Flag: Tornado! Hurricane!

 Forums >>  Brainstorms - General  >>  PE packer causing runtime MSVC++ runtime R6002 error

Topic created on: January 13, 2009 13:02 CST by blackd0t .

Hello!

I've recently started working on my own PE packer to understand the PE format better and I generally reached the moment where everything works with one slight exception. When I pack my PE files created with MSVC++ 2005 the executable runs fine until it has to perform calculations on floating numbers. That's when the runtime R6002: "floating point not loaded error" pops up. I'm writing here, because I spent hours looking for the solution on google, but to no avail.
I found some information that the CRT library of MSVC++ is buggy and if it detects .rdata section as writeable it will crash with this error. When it's read-only it should be fine. I've tried running VirtualProtect on decrypted parts of memory, which all reside in one section, to restore the old section permissions, but it didn't work.
Someone also said that linking the VC++ application with msvcrt.lib will help and yes it does, but then I have compatibility issues running the application on different systems.

I'd be glad if anyone could lend me a hand with this problem. I know the UPX author had the same problem with his packer long time ago, but I have no idea how he solved the problem and it would take quite a long time to find the solution in the sources.

Regards,
Black Dot

  nezumi     January 13, 2009 17:51.10 CST
VirtualProtect should work, just pass the base address of the allocated block. could you show the original and packed file? hope I will find out what's wrong.

added:
yep, I found it! what's bi... bizarre code there! wow! wait a sec, description is following...

  nezumi     January 13, 2009 22:00.19 CST
quick answer: ms floating point RTL calls _IsNonwritableInCurrentImage() to checks if the given memory cell belongs to non-writable section or not. if the section is writable we get the error: "R6002: floating point not loaded".

the problem is: _IsNonwritableInCurrentImage() does not check the real attributes, just reads PE header. no wonder that VirtualProtect() does not work! I mean it works, but _IsNonwritableInCurrentImage() ignores the real memory attributes. so, your packer should restore PE header in memory.

more info: # MS VC - challenge for PE packers

  bw     January 14, 2009 13:39.14 CST
Patch .code and .rdata section flags after loading exe image (unlock PE header first with VirtualProtect) (UPX way), you could also leave nonwritable flags on the sections and write to them with WriteProcessMemory() api, you could also scan exe image and patch _IsNonwritableInCurrentImage() function (i dont recommend it, because its code is compiled from the C source)

In my opinion this "improvement" from MS was made to break all existing exe packers :)

  blackd0t     January 15, 2009 18:21.17 CST
Nezumi, bw: Thank you for your findings! That's truly bizzare how it behaves, I'll just reconstruct the PE header then and it should work fine. As an interesting thing I can say that apps compiled with MSVC++ 2003 work fine without this "floating point" error when packed.

Note: Registration is required to post to the forums.

There are 31,313 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
hi!
Jul/01
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit