Fix the issue with TitanEngine closing invalid handles

https://x64dbg.com/blog/2017/11/04/the-big-handle-gamble.html
This commit is contained in:
Duncan Ogilvie 2017-11-11 11:06:15 +01:00
parent f3626c717e
commit 02be13641e
No known key found for this signature in database
GPG Key ID: FC89E0AAA0C1AAD8
2 changed files with 4 additions and 10 deletions

View File

@ -25,14 +25,10 @@ __declspec(dllexport) void TITCALL ForceClose()
int libcount = (int)hListLibrary.size();
for(int i = 0; i < libcount; i++)
{
if(hListLibrary.at(i).hFile != (HANDLE) - 1)
if(hListLibrary.at(i).hFileMappingView != NULL)
{
if(hListLibrary.at(i).hFileMappingView != NULL)
{
UnmapViewOfFile(hListLibrary.at(i).hFileMappingView);
EngineCloseHandle(hListLibrary.at(i).hFileMapping);
}
EngineCloseHandle(hListLibrary.at(i).hFile);
UnmapViewOfFile(hListLibrary.at(i).hFileMappingView);
EngineCloseHandle(hListLibrary.at(i).hFileMapping);
}
}
ClearLibraryList();

View File

@ -257,7 +257,6 @@ __declspec(dllexport) void TITCALL DebugLoop()
hListLibraryFirst = false;
LIBRARY_ITEM_DATAW NewLibraryData;
memset(&NewLibraryData, 0, sizeof(LIBRARY_ITEM_DATAW));
NewLibraryData.hFile = DBGEvent.u.LoadDll.hFile;
NewLibraryData.BaseOfDll = DBGEvent.u.LoadDll.lpBaseOfDll;
hFileMapping = DBGEvent.u.LoadDll.hFile ? CreateFileMappingA(DBGEvent.u.LoadDll.hFile, NULL, PAGE_READONLY, 0, 0, NULL) : NULL;
if(hFileMapping != NULL)
@ -375,8 +374,7 @@ __declspec(dllexport) void TITCALL DebugLoop()
//maintain library list
for(unsigned int i = 0; i < hListLibrary.size(); i++)
{
if(hListLibrary.at(i).BaseOfDll == DBGEvent.u.UnloadDll.lpBaseOfDll &&
hListLibrary.at(i).hFile != INVALID_HANDLE_VALUE)
if(hListLibrary.at(i).BaseOfDll == DBGEvent.u.UnloadDll.lpBaseOfDll)
{
if(hListLibrary.at(i).hFileMappingView != NULL)
{