWORD     0000009C
0012F540         u.CreateThread.lpThreadLocalBase                                                      DWORD     77F50000
0012F544         u.CreateThread.lpStartAddress                                                         DWORD     00000000
0012F53C         u.CreateProcessInfo.hFile                                                             DWORD     0000009C
0012F540         u.CreateProcessInfo.hProcess                                                          DWORD     77F50000
0012F544         u.CreateProcessInfo.hThread                                                           DWORD     00000000
0012F548         u.CreateProcessInfo.lpBaseOfImage                                                     DWORD     00000000
0012F54C         u.CreateProcessInfo.dwDebugInfoFileOffset                                             DWORD     7FFDE014
0012F550         u.CreateProcessInfo.nDebugInfoSize                                                    DWORD     00000001
0012F554         u.CreateProcessInfo.lpThreadLocalBase                                                 DWORD     7FFDE000
0012F558         u.CreateProcessInfo.lpStartAddress                                                    DWORD     00401000
0012F55C         u.CreateProcessInfo.lpImageName                                                       DWORD     00000000
0012F560         u.CreateProcessInfo.fUnicode                                                          WORD      0001
0012F53C         u.ExitThread.dwExitCode                                                               DWORD     0000009C
0012F53C         u.ExitProcess.dwExitCode                                                              DWORD     0000009C
0012F53C         u.LoadDll.hFile                                                                       DWORD     0000009C
0012F540         u.LoadDll.lpBaseOfDll                                                                 DWORD     77F50000
0012F544         u.LoadDll.dwDebugInfoFileOffset                                                       DWORD     00000000
0012F548         u.LoadDll.nDebugInfoSize                                                              DWORD     00000000
0012F54C         u.LoadDll.lpImageName                                                                 DWORD     7FFDE014
0012F550         u.LoadDll.fUnicode                                                                    WORD      0001
0012F53C         u.UnloadDll.lpBaseOfDll                                                               DWORD     0000009C
0012F53C         u.DebugString.lpDebugStringData                                                       DWORD     0000009C
0012F540         u.DebugString.fUnicode                                                                WORD      0000
0012F542         u.DebugString.nDebugStringiLength                                                     WORD      77F5
0012F53C         u.RipInfo.dwError                                                                     DWORD     0000009C
0012F540         u.RipInfo.dwType                                                                      DWORD     77F50000
0012F53C         u.Exception.pExceptionRecord.ExceptionCode                                            DWORD     0000009C
0012F540         u.Exception.pExceptionRecord.ExceptionFlags                                           DWORD     77F50000
0012F544         u.Exception.pExceptionRecord.pExceptionRecord                                         DWORD     00000000
0012F548         u.Exception.pExceptionRecord.ExceptionAddress                                         DWORD     00000000
0012F54C         u.Exception.pExceptionRecord.NumberParameters                                         DWORD     7FFDE014
0012F550         u.Exception.pExceptionRecord.ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS]       DWORD                                        0100000000E0FD7F0010400000000000
0012F58C         u.Exception.dwFirstChance                                                             DWORD     00000000


i know this event is for ntdll.dll
i can confirm the file handle ox9c is indeed ntdll.dll

Handles, item 12
Handle=0000009C
Type=File
Refs=   2.
Access=00120089 SYNCHRONIZE|READ_CONTROL|READ_DATA|READ_EA|READ_ATTRIBUTES
Info=Size 668672. (000A3400) bytes
Name=c:\WINDOWS\System32\ntdll.dll

should i be murking around with FindFilename From File handle routines to get the image name


see here another example


Structure
Address          Name                                                                                  Type      Value                              Hex Dump
0012F530         dwDebugEventCode                                                                      DWORD     00000006
0012F534         dwProcessId                                                                           DWORD     000001D0
0012F538         dwThreadId                                                                            DWORD     0000076C
0012F53C         u.CreateThread.hThread                                                                DWORD     000000A0
0012F540         u.CreateThread.lpThreadLocalBase                                                      DWORD     77E60000
0012F544         u.CreateThread.lpStartAddress                                                         DWORD     00000000
0012F53C         u.CreateProcessInfo.hFile                                                             DWORD     000000A0
0012F540         u.CreateProcessInfo.hProcess                                                          DWORD     77E60000
0012F544         u.CreateProcessInfo.hThread                                                           DWORD     00000000
0012F548         u.CreateProcessInfo.lpBaseOfImage                                                     DWORD     00000000
0012F54C         u.CreateProcessInfo.dwDebugInfoFileOffset                                             DWORD     7FFDE014
0012F550         u.CreateProcessInfo.nDebugInfoSize                                                    DWORD     00000001
0012F554         u.CreateProcessInfo.lpThreadLocalBase                                                 DWORD     7FFDE000
0012F558         u.CreateProcessInfo.lpStartAddress                                                    DWORD     00401000
0012F55C         u.CreateProcessInfo.lpImageName                                                       DWORD     00000000
0012F560         u.CreateProcessInfo.fUnicode                                                          WORD      0001
0012F53C         u.ExitThread.dwExitCode                                                               DWORD     000000A0
0012F53C         u.ExitProcess.dwExitCode                                                              DWORD     000000A0
0012F53C         u.LoadDll.hFile                                                                       DWORD     000000A0
0012F540         u.LoadDll.lpBaseOfDll                                                                 DWORD     77E60000
0012F544         u.LoadDll.dwDebugInfoFileOffset                                                       DWORD     00000000
0012F548         u.LoadDll.nDebugInfoSize                                                              DWORD     00000000
0012F54C         u.LoadDll.lpImageName                                                                 DWORD     7FFDE014
0012F550         u.LoadDll.fUnicode                                                                    WORD      0001
0012F53C         u.UnloadDll.lpBaseOfDll                                                               DWORD     000000A0
0012F53C         u.DebugString.lpDebugStringData                                                       DWORD     000000A0
0012F540         u.DebugString.fUnicode                                                                WORD      0000
0012F542         u.DebugString.nDebugStringiLength                                                     WORD      77E6
0012F53C         u.RipInfo.dwError                                                                     DWORD     000000A0
0012F540         u.RipInfo.dwType                                                                      DWORD     77E60000
0012F53C         u.Exception.pExceptionRecord.ExceptionCode                                            DWORD     000000A0
0012F540         u.Exception.pExceptionRecord.ExceptionFlags                                           DWORD     77E60000
0012F544         u.Exception.pExceptionRecord.pExceptionRecord                                         DWORD     00000000
0012F548         u.Exception.pExceptionRecord.ExceptionAddress                                         DWORD     00000000
0012F54C         u.Exception.pExceptionRecord.NumberParameters                                         DWORD     7FFDE014
0012F550         u.Exception.pExceptionRecord.ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS]       DWORD                                        0100000000E0FD7F0010400000000000
0012F58C         u.Exception.dwFirstChance                                                             DWORD     00000000


the handle A0 is kernel32.dll

Handles, item 13
Handle=000000A0
Type=File
Refs=   2.
Access=00120089 SYNCHRONIZE|READ_CONTROL|READ_DATA|READ_EA|READ_ATTRIBUTES
Info=Size 930304. (000E3200) bytes
Name=c:\WINDOWS\System32\KERNEL32.DLL

but the pointer in imagename is pointing at some 7ff

7FFDE014                       00 00 00 00 00 E0 FD 7F 00                       .....��.

any information would be helpful

some one with quick sleight of hand in scripting languages could confirm deny this with a quick hacked script

  Kayaker     April 6, 2007 06:10.26 CDT
Hi anonymouse,

It seems it's a matter of context. I got the same results as you (pointer 7FFDE014), but I noticed a couple of times in Softice that I could change the address context from the debugger to the debuggee and I got a valid lpImageName pointer..

Now if you look carefully at the definition for lpImageName in the LOAD_DLL_DEBUG_INFO structure, it states that the string pointer is "IN THE ADDRESS SPACE of the process being debugged"

----------------------------------------------
lpImageName
Pointer to the filename associated with hFile. This member may be NULL, or it may contain the address of a string pointer in the address space of the process being debugged. That address may, in turn, either be NULL or point to the actual filename. If fUnicode is a nonzero value, the name string is Unicode; otherwise, it is ANSI.

This member is strictly optional. Debuggers must be prepared to handle the case where lpImageName is NULL or *lpImageName (in the address space of the process being debugged) is NULL. Specifically, the system will never provide an image name for a create process event, and it will not likely pass an image name for the first DLL event. The system will also never provide this information in the case of debugging events that originate from a call to the DebugActiveProcess function.
----------------------------------------------


Using ReadProcessMemory seems to work however..
ntdll.dll doesn't show the full path, but the rest of the dlls do.
(sorry about the left alignment on the code, the /code tags don't seem to want to accept the correct code syntax spacing)


///////////////////////////////////////////

ULONG lpImageName;
char UnicodeStr[512];
char AsciiStr[256];

///////////////////////////////////////////
...
if(debugevent !=0)
{
debevmainloop = *debugevent;
if((debevmainloop.dwDebugEventCode == CREATE_PROCESS_DEBUG_EVENT))
{
dbgprocess = debevmainloop.u.CreateProcessInfo.hProcess;
}
else if((debevmainloop.dwDebugEventCode == LOAD_DLL_DEBUG_EVENT))
{

// Read LOAD_DLL_DEBUG_INFO.lpImageName in address space of debugee
ReadProcessMemory(dbgprocess, debevmainloop.u.LoadDll.lpImageName,
  &lpImageName, sizeof (lpImageName), NULL);

// Read Unicode lpImageName string
ReadProcessMemory(dbgprocess, lpImageName,
  &UnicodeStr, sizeof (UnicodeStr), NULL);

// Convert Unicode string to ASCII string
WideCharToMultiByte(CP_ACP, 0, UnicodeStr, -1, AsciiStr, 256, NULL, NULL);

MessageBox(NULL, &AsciiStr, "Dll being loaded", MB_OK);
}
}
}
//////////////////////////////////////////////////////////////////////


Cheers,
Kayaker

  anonymouse     April 6, 2007 12:07.17 CDT
Kayaker

thanks for the
[quote]
Now if you look carefully at the definition for lpImageName in the LOAD_DLL_DEBUG_INFO structure
[/quote]

obviously i didnt look (well couldnt have looked too if thats some solace)

i was actually looking inside ollydbg on how it is finding
it seems to do a loop on

ZwDuplicateObject()
ZwQueryObject()
with InfoClass = ObjectBasicInfo & ObjectTypeInfo & NameInfo

so before hacking and butchering around i thought ill ask :)

thanks once again for your reply

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM
oleavr
Oct/24
Anatomy of a code tracer
hasherezade
Sep/24
IAT Patcher - new tool for ...
oleavr
Aug/27
CryptoShark: code tracer ba...
oleavr
Jun/25
Build a debugger in 5 minutes
More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...
djnemo on:
Nov/17
Kernel debugger vs user mod...
acel on:
Nov/14
Kernel debugger vs user mod...
pedram on:
Dec/21
frida.github.io: scriptable...
capadleman on:
Jun/19
Using NtCreateThreadEx for ...
More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit