The subject of this post will be about the different paths we can opt to find the EP in a .Net process. As I’m very lazy, instead of creating my own demo program, I'll be working with a sample program called 02simple.exe that came with Advanced .Net debugging book, and available with source from its online site http://advanceddotnetdebugging.com/. In hope that Mario Hewardt forgives my "unauthorized" use of his software, let me give him my endorsement, by saying that the book is great. Be it for those who debug or reverse engineer .Net applications, be it for those who program in .Net and are trying to delve into the under layers of the CLR engine.
So, Let's first find out what we're trying to hit. Using Ildasm,
available on the .NET SDK:
Dumping the metainfo in ildasm:
===========================================================
===========================================================
ScopeName : 02Simple.exe
MVID : {39294D5C-77D0-4D3C-8BBC-18B40FFDE70A}
===========================================================
Global functions
-------------------------------------------------------
Global fields
------------------------------------------------------
Global MemberRefs
-------------------------------------------------------
TypeDef #1 (02000002)
-------------------------------------------------------
TypDefName: Advanced.NET.Debugging.Chapter2.Simple (02000002)
Flags : [NotPublic]
[AutoLayout] [Class] [AnsiClass] [BeforeFieldInit] (00100000)
Extends : 01000001
[TypeRef] System.Object
Method #1 (06000001) [ENTRYPOINT]
-------------------------------------------------------
MethodName: Main (06000001)
Flags : [Private] [Static]
[HideBySig] [ReuseSlot] (00000091)
RVA :
0x00002050
ImplFlags : [IL] [Managed] (00000000)
CallCnvntn: [DEFAULT]
ReturnType: Void
1 Arguments
Argument #1:
SZArray String
1 Parameters
(1) ParamToken : (08000001) Name : args flags:
[none] (00000000)
Method #2 (06000002)
-------------------------------------------------------
MethodName: .ctor (06000002)
Flags :
[Public] [HideBySig] [ReuseSlot] [SpecialName] [RTSpecialName] [.ctor] (00001886)
RVA : 0x0000205e
ImplFlags : [IL]
[Managed] (00000000)
CallCnvntn: [DEFAULT]
hasThis
ReturnType: Void
No arguments.
...
...
The entry
point method is called Main as it is marked with a couple of special flags:
STATIC and ENTRYPOINT. This is all information that we need to confirm our
future findings, so let's start with windbg.
Open
executable in windbg, first break is fired at:
ntdll!DbgBreakPoint:
ntdll!DbgBreakPoint:
7c90120e cc int 3
7c90120f c3 ret
There is nothing here yet:
0:000> ~
. 0 Id:
e28.91c Suspend: 1 Teb: 7ffdd000 Unfrozen
If we step through, we can see that we stopped during the loading phase:
If we step through, we can see that we stopped during the loading phase:
eip=7c90120f
esp=0012fb20 ebp=0012fc94 iopl=0
nv up ei pl nz na po nc
cs=001b ss=0023
ds=0023 es=0023 fs=003b
gs=0000 efl=00000202
ntdll!DbgBreakPoint+0x1:
7c90120f c3 ret
0:000> t
7c90120f c3 ret
0:000> t
eax=00241eb4
ebx=7ffde000 ecx=00000000 edx=00000001 esi=00241f48 edi=00241eb4
eip=7c940442
esp=0012fb24 ebp=0012fc94 iopl=0
nv up ei pl nz na po nc
cs=001b ss=0023
ds=0023 es=0023 fs=003b
gs=0000 efl=00000202
ntdll!LdrpInitializeProcess+0xffa:
7c940442 8b4368 mov eax,dword ptr [ebx+68h] ds:0023:7ffde068=00000470
If we try to load sos:
.loadby sos mscorwks
Unable to find module 'mscorwks'
7c940442 8b4368 mov eax,dword ptr [ebx+68h] ds:0023:7ffde068=00000470
If we try to load sos:
.loadby sos mscorwks
Unable to find module 'mscorwks'
We're presented with an error message.
Let's try to load psscor2:
.load psscor2
It seems that it was successful, lets run some commands:
!help
.load psscor2
It seems that it was successful, lets run some commands:
!help
-------------------------------------------------------------------------------
PSSCOR
is a debugger extension DLL designed to aid in the debugging of managed
programs.
Functions are listed by category, then roughly in order of
importance.
Shortcut names for popular functions are listed i...
...
Ok, some more:
!dumpdomain
Ok, some more:
!dumpdomain
Failed
to find runtime DLL (mscorwks.dll), 0x80004005
Extension
commands need mscorwks.dll in order to have something to do.
Yes, psscor2.dll is much friendlier than sos.dll, maybe because
it is used by Microsoft employees. Both errors relate to the same situation,
mscorwks.dll isn't yet loaded, so we need to wait until this module is loaded
before trying to use any of the debugger metadata interpreter extensions
commands.
So, first approach is to:
0:000>
sxe ld mscorwks.dll
0:000>
g
ModLoad:
79e70000 7a400000
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll
eax=00000000 ebx=00000000 ecx=008f0000
edx=7c90e514 esi=00000000 edi=00000000
eip=7c90e514 esp=0012f1bc ebp=0012f2b0
iopl=0 nv up ei ng nz ac pe nc
cs=001b ss=0023
ds=0023 es=0023 fs=003b
gs=0000 efl=00000296
ntdll!KiFastSystemCallRet:
7c90e514
c3 ret
0:000>
k
ChildEBP
RetAddr
0012f1b8
7c90d52a ntdll!KiFastSystemCallRet
0012f1bc
7c91bd23 ntdll!NtMapViewOfSection+0xc
0012f2b0
7c91626a ntdll!LdrpMapDll+0x330
0012f570
7c9164d3 ntdll!LdrpLoadDll+0x1e9
0012f818
7c801bbd ntdll!LdrLoadDll+0x230
0012f880
7900921b KERNEL32!LoadLibraryExW+0x18e
0012f8a4
7900923e mscoree!WszLoadLibraryEx+0x75
0012f8bc
79007b5a mscoree!LoadLibraryWrapperForEE+0x10
0012ffa4
79007c02 mscoree!GetInstallation+0x1cc
0012ffc0
7c817077 mscoree!_CorExeMain+0x12
0012fff0
00000000 KERNEL32!BaseProcessStart+0x23
Lets try it again:
0:000> .loadby sos mscorwks
0:000> !dumpdomain
Lets try it again:
0:000> .loadby sos mscorwks
No error, so the load was successful. Let's
try running some commands:
0:000> !dumpdomain
--------------------------------------
System
Domain: 00000000
Unable
to get system domain info
0:000>
!name2ee 02simple Advanced.NET.Debugging.Chapter2.Simple.Main
0:000> !load sosex
Yey!! It worked. But we've got only the system domain, and even the
system domain doesn't seem to be fully setup. Let's try to resolve the main
entry to a valid IP address:
Nothing happened. Damn. We can't breakpoint anything yet,
because nothing has been setup yet. So let's resort to sosex.dll by Steve
Johnson:
0:000> !load sosex
0:000>
!mbm Advanced.NET.Debugging.Chapter2.Simple.Main
The
breakpoint could not be resolved immediately.
Further
attempts will be made as modules are loaded.
0:000>
g
(a64.2c8):
CLR notification exception - code e0444143 (first chance)
(a64.2c8):
CLR notification exception - code e0444143 (first chance)
Breakpoint:
Matching method Advanced.NET.Debugging.Chapter2.Simple.Main resolved, but not
yet jitted. Setting JIT notification...
(a64.2c8):
CLR notification exception - code e0444143 (first chance)
Breakpoint:
JIT notification received for method Advanced.NET.Debugging.Chapter2.Simple.Main(System.String[]).
Breakpoint
set at Advanced.NET.Debugging.Chapter2.Simple.Main(System.String[]).
Breakpoint
0 hit
eax=00922ff0
ebx=0012f4ac ecx=01292e14 edx=00000000 esi=00181718 edi=00000000
eip=00c70085
esp=0012f47c ebp=0012f480 iopl=0
nv up ei pl zr na pe nc
cs=001b ss=0023
ds=0023 es=0023 fs=003b
gs=0000 efl=00000246
00c70085
90 nop
We broke at 00c70085. Let's see what we've got there:
0:000> !u @eip
We broke at 00c70085. Let's see what we've got there:
0:000> !u @eip
Normal
JIT generated code
Advanced.NET.Debugging.Chapter2.Simple.Main(System.String[])
Begin
00c70070, size 27
00c70070
55 push ebp
00c70071
8bec mov ebp,esp
00c70073
50 push eax
00c70074
894dfc mov dword ptr [ebp-4],ecx
00c70077 833d142e920000 cmp
dword ptr ds:[922E14h],0
00c7007e 7405 je 00c70085
00c70080 e83ca64579 call
mscorwks!JIT_DbgIsJustMyCode (7a0ca6c1)
>>>
00c70085 90 nop
00c70086
8b0d30202902 mov ecx,dword ptr ds:[2292030h] ("Welcome
to Advanced .NET Debugging!")
00c7008c
e88738b278 call mscorlib_ni+0x6d3918 (79793918)
(System.Console.WriteLine(System.String), mdToken: 060007c8)
00c70091
90 nop
00c70092
90 nop
00c70093
8be5 mov
esp,ebp
00c70095
5d pop ebp
00c70096
c3 ret
We're in!! But the code is already Jitted, and we still needed
to know the function name we're looking for, in order to set a breakpoint on
it. Although we were able to find the EP in memory, why should we need to
resort to ildasm?
Let's try it another way. From the beginning again:
0:000>
bu mscorwks!ClassLoader::RunMain
0:000>
g
***
WARNING: Unable to verify checksum for
C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\7124a40b9998f7b63c86bd1a2125ce26\mscorlib.ni.dll
Breakpoint
1 hit
eax=0012f81c
ebx=00000000 ecx=79f54ea1 edx=80000001 esi=00922ff0 edi=00000000
eip=79f4088d esp=0012f7e4 ebp=0012fa48
iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023
ds=0023 es=0023 fs=003b
gs=0000 efl=00000206
mscorwks!ClassLoader::RunMain:
79f4088d
6838010000 push 138h
0:000>
.load psscor2
0:000>
!dumpdomain
--------------------------------------
System
Domain: 7a3bd058
LowFrequencyHeap:
7a3bd07c
HighFrequencyHeap:
7a3bd0c8
StubHeap:
7a3bd114
Stage:
OPEN
Name:
System Domain
--------------------------------------
Shared
Domain: 7a3bc9a8
LowFrequencyHeap:
7a3bc9cc
HighFrequencyHeap:
7a3bca18
StubHeap:
7a3bca64
Stage:
OPEN
Name:
Shared Domain
Assembly:
0018f638
--------------------------------------
Domain
1: 0014c488
LowFrequencyHeap:
0014c4ac
HighFrequencyHeap:
0014c4f8
StubHeap:
0014c544
Stage:
OPEN
SecurityDescriptor:
0014d7b0
Name:
02Simple.exe
Assembly:
0018f638 [C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll]
ClassLoader:
0018f6b8
SecurityDescriptor:
0018d310
Module Name
790c1000
C:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
Assembly:
00193508 [D:\development\programming\debuggingdotnet\02Simple.exe]
ClassLoader:
00197f30
SecurityDescriptor:
001933d0
Module Name
00922c5c
D:\development\programming\debuggingdotnet\02Simple.exe
!dumpmd @esi
As seen, the domains have been setup, and ClassLoader::RunMain
is about to run the method we want having ESI pointing to it. esi=00922ff0.
Let's confirm this:
!dumpmd @esi
Method
Name: Advanced.NET.Debugging.Chapter2.Simple.Main(System.String[])
Class:
0092125c
MethodTable:
00923004
mdToken:
06000001
Module:
00922c5c
IsJitted:
no
m_CodeOrIL:
ffffffff
0:000> !name2ee 02simple.exe Advanced.NET.Debugging.Chapter2.Simple.Main
Yes. We reached EP, fast and simple without having to reverse or
decode anything. Just using windbg. Let's what more we can get from here:
0:000> !name2ee 02simple.exe Advanced.NET.Debugging.Chapter2.Simple.Main
Module:
00922c5c (02Simple.exe)
Token:
0x06000001
MethodDesc:
00922ff0
Name:
Advanced.NET.Debugging.Chapter2.Simple.Main(System.String[])
Not
JITTED yet. Use !bpmd -md 00922ff0 to break on run.
Everything checks. Notice something cool: the code is not jitted
yet. So we can check it against the ildasm output:
0:000> !DumpIL @esi
ilAddr = 00402050
IL_0000:
nop
IL_0001:
ldstr "Welcome to Advanced .NET Debugging!"
IL_0006:
call System.Console::WriteLine
IL_000b:
nop
IL_000c:
ret
How cool is this? Can we change the IL on runtime? Perhaps with some sort of hooking?
How cool is this? Can we change the IL on runtime? Perhaps with some sort of hooking?
Now, let the
crl jit the code and watch the result:
!bpmd -md 00922ff0
!bpmd -md 00922ff0
MethodDesc
= 00922ff0
Adding
pending breakpoints...
0:000>
g
(c34.7cc):
CLR notification exception - code e0444143 (first chance)
JITTED
02Simple!Advanced.NET.Debugging.Chapter2.Simple.Main(System.String[])
Setting
breakpoint: bp 00C70070
[Advanced.NET.Debugging.Chapter2.Simple.Main(System.String[])]
Breakpoint
2 hit
eax=00922ff0
ebx=0012f4ac ecx=01292e14 edx=00000000 esi=00181718 edi=00000000
eip=00c70070
esp=0012f484 ebp=0012f490 iopl=0
nv up ei pl nz ac po nc
cs=001b ss=0023
ds=0023 es=0023 fs=003b
gs=0000 efl=00000212
00c70070
55 push ebp
We're back to the same point before:
!u @eip
We're back to the same point before:
!u @eip
Normal
JIT generated code
Advanced.NET.Debugging.Chapter2.Simple.Main(System.String[])
Begin
00c70070, size 27
>>>
00c70070 55 push ebp
00c70071
8bec mov ebp,esp
00c70073
50 push eax
00c70074
894dfc mov dword ptr [ebp-4],ecx
00c70077 833d142e920000 cmp
dword ptr ds:[922E14h],0
00c7007e 7405 je 00c70085
00c70080 e83ca64579 call
mscorwks!JIT_DbgIsJustMyCode (7a0ca6c1)
00c70085
90 nop
00c70086
8b0d30202902 mov ecx,dword ptr ds:[2292030h]
00c7008c
e88738b278 call mscorlib_ni+0x6d3918 (79793918)
(System.Console.WriteLine(System.String), mdToken: 060007c8)
00c70091
90 nop
00c70092
90 nop
00c70093
8be5 mov esp,ebp
00c70095
5d pop ebp
00c70096
c3 ret
Hope you enjoyed it.
Hope you enjoyed it.
