x64dbg/x64dbg
x64dbg
/
x64dbg
1
0
Fork 0
Code Releases 5 Activity

DBG: remove TitanEngine for parsing TLS callbacks

This commit is contained in:
Duncan Ogilvie 2017-12-28 23:25:42 +01:00
parent 42dc5f90e5
commit 2d6004da9b
No known key found for this signature in database
GPG Key ID: FC89E0AAA0C1AAD8
3 changed files with 57 additions and 51 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

78
src/dbg/debugger.cpp
View File

@ -1371,34 +1371,23 @@ static void cbCreateProcess(CREATE_PROCESS_DEBUG_INFO* CreateProcessInfo)
if(settingboolget("Events", "TlsCallbacks"))
{
DWORD NumberOfCallBacks = 0;
TLSGrabCallBackDataW(StringUtils::Utf8ToUtf16(DebugFileName).c_str(), 0, &NumberOfCallBacks);
if(NumberOfCallBacks)
SHARED_ACQUIRE(LockModules);
auto modInfo = ModInfoFromAddr(duint(base));
int invalidCount = 0;
for(size_t i = 0; i < modInfo->tlsCallbacks.size(); i++)
{
dprintf(QT_TRANSLATE_NOOP("DBG", "TLS Callbacks: %d\n"), int(NumberOfCallBacks));
Memory<duint*> TLSCallBacks(NumberOfCallBacks * sizeof(duint), "cbCreateProcess:TLSCallBacks");
if(!TLSGrabCallBackDataW(StringUtils::Utf8ToUtf16(DebugFileName).c_str(), TLSCallBacks(), &NumberOfCallBacks))
dputs(QT_TRANSLATE_NOOP("DBG", "Failed to get TLS callback addresses!"));
else
auto callbackVA = modInfo->tlsCallbacks.at(i);
if(MemIsValidReadPtr(callbackVA))
{
duint ImageBase = GetPE32DataW(StringUtils::Utf8ToUtf16(DebugFileName).c_str(), 0, UE_IMAGEBASE);
int invalidCount = 0;
for(unsigned int i = 0; i < NumberOfCallBacks; i++)
{
duint callbackVA = TLSCallBacks()[i] - ImageBase + pDebuggedBase;
if(MemIsValidReadPtr(callbackVA))
{
String breakpointname = StringUtils::sprintf(GuiTranslateText(QT_TRANSLATE_NOOP("DBG", "TLS Callback %d")), i + 1);
sprintf_s(command, "bp %p,\"%s\",ss", callbackVA, breakpointname.c_str());
cmddirectexec(command);
}
else
invalidCount++;
}
if(invalidCount)
dprintf(QT_TRANSLATE_NOOP("DBG", "%d invalid TLS callback addresses...\n"), invalidCount);
String breakpointname = StringUtils::sprintf(GuiTranslateText(QT_TRANSLATE_NOOP("DBG", "TLS Callback %d")), i + 1);
sprintf_s(command, "bp %p,\"%s\",ss", callbackVA, breakpointname.c_str());
cmddirectexec(command);
}
else
invalidCount++;
}
if(invalidCount)
dprintf(QT_TRANSLATE_NOOP("DBG", "%d invalid TLS callback addresses...\n"), invalidCount);
}
if(settingboolget("Events", "EntryBreakpoint"))
@ -1680,36 +1669,25 @@ static void cbLoadDll(LOAD_DLL_DEBUG_INFO* LoadDll)
if(settingboolget("Events", "TlsCallbacks"))
{
DWORD NumberOfCallBacks = 0;
TLSGrabCallBackDataW(StringUtils::Utf8ToUtf16(DLLDebugFileName).c_str(), 0, &NumberOfCallBacks);
if(NumberOfCallBacks)
SHARED_ACQUIRE(LockModules);
auto modInfo = ModInfoFromAddr(duint(base));
int invalidCount = 0;
for(size_t i = 0; i < modInfo->tlsCallbacks.size(); i++)
{
dprintf(QT_TRANSLATE_NOOP("DBG", "TLS Callbacks: %d\n"), int(NumberOfCallBacks));
Memory<duint*> TLSCallBacks(NumberOfCallBacks * sizeof(duint), "cbLoadDll:TLSCallBacks");
if(!TLSGrabCallBackDataW(StringUtils::Utf8ToUtf16(DLLDebugFileName).c_str(), TLSCallBacks(), &NumberOfCallBacks))
dputs(QT_TRANSLATE_NOOP("DBG", "Failed to get TLS callback addresses!"));
else
auto callbackVA = modInfo->tlsCallbacks.at(i);
if(MemIsValidReadPtr(callbackVA))
{
duint ImageBase = GetPE32DataW(StringUtils::Utf8ToUtf16(DLLDebugFileName).c_str(), 0, UE_IMAGEBASE);
int invalidCount = 0;
for(unsigned int i = 0; i < NumberOfCallBacks; i++)
{
duint callbackVA = TLSCallBacks()[i] - ImageBase + (duint)base;
if(MemIsValidReadPtr(callbackVA))
{
if(bIsDebuggingThis)
sprintf_s(command, "bp %p,\"%s %u\",ss", callbackVA, GuiTranslateText(QT_TRANSLATE_NOOP("DBG", "TLS Callback")), i + 1);
else
sprintf_s(command, "bp %p,\"%s %u (%s)\",ss", callbackVA, GuiTranslateText(QT_TRANSLATE_NOOP("DBG", "TLS Callback")), i + 1, modname);
cmddirectexec(command);
}
else
invalidCount++;
}
if(invalidCount)
dprintf(QT_TRANSLATE_NOOP("DBG", "%d invalid TLS callback addresses...\n"), invalidCount);
if(bIsDebuggingThis)
sprintf_s(command, "bp %p,\"%s %u\",ss", callbackVA, GuiTranslateText(QT_TRANSLATE_NOOP("DBG", "TLS Callback")), i + 1);
else
sprintf_s(command, "bp %p,\"%s %u (%s)\",ss", callbackVA, GuiTranslateText(QT_TRANSLATE_NOOP("DBG", "TLS Callback")), i + 1, modname);
cmddirectexec(command);
}
else
invalidCount++;
}
if(invalidCount)
dprintf(QT_TRANSLATE_NOOP("DBG", "%d invalid TLS callback addresses...\n"), invalidCount);
}
auto breakOnDll = dbghandledllbreakpoint(modname, true);

29
src/dbg/module.cpp
View File

@ -16,7 +16,33 @@ bool MODRELOCATIONINFO::Contains(duint Address) const
return Address >= rva && Address < rva + size;
}
void ReadBaseRelocationTable(MODINFO & Info, ULONG_PTR FileMapVA)
static void ReadTlsCallbacks(MODINFO & Info, ULONG_PTR FileMapVA)
{
// TODO: proper bounds checking
// Clear TLS callbacks
Info.tlsCallbacks.clear();
// Get address and size of base relocation table
duint tlsDirRva = GetPE32DataFromMappedFile(FileMapVA, 0, UE_TLSTABLEADDRESS);
duint tlsDirSize = GetPE32DataFromMappedFile(FileMapVA, 0, UE_TLSTABLESIZE);
if(tlsDirRva == 0 || tlsDirSize == 0)
return;
auto tlsDir = PIMAGE_TLS_DIRECTORY(ConvertVAtoFileOffsetEx(FileMapVA, Info.loadedSize, 0, tlsDirRva, true, false) + FileMapVA);
if(!tlsDir || !tlsDir->AddressOfCallBacks)
return;
auto imageBase = GetPE32DataFromMappedFile(FileMapVA, 0, UE_IMAGEBASE);
auto tlsArray = PULONG_PTR(ConvertVAtoFileOffsetEx(FileMapVA, Info.loadedSize, 0, tlsDir->AddressOfCallBacks - imageBase, true, false) + FileMapVA);
if(!tlsArray)
return;
while(*tlsArray)
Info.tlsCallbacks.push_back(*tlsArray++ - imageBase + Info.base);
}
static void ReadBaseRelocationTable(MODINFO & Info, ULONG_PTR FileMapVA)
{
// Clear relocations
Info.relocations.clear();
@ -142,6 +168,7 @@ void GetModuleInfo(MODINFO & Info, ULONG_PTR FileMapVA)
// Clear imports by default
Info.imports.clear();
ReadTlsCallbacks(Info, FileMapVA);
ReadBaseRelocationTable(Info, FileMapVA);
}

1
src/dbg/module.h
View File

@ -41,6 +41,7 @@ struct MODINFO
std::vector<MODSECTIONINFO> sections;
std::vector<MODIMPORTINFO> imports;
std::vector<MODRELOCATIONINFO> relocations;
std::vector<duint> tlsCallbacks;
HANDLE fileHandle = nullptr;
DWORD loadedSize = 0;