1

Have a 64-bit plugin DLL (no source code) and the host application in an update changed its DLL characteristic to include "high-entropy 64-bit address space layout randomization (ASLR)" When this is set this causes the add-in to randomly crash. While I have used CFF explorer to remove the DLL characteristic for now to fix the application I am wondering if there is any static analysis techniques could be used on a disassembly to find ASLR incompatibility using tool like IDA Pro, or what such code may look like if come across analysing the application crash dumps.

With WinDbg I can see access violation here due to rbp set to invalid value:

uccoext64!GetOutlookViewID+0x46eee:
0000016b`01f75bae 488b4500        mov     rax,qword ptr [rbp] ss:00000000`05cccc50=????????????????

Stepping backwards I find this invalid value is set in a different DLL:

UcLogging64+0x1ec8:
0000016b`05201ec8 488b6c2438      mov     rbp,qword ptr [rsp+38h] ss:00000029`834f8978=0000000005cccc50

This section of code:

0:000> uf 0000016b`05201ec8 488b6c2438 
UcLogging64+0x1e40:
0000016b`05201e40 48895c2408      mov     qword ptr [rsp+8],rbx
0000016b`05201e45 48896c2410      mov     qword ptr [rsp+10h],rbp
0000016b`05201e4a 48897c2418      mov     qword ptr [rsp+18h],rdi
0000016b`05201e4f 4154            push    r12
0000016b`05201e51 4883ec20        sub     rsp,20h
0000016b`05201e55 33ff            xor     edi,edi
0000016b`05201e57 418bd9          mov     ebx,r9d
0000016b`05201e5a 4d8be0          mov     r12,r8
0000016b`05201e5d 488bea          mov     rbp,rdx
0000016b`05201e60 40387928        cmp     byte ptr [rcx+28h],dil
0000016b`05201e64 7423            je      UcLogging64+0x1e89 (0000016b`05201e89)  Branch

UcLogging64+0x1e66:
0000016b`05201e66 8b542450        mov     edx,dword ptr [rsp+50h]
0000016b`05201e6a 488d0d0fd60000  lea     rcx,[UcLogging64!UnifiedClientTrace+0xa480 (0000016b`0520f480)]
0000016b`05201e71 e82afaffff      call    UcLogging64+0x18a0 (0000016b`052018a0)
0000016b`05201e76 4885c0          test    rax,rax
0000016b`05201e79 7403            je      UcLogging64+0x1e7e (0000016b`05201e7e)  Branch

UcLogging64+0x1e7b:
0000016b`05201e7b 8b780c          mov     edi,dword ptr [rax+0Ch]

UcLogging64+0x1e7e:
0000016b`05201e7e f6c304          test    bl,4
0000016b`05201e81 7406            je      UcLogging64+0x1e89 (0000016b`05201e89)  Branch

UcLogging64+0x1e83:
0000016b`05201e83 85ff            test    edi,edi
0000016b`05201e85 7e02            jle     UcLogging64+0x1e89 (0000016b`05201e89)  Branch

UcLogging64+0x1e87:
0000016b`05201e87 ffcf            dec     edi

UcLogging64+0x1e89:
0000016b`05201e89 448b442450      mov     r8d,dword ptr [rsp+50h]
0000016b`05201e8e 448bcf          mov     r9d,edi
0000016b`05201e91 498bd4          mov     rdx,r12
0000016b`05201e94 488bcd          mov     rcx,rbp
0000016b`05201e97 e834fcffff      call    UcLogging64+0x1ad0 (0000016b`05201ad0)
0000016b`05201e9c f6c301          test    bl,1
0000016b`05201e9f 7422            je      UcLogging64+0x1ec3 (0000016b`05201ec3)  Branch

UcLogging64+0x1ea1:
0000016b`05201ea1 33c0            xor     eax,eax
0000016b`05201ea3 488bfd          mov     rdi,rbp
0000016b`05201ea6 4883c9ff        or      rcx,0FFFFFFFFFFFFFFFFh
0000016b`05201eaa 66f2af          repne scas word ptr [rdi]
0000016b`05201ead 488b053c890000  mov     rax,qword ptr [UcLogging64!UnifiedClientTrace+0x57f0 (0000016b`0520a7f0)]
0000016b`05201eb4 488947fe        mov     qword ptr [rdi-2],rax
0000016b`05201eb8 488b0539890000  mov     rax,qword ptr [UcLogging64!UnifiedClientTrace+0x57f8 (0000016b`0520a7f8)]
0000016b`05201ebf 48894706        mov     qword ptr [rdi+6],rax

UcLogging64+0x1ec3:
0000016b`05201ec3 488b5c2430      mov     rbx,qword ptr [rsp+30h]
0000016b`05201ec8 488b6c2438      mov     rbp,qword ptr [rsp+38h]
0000016b`05201ecd 488b7c2440      mov     rdi,qword ptr [rsp+40h]
0000016b`05201ed2 4883c420        add     rsp,20h
0000016b`05201ed6 415c            pop     r12
0000016b`05201ed8 c3              ret

Using Time Travel debugging and a memory write breakpoint on this location I see it seems to change here, stepping backwards:

UcLogging64+0x1e45:
0000016b`05201e45 48896c2410      mov     qword ptr [rsp+10h],rbp ss:00000029`834f8978=0000016b0520add8
0:000> r rbp
rbp=0000000005cccc50

Looking again for when rbp is set to this:

UcLogging64+0x1193:
0000016b`05201193 488b6c2448      mov     rbp,qword ptr [rsp+48h] ss:00000029`834f8958=0000000005cccc50

Stepping back:

UcLogging64+0x108a:
0000016b`0520108a 56              push    rsi
0:000> dd 00000029`834f8958
00000029`834f8958  05cccc50 00000000 834f8a09 00000029
00000029`834f8968  052051a4 0000016b 0520a728 0000016b
00000029`834f8978  0520add8 0000016b 834f89e0 00000029
00000029`834f8988  6d5e0000 00000000 000004e0 53282064
00000029`834f8998  01f92a80 0000016b 0520a728 0000016b
00000029`834f89a8  0520f0a0 0000016b ffffff01 ffffffff
00000029`834f89b8  01f92a70 0000016b 00000027 00000000
00000029`834f89c8  834fa670 00000029 fffffffe ffffffff
0:000> t-
Time Travel Position: 6516CD:1B [Unindexed] Index
UcLogging64+0x1085:
0000016b`05201085 48896c2420      mov     qword ptr [rsp+20h],rbp ss:00000029`834f8958=0000016b01fad918
0:000> dd 00000029`834f8958
00000029`834f8958  01fad918 0000016b 834f8a09 00000029

Going backwards again see this change to invalid instuction on pop rbp:

rbp=00000029834f8930
0:000> t-
Time Travel Position: 6516CB:134 [Unindexed] Index
MSVCR100!vswprintf_l+0xd7:
00000000`6d61400f 4883c450        add     rsp,50h
0:000> r rbp
rbp=00000029834f8930
0:000> t
Time Travel Position: 6516CB:135 [Unindexed] Index
MSVCR100!vswprintf_l+0xdb:
00000000`6d614013 5d              pop     rbp
0:000> t
Time Travel Position: 6516CB:136 [Unindexed] Index
MSVCR100!vswprintf_l+0xdc:
00000000`6d614014 c3              ret
0:000> r rbp
rbp=0000000005cccc50

As the value was corrupt before function started:

Time Travel Position: 6516CA:B51 [Unindexed] Index
MSVCR100!vswprintf_l+0x13:
00000000`6d613f4b 55              push    rbp
0:000> t-
Time Travel Position: 6516CA:B50 [Unindexed] Index
MSVCR100!vswprintf_l+0xf:
00000000`6d613f47 4c896020        mov     qword ptr [rax+20h],r12 ds:00000029`834f8958=0000000000000004
0:000> r rbp
rbp=0000000005cccc50

This gets setup in a previous msvcr100!vswprintf_l call:

MSVCR100!vsnprintf_l+0xbb:
00000000`6d613a0b 488b6c2468      mov     rbp,qword ptr [rsp+68h] ss:00000029`834f8938=0000000005cccc50
0:000> r rbp
rbp=0000000000000000
0:000> t
Time Travel Position: 6516CA:ACB [Unindexed] Index
MSVCR100!vsnprintf_l+0xc0:
00000000`6d613a10 488b742470      mov     rsi,qword ptr [rsp+70h] ss:00000029`834f8940=0000016b01fad918
0:000> r rbp
rbp=0000000005cccc50

This is setup earlier:

0:000> r rbp
rbp=0000000005cccc50
0:000> t
Time Travel Position: 6516CA:11C [Unindexed] Index
MSVCR100!vsnprintf_l+0x3:
00000000`6d613953 48895808        mov     qword ptr [rax+8],rbx ds:00000029`834f8930=0000016b0520f0a0
0:000> t
Time Travel Position: 6516CA:11D [Unindexed] Index
MSVCR100!vsnprintf_l+0x7:
00000000`6d613957 48896810        mov     qword ptr [rax+10h],rbp ds:00000029`834f8938=0000016b0520f000
0:000> t

This continues, I haven't traced all the way back to origin yet, I am wondering if there is some other way I could find likely code to create this problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.