VirtualProtect and app crash: what's your interpretation?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Here is my thought process on why the application crashes with a 
protection violation reading a section of memory.

I used IDA to disassemble the app. Here's the section where it reads 
from memory and crashes because of a protection violation:

00760D4A sub_760D4A      proc near               ; CODE XREF: 
sub_75FCB0+159^Xp
00760D4A                 push    ebp
00760D4B                 mov     eax, ds:dword_75D66C
00760D50                 mov     ebp, esp
00760D52                 sub     esp, 14h
00760D55                 push    ebx
;
; localvar <- *(long *)75D66C = 0x56000
;
00760D56                 mov     [ebp-4], eax
00760D59                 push    esi
00760D5A                 push    edi
00760D5B                 push    eax
00760D5C                 push    75D5F0h
00760D61                 call    sub_75FC7B
00760D66                 add     esp, 8
00760D69                 mov     ds:dword_75D720, eax
00760D6E                 movzx   ecx, ds:word_75D5F2
00760D75                 cmp     ecx, eax
00760D77                 jbe     loc_760EFC
00760D7D                 mov     ecx, ds:dword_75D704
00760D83                 imul    eax, 28h
00760D86                 mov     eax, [eax+ecx+34h]
00760D8A                 sub     eax, [ebp-4]
00760D8D                 cmp     ds:dword_75D734, 2
00760D94                 mov     [ebp-14h], eax
;
; If (*(long *)75D734) != 2 then skip the call to
; VirtualProtect
;
00760D97                 jnz     short loc_760DC4
;
; Push arguments to VirtualProtect(
;    LPVOID lpAddress,
;    SIZE_T dwSize,
;    DWORD flNewProtect,
;    PDWORD lpflOldProtect)
;
00760D99                 lea     eax, [ebp-8]
;
; lpflOldProtect is a local variable
;
00760D9C                 push    eax
;
; flNewProtect = 4 = PAGE_READWRITE
;
00760D9D                 push    4
;
; dwSize = size of region to protect = a local variable
;
00760D9F                 push    dword ptr [ebp-14h]
;
; lpAddress = base address of region to protect =
;   (*(long *)75D728) + localvar
;
00760DA2                 mov     eax, ds:dword_75D728
00760DA7                 add     eax, [ebp-4]
00760DAA                 push    eax
00760DAB                 call    ds:VirtualProtect
00760DB1                 test    eax, eax
;
; On success go to loc_760DC4
;
00760DB3                 jnz     short loc_760DC4
;
; This routine prints an error message and exits
;
00760DB5                 push    3
00760DB7                 push    75B470h
00760DBC                 call    sub_7602F6
00760DC1                 add     esp, 8
00760DC4
00760DC4 loc_760DC4:                             ; CODE XREF: 
sub_760D4A+4D^Xj
00760DC4                                         ; sub_760D4A+69^Xj
00760DC4                 mov     esi, ds:dword_75D728
00760DCA                 add     esi, [ebp-4]
;
; here is the instruction causing the fault:
;   eax <- *(0x10 + (*(long *)75D728) + localvar)
;
00760DCD                 mov     eax, [esi+10h]
00760DD0                 test    eax, eax
00760DD2                 jz      loc_760EB4
00760DD8
00760DD8 loc_760DD8:                             ; CODE XREF: 
sub_760D4A+164^Yj
00760DD8                 mov     ecx, ds:dword_75D728
00760DDE                 lea     edi, [ecx+eax]
00760DE1                 mov     eax, [esi+0Ch]
00760DE4                 add     eax, ecx
00760DE6                 push    eax
00760DE7                 mov     [ebp-10h], eax
00760DEA                 call    ds:LoadLibraryA
00760DF0                 mov     [ebp-0Ch], eax
00760DF3                 test    eax, eax
00760DF5                 jnz     short loc_760E04
00760DF7                 push    6
00760DF9                 push    dword ptr [ebp-10h]
00760DFC                 call    sub_7602F6
00760E01                 add     esp, 8


At this point, winedbg says

First chance exception: page fault on read access to 0x00456010 in 
32-bit code (0x00760dcd)

According to IDA, that section at 0x456000 is named .shrink1, is an 
uninitialized section of memory, and should be read/write:

00456000 ; Section 3. (virtual address 00056000)
00456000 ; Virtual size                  : 00002000 (   8192.)
00456000 ; Section size in file          : 00000000 (      0.)
00456000 ; Offset to raw data for section: 00000000
00456000 ; Flags C0000082: Noload Bss Readable Writable
00456000 ; Alignment     : 16 bytes by default
00456000
00456000 .shrink1        segment para public '' use32
00456000                 assume cs:.shrink1
00456000                 ;org 456000h



In addition, the trace of the last call to VirtualProtect shows this:

0806d398:Call 
kernel32.VirtualProtect(00459000,00000018,00000002,40616e74) ret=0075fd82
0806d398:trace:virtual:VirtualProtect 0x459000 00000018 00000002
0806d398:trace:virtual:VIRTUAL_SetProt 0x459000-0x459fff c-r--
View: 0x400000 - 0x765fff 28
       0x400000 - 0x400fff c-r--
       0x401000 - 0x458fff c----   <-- here is where the read is
       0x459000 - 0x459fff c-r--
       0x45a000 - 0x758fff c----
       0x759000 - 0x765fff c-rw-
0806d398:Ret  kernel32.VirtualProtect() retval=00000001 ret=0075fd82

Note that this call has a protect of 2, not 4. That means the branch at 
00760D97 must have been taken. That branch gets taken if
*(long *)75D734 is not equal to 2. gdb shows that the contents is 3. And 
where does this value come from?

It is loaded only in this subroutine:


0075F000 sub_75F000      proc near               ; CODE XREF: start+7C^Yp
0075F000                 call    ds:GetVersion
0075F006                 movzx   ecx, ah
0075F009                 movzx   edx, al
0075F00C                 mov     dword_75D738, ecx
0075F012                 mov     dword_75D730, edx
0075F018                 test    eax, 80000000h
0075F01D                 jz      short loc_75F03C
0075F01F                 cmp     edx, 4
0075F022                 jge     short loc_75F030
0075F024                 mov     dword_75D734, 1
0075F02E                 jmp     short locret_75F046
0075F030
0075F030 loc_75F030:                             ; CODE XREF: 
sub_75F000+22^Xj
0075F030                 mov     dword_75D734, 2
0075F03A                 jmp     short locret_75F046
0075F03C
0075F03C loc_75F03C:                             ; CODE XREF: 
sub_75F000+1D^Xj
0075F03C                 mov     dword_75D734, 3
0075F046
0075F046 locret_75F046:                          ; CODE XREF: 
sub_75F000+2E^Xj
0075F046                                         ; sub_75F000+3A^Xj
0075F046                 retn
0075F046 sub_75F000      endp


*(long *)75D738 is the major version of Windows, 4.
*(long *)75D730 is the minor version, 0.
*(long *)75D734 is a "level", 3 for NT/2000/XP, 2 for 95/98/Me, or 1 for 
win32s. It contains 3.

Thus, GetVersion is correctly returning NT 4.0.

This was the trace of the last call to GetVersion:

0806d398:Call kernel32.GetVersion() ret=0075f006
0806d398:Ret  kernel32.GetVersion() retval=05650004 ret=0075f006


So the funny thing is that the app skips the VirtualProtect (which would 
have made the memory have read/write access) only if the Windows version 
is not 95/98/Me. But I didn't get a crash when I ran this natively under 
2000 (which was running under VMWare)!

So next I need to find the place where the protection is placed on the 
memory range in question. The wine trace shows this:

0806d398:Call 
kernel32.VirtualProtect(00401000,00358000,00000001,40616e74) ret=0075fd22
0806d398:trace:virtual:VirtualProtect 0x401000 00358000 00000001
0806d398:trace:virtual:VIRTUAL_SetProt 0x401000-0x758fff c----
View: 0x400000 - 0x765fff 28
       0x400000 - 0x400fff c-r--
       0x401000 - 0x758fff c----
       0x759000 - 0x765fff c-rw-
0806d398:Ret  kernel32.VirtualProtect() retval=00000001 ret=0075fd22


And the listing around that address is:


0075FCB0 sub_75FCB0      proc near               ; CODE XREF: 
sub_7605E2+47^Yp
0075FCB0                 push    ebp
0075FCB1                 mov     ebp, esp
0075FCB3                 sub     esp, 4
0075FCB6                 cmp     dword_75D734, 2
0075FCBD                 push    esi
;
; If "level" is not 2, call bunches of VirtualProtects.
;
0075FCBE                 jnz     short loc_75FCE4
0075FCC0                 mov     eax, dword_75D728
0075FCC5                 push    eax
0075FCC6                 push    75D5F0h
0075FCCB                 push    dword_75D72C
0075FCD1                 push    dword_75B1B4
0075FCD7                 call    sub_7617D3
0075FCDC                 add     esp, 10h
0075FCDF                 jmp     loc_75FDAD
0075FCE4
0075FCE4 loc_75FCE4:                             ; CODE XREF: 
sub_75FCB0+E^Xj
0075FCE4                 mov     eax, dword_75D63C
0075FCE9                 add     eax, dword_75D728
0075FCEF                 push    eax
0075FCF0                 push    dword_75D728
0075FCF6                 call    sub_75F07E
0075FCFB                 add     esp, 8
;
; This is VirtualProtect call from above:
;
; base address = *(long *)75D624 + *(long *)75D728
; size = *(long *)75D63C - *(long *)75D624
; access = PAGE_NOACCESS
; oldaccessptr = localvar
;
0075FCFE                 lea     ecx, [ebp-4]
0075FD01                 mov     eax, dword_75D63C
0075FD06                 push    ecx
0075FD07                 push    1
0075FD09                 sub     eax, dword_75D624
0075FD0F                 push    eax
0075FD10                 mov     eax, dword_75D624
0075FD15                 add     eax, dword_75D728
0075FD1B                 push    eax
0075FD1C                 call    ds:VirtualProtect
0075FD22                 test    eax, eax
0075FD24                 jnz     short loc_75FD35
;
0075FD26                 push    7
0075FD28                 push    75B3FCh
0075FD2D                 call    sub_7602F6
0075FD32                 add     esp, 8
0075FD35
0075FD35 loc_75FD35:                             ; CODE XREF: 
sub_75FCB0+74^Xj
0075FD35                 mov     esi, dword_75D6AC
0075FD3B                 push    esi
0075FD3C                 push    75D5F0h
0075FD41                 call    sub_75FC7B
0075FD46                 add     esp, 8
;
0075FD49                 mov     [ebp-4], eax
0075FD4C                 movzx   eax, word_75D5F2
0075FD53                 cmp     eax, [ebp-4]
0075FD56                 jbe     short loc_75FD95
;
; This is the last VirtualProtect call.
; base address = esi + *(long *)dword_75D728
;              = 0x459000
; size = *(long *)75D6B0
;      = 0x18
; new = the return value of sub_75FC23
;     = 2 = PAGE_READONLY
; oldptr = ?
;
0075FD58                 lea     eax, [ebp-4]
0075FD5B                 push    eax
0075FD5C                 push    dword ptr [ebp-4]
0075FD5F                 push    dword_75D704
0075FD65                 call    sub_75FC23
0075FD6A                 add     esp, 8
0075FD6D                 push    eax
0075FD6E                 mov     eax, dword_75D728
0075FD73                 push    dword_75D6B0
0075FD79                 add     eax, esi
0075FD7B                 push    eax
0075FD7C                 call    ds:VirtualProtect
0075FD82                 test    eax, eax
0075FD84                 jnz     short loc_75FD95
;
0075FD86                 push    7
0075FD88                 push    75B400h
0075FD8D                 call    sub_7602F6
0075FD92                 add     esp, 8
0075FD95
0075FD95 loc_75FD95:                             ; CODE XREF: 
sub_75FCB0+A6^Xj
0075FD95                                         ; sub_75FCB0+D4^Xj
0075FD95                 mov     eax, dword_75D664
0075FD9A                 push    eax
0075FD9B                 push    75D5F0h
0075FDA0                 call    sub_75FC7B
0075FDA5                 add     esp, 8
0075FDA8                 mov     dword_75D5E4, eax


Note that *(long *)75D728 was also mentioned in the skipped 
VirtualProtect call. That address contains 0x400000, which is the base 
of the memory-mapped executable:

0806d398:trace:module:map_image mapped PE file at 0x400000-0x766000
0806d398:trace:module:map_image mapping section .rdata at 0x459000 off 
400 size
200 flags 50000040
0806d398:trace:module:map_image mapping section .shrink3 at 0x759000 off 
7600 size 200 flags 40000042
0806d398:trace:module:map_image clearing 0x759200 - 0x75a000
0806d398:trace:module:map_image mapping section .rdata at 0x75a000 off 
301000 size 200 flags 40000040
0806d398:trace:module:map_image mapping section .data at 0x75b000 off 
800 size 1600 flags c0000040
0806d398:trace:module:map_image clearing 0x75c600 - 0x75d000
0806d398:trace:module:map_image mapping section .idata at 0x75e000 off 
1e00 size a00 flags c0000040
0806d398:trace:module:map_image mapping section .load at 0x75f000 off 
2800 size
3200 flags 68040020
0806d398:trace:module:map_image mapping section .reloc at 0x763000 off 
5a00 size 800 flags 42000040
0806d398:trace:module:map_image mapping section .rsrc at 0x764000 off 
6200 size
1400 flags 50000040
0806d398: dup_handle( src_process=-1, src_handle=24, dst_process=-1, 
access=00000000, inherit=0, options=2 )
0806d398: dup_handle() = 0 { handle=28, fd=-1 }
View: 0x400000 - 0x765fff 28
       0x400000 - 0x765fff c-rw-

That address is filled via a call to VirtualQuery, storing the 
allocation base address of the virtual memory space containing the 
address 0x75D5F0.

Why is the app trying to read from 0x456010? Where did it get the 
0x56000 offset from? That offset was stored in 0x75D66C. That address is 
not mentioned explicitly anywhere else, but looking at the memory around 
that value, it looks like there is an array of file segment info there.

So this call:

;
; This is VirtualProtect call from above:
;
; base address = *(long *)75D624 + *(long *)75D728
; size = *(long *)75D63C - *(long *)75D624
; access = PAGE_NOACCESS
; oldaccessptr = localvar
;


actually sets PAGE_NOACCESS from the beginning of a segment to the end 
of the segment. That segment is at 0x1000, and the next segment in the 
array starts at 0x359000.

At this point I'm totally nonplussed.

Does anyone know of an NT/2000 debugger that works? I tried Borland's 
free TurboDebugger 5.5 but that failed to run the program.

--Rob









[Index of Archives]     [Gimp for Windows]     [Red Hat]     [Samba]     [Yosemite Camping]     [Graphics Cards]     [Wine Home]

  Powered by Linux