reece/UWP-SEH-Exception-Sniffing-POC
1
0
Fork 0
Code Issues 1 Pull Requests Releases Wiki Activity

Recrinkling...

Browse Source
This commit is contained in:
Reece Wilson 2022-01-23 02:39:33 +00:00
parent 859c35d175
commit 7bd09bbb64
2 changed files with 13 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
a_1authrowhook.asm
View File

@ -3,8 +3,8 @@
; A/B/C:\... < ntstc_msvcrt's d:\os\obj\... ; A/B/C:\... < ntstc_msvcrt's d:\os\obj\...
PUBLIC _CxxThrowException PUBLIC _CxxThrowException
EXTERN _CxxThrowExceptionHook : proc EXTERN _SEHReport : proc
EXTERN CXX_THROW_REFERENCE : qword EXTERN gGxxThrowRefDll : qword
.code .code
@ -15,16 +15,15 @@ _CxxThrowException PROC
push RDX push RDX
SUB RSP, 24 ; yo wtf, we have [0, -8], [-8, -8], [-16, -8] writes in our stack?! stdcall compiler optimizer conflicting with the reality that stdcall does not exist under x64? SUB RSP, 24 ; yo wtf, we have [0, -8], [-8, -8], [-16, -8] writes in our stack?! stdcall compiler optimizer conflicting with the reality that stdcall does not exist under x64?
MOV RAX, [_CxxThrowExceptionHook] MOV RAX, [_SEHReport]
CALL RAX CALL RAX
add rsp, 24 ADD RSP, 24
pop RDX POP RDX
pop RCX POP RCX
xor rax, rax XOR RAX, RAX
jmp CXX_THROW_REFERENCE JMP gGxxThrowRefDll
ret
_CxxThrowException ENDP _CxxThrowException ENDP
END END

21
demo.cpp
View File

@ -2,7 +2,7 @@
#include <iostream> #include <iostream>
#include <ehdata.h> #include <ehdata.h>
extern "C" size_t CXX_THROW_REFERENCE = 0xDEADBEEF; extern "C" size_t gGxxThrowRefDll = 0xDEADBEEF;
static std::string kStringRawName = typeid(std::string).raw_name(); static std::string kStringRawName = typeid(std::string).raw_name();
@ -24,9 +24,10 @@ static bool IsReadable(const void *address)
} }
#pragma warning(suppress : 4996) #pragma warning(suppress : 4996)
static bool DoMagic(void *exception, const ThrowInfo *throwInfo, void *caller) extern "C" void __stdcall _SEHReport(void *exception, const ThrowInfo *throwInfo, void *caller)
{ {
if (!throwInfo) return false; if (!throwInfo) return;
if (!exception) return;
auto attribs = throwInfo->attributes; auto attribs = throwInfo->attributes;
@ -91,27 +92,15 @@ static bool DoMagic(void *exception, const ThrowInfo *throwInfo, void *caller)
{ {
std::cout << message << std::endl; std::cout << message << std::endl;
} }
return true;
}
extern "C" void __stdcall _CxxThrowExceptionHook(
void *pExceptionObject,
void * pThrowInfo,
void *caller
)
{
DoMagic(pExceptionObject, (ThrowInfo *)pThrowInfo, caller);
} }
int main() int main()
{ {
CXX_THROW_REFERENCE = (size_t)GetProcAddress(LoadLibraryW(L"ucrtbase.dll"), "_CxxThrowException"); gGxxThrowRefDll = (size_t)GetProcAddress(LoadLibraryW(L"ucrtbase.dll"), "_CxxThrowException");
try try
{ {
throw std::exception("hello"); throw std::exception("hello");
std::cout << "cont?!!\n"; std::cout << "cont?!!\n";
} }
catch (...) catch (...)
{ {