📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  Debuggers  >>  # Syser causes BSOD

Topic created on: May 9, 2008 01:56 CDT by nezumi .

a new bug in Syser was found. download this file, unpack it and run make-all-and-run.bat.
under XP SP2 with Syser we have BSOD:
# BugCheck 100000D1, {45b0, ff, 0, f580aa75}
# Probably caused by : Syser.sys ( Syser+aa75 )
# DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)

this is _very_ strange, since the program causes crash - is a user-mode application (or, to be exactly, there are two programs - one traces another to find out NT bug: OS kernel doesn't zero TF bit on faults (see this post for more detail), leading to crash OllyDbg, but OllyDbg just refuses to debug, while Syser causes BSOD. not good :=( excellent way to defeat Syser, although :=)

btw, please test the file mentioned above on your box and mail me log or post it here. I would like to know what we get under different versions of Syser, Vista (with or without Syser), Server 2008 and especially virtual machines like VM Ware, Virtual PC, etc

  nezumi     May 12, 2008 06:04.30 CDT
the bug was located
rebuild PeterFerrie.exe with following options and forgot about BSOD:

$link.exe PeterFerrie.obj /ENTRY:nezumi /SUBSYSTEM:CONSOLE KERNEL32.LIB

the previous ones were:

$link.exe PeterFerrie.obj /FIXED /ENTRY:nezumi /SUBSYSTEM:CONSOLE /ALIGN:16 /MERGE:.rdata=.text /STUB:stub KERNEL32.LIB

I'm too lazy to check every combination to find out which one triggers BSOD. it might be /ALIGN:16 or section merging or incorrect ms-dos stub (I just truncated file at the end of MZ-header without fixing size of the file - windows doesn't check it).

I sent my report to Syser team, but got no answer. never mind. it's probable nothing. however, the bug gives a great opportunity to malware-writers, so it has to be fixed.

  proxy   June 17, 2008 15:25.40 CDT
Also, you should note that the crash is due (likely) because of a bug in a kernel mode portion of syser. If you look carefully at the crash you posted, you will see this:

# BugCheck 100000D1, {45b0, ff, 0, f580aa75}
# Probably caused by : Syser.sys ( Syser+aa75 )
# DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)

looks like syser.sys is the culpert :-P

  evilcry     June 22, 2008 05:35.29 CDT
Sometimes calling KMUTEX causes a deadly BSOD..

Syser 1.97

Informed the Bug Support Forum, No Reply from Coders.

Regards,
Evilcry

  nezumi     June 22, 2008 06:17.40 CDT
evilcry
better to write them directly. do you have mail?

  evilcry     June 22, 2008 10:34.11 CDT
Eh no, I don't know the mail of Coders :)

  nezumi     June 22, 2008 11:15.16 CDT
mail to support#sysersoft.com to Wu YanFeng or Chen JunHao, they should answer

  evilcry     June 22, 2008 11:23.51 CDT
Thanks :)

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit