Skip to content

Add some checks that should fix some issues with certain packers #144

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from Jan 18, 2020
Merged

Add some checks that should fix some issues with certain packers #144

merged 1 commit into from Jan 18, 2020

Conversation

ghost
Copy link

@ghost ghost commented Jan 18, 2020

I was running into some issues using ReClass.NET with on a program protected by Themida, so I fixed them.

  • At some point, Themida intentionally fills the first 24 bytes of the .idata header with garbage (Name, VirtualSize, VirtualAddress, SizeOfRawData all get clobbered), so I added a check to make sure VA+VirtualSize doesn't exceed the size of the current module.
  • I made it so the category is detected by using the descriptive flags set in the Characteristics field, instead of the section name. This should be more accurate.
  • Additionally, I wrapped the char-to-char16_t conversion in a try-catch block, so even if it fails from malformed character data, it won't just crash.

- Add sanity check for section size
- Catch bad conversion exception of section name
- Detect section category by characteristics flags rather than name
@KN4CK3R
Copy link
Member

KN4CK3R commented Jan 18, 2020

Thank you for the PR. Do you have a sample input which crashes the name transformation?

@ghost
Copy link
Author

ghost commented Jan 18, 2020

It was happening with the game Blade & Soul (which is like 30+GB). I can provide a stack trace of the exception though, if that helps.

It's kind of weird, I checked and Themida clobbers the section header immediately but ReClass.NET doesn't seem to crash when attaching until the main game window opens, but it is definitely crashing from a texting encoding error.

Stack trace:

 	KernelBase.dll!00007ff9245f8403()	Unknown
 	ntdll.dll!00007ff92857477f()	Unknown
 	ntdll.dll!00007ff9284d4bef()	Unknown
 	ntdll.dll!00007ff9285734ee()	Unknown
 	KernelBase.dll!00007ff9245f9159()	Unknown
 	vcruntime140d.dll!00007ff8fbe482b0()	Unknown
 	NativeCore.dll!std::_Throw_range_error(const char * const _Message=0x00007ff8e2c7dad0) Line 194	C++
 	NativeCore.dll!std::wstring_convert<std::codecvt_utf8_utf16<short,1114111,0>,short,std::allocator<short>,std::allocator<char>>::from_bytes(const char * _First=0x0000001684dfe75a, const char * _Last=0x0000001684dfe760) Line 406	C++
 	NativeCore.dll!std::wstring_convert<std::codecvt_utf8_utf16<short,1114111,0>,short,std::allocator<short>,std::allocator<char>>::from_bytes(const char * _Ptr=0x0000001684dfe758) Line 352	C++
>	NativeCore.dll!MultiByteToUnicode(const char * src=0x0000001684dfe758, const int srcOffset=0x00000000, char16_t * dst=0x0000011f02e88d2c, const int dstOffset=0x00000000, const int size=0x00000008) Line 282	C++
 	NativeCore.dll!MultiByteToUnicode(const char * src=0x0000001684dfe758, char16_t * dst=0x0000011f02e88d2c, const int size=0x00000008) Line 290	C++
 	NativeCore.dll!EnumerateRemoteSectionsAndModules(void * process=0x00000000000005cc, void(*)(EnumerateRemoteSectionData *) callbackSection=0x0000011f7f4b4d3c, void(*)(EnumerateRemoteModuleData *) callbackModule=0x0000011f7f4b52dc) Line 115	C++
 	[External Code]	
 	ReClass.NET.exe!ReClassNET.Core.NativeCoreWrapper.EnumerateRemoteSectionsAndModules(System.IntPtr process = 0x00000000000005cc, ReClassNET.Core.EnumerateRemoteSectionCallback callbackSection = {Method = {System.Reflection.RuntimeMethodInfo}}, ReClassNET.Core.EnumerateRemoteModuleCallback callbackModule = {Method = {System.Reflection.RuntimeMethodInfo}}) Line 100	C#
 	ReClass.NET.exe!ReClassNET.Core.CoreFunctionsManager.EnumerateRemoteSectionsAndModules(System.IntPtr process = 0x00000000000005cc, System.Action<ReClassNET.Memory.Section> callbackSection = {Method = {System.Reflection.RuntimeMethodInfo}}, System.Action<ReClassNET.Memory.Module> callbackModule = {Method = {System.Reflection.RuntimeMethodInfo}}) Line 115	C#
 	ReClass.NET.exe!ReClassNET.Memory.RemoteProcess.EnumerateRemoteSectionsAndModules(out System.Collections.Generic.List<ReClassNET.Memory.Section> sections = Count = 0x00000000, out System.Collections.Generic.List<ReClassNET.Memory.Module> modules = Count = 0x00000001) Line 584	C#
 	ReClass.NET.exe!ReClassNET.Memory.RemoteProcess.UpdateProcessInformationsAsync.AnonymousMethod__68_0() Line 619	C#

MultiByteToUnicode parameters:

  • const char* src: "\xf6\xad\x02\xc5\xc6\xb5\x01\x6f" (garbage section name from Themida)
  • const int srcOffset: 0
  • RC_UnicodeChar* dst: (empty buffer)
  • const int dstOffset: 0
  • const int size: 8

@KN4CK3R KN4CK3R merged commit bbcbc60 into ReClassNET:master Jan 18, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant