calling getEHinfo in x64

January 8

Calling getEHinfo x64: crushes

        [UnmanagedFunctionPointer(CallingConvention.StdCall)]
        public delegate void getEHinfo(IntPtr self, IntPtr ftn, uint EHnumber, out CORINFO_EH_CLAUSE clause);
        
        public static IntPtr getEHinfoaddress;
        
        public static bool ShouldResolve = false;
        public static int targetIndex;
        
        public static IntPtr Compiler;
        public static IntPtr iftn;
        public static int EhCounti;
        
        public static unsafe void ResolveEH(int idx, IntPtr comp, int EHCount, IntPtr ftn)
        {
            //IntPtr selfEH1 =  GetEHInfo(comp, false);
            IntPtr getEHinfoaddress = GetEHInfo(comp, false);
            
            //MessageBox.Show(getEHinfoaddress.ToString("X8"));
            
            string installedFr = GetFramework4Version();
            if (IntPtr.Size==8)
            {
            //getEHinfoaddress = X64CallingConvention(getEHinfoaddress);
            }
            else
            {
            
            if (installedFr.StartsWith("4.5")||installedFr.StartsWith("4.7")||installedFr.StartsWith("4.8"))
                getEHinfoaddress = ConvertCallingConvention(getEHinfoaddress, CallingConvention.ThisCall, CallingConvention.StdCall);
            }
            
            
            //ICorJitInfo* comp_ptr = (ICorJitInfo*)(comp);
            //IntPtr getEHinfoaddress1 = ICorStaticInfo.ICorMethodInfo(ICorDynamicInfo.ICorStaticInfo(ICorJitInfo.ICorDynamicInfo(comp_ptr)))->vfptr->getEHinfo;
            
            //MessageBox.Show(getEHinfoaddress.ToString("X8")+"-"+getEHinfoaddress1.ToString("X8"));
            
            getEHinfo getEHinfo = null;
            getEHinfo = (getEHinfo)Marshal.GetDelegateForFunctionPointer(getEHinfoaddress, typeof(getEHinfo));

            //IntPtr selfEH = (IntPtr)ICorStaticInfo.ICorMethodInfo(ICorDynamicInfo.ICorStaticInfo(ICorJitInfo.ICorDynamicInfo(comp_ptr)));
            IntPtr selfEH = IntPtr.Zero;
            
            if (installedFr.StartsWith("4.7")||installedFr.StartsWith("4.8"))
            selfEH = comp;
            else
            selfEH = GetEHInfo(comp, true);

            //MessageBox.Show("a"+selfEH.ToString("X8")+"-"+ftn.ToString("X8"));
            List<CORINFO_EH_CLAUSE> ehcs = new List<CORINFO_EH_CLAUSE>();
            for (uint i = 0; i < EHCount; i++)
            {
                CORINFO_EH_CLAUSE clause = new CORINFO_EH_CLAUSE();
                getEHinfo(selfEH, ftn, i, out clause);
                ehcs.Add(clause);
            }
            
            MI.moduledata.TryCatch[idx] = GetExceptionBytes(ehcs, true);
            MessageBox.Show("OK");
        }

        
        // https://github.com/dotnet/runtime/issues/4887
        
        public unsafe static IntPtr GetEHInfo(IntPtr pICorJitInfo, bool ReturnEHThis)
        {
            // CLR47:
            // 8BBB 48190000 | mov     edi, [ebx+0x1948]            |
            // 8D5424 3C     | lea     edx, [esp+0x3C]              |
            // 52            | push    edx                          |
            // 51            | push    ecx                          |
            // FFB3 54190000 | push    [ebx+0x1954]                 |
            // 8B07          | mov     eax, [edi]                   |
            // 8B70 20       | mov     esi, [eax+0x20]              |
            // 8BCE          | mov     ecx, esi                     |
            // FF15 8C112D6F | call    [<__guard_check_icall_fptr>] |
            // 8BCF          | mov     ecx, edi                     |
            // FFD6          | call    esi                          |

            // CLR40:
            // 8B86 D81B0000 | mov     eax, [esi+0x1BD8]  | eaxæ˜¯pICorJitInfo
            // 8B48 04       | mov     ecx, [eax+0x4]     |
            // 8B49 04       | mov     ecx, [ecx+0x4]     |
            // 8D55 E4       | lea     edx, [ebp-0x1C]    |
            // 52            | push    edx                |
            // FF75 E0       | push    [ebp-0x20]         |
            // 8D4401 04     | lea     eax, [ecx+eax+0x4] |
            // FFB6 E41B0000 | push    [esi+0x1BE4]       |
            // 8B08          | mov     ecx, [eax]         |
            // 50            | push    eax                |
            // FF51 28       | call    [ecx+0x28]         | [ecx+0x28]æ˜¯getEHinfo vtordispçš„å‡½æ•°æŒ‡é’ˆ

            /*
060C230A    8B4C24 24       MOV ECX,DWORD PTR SS:[ESP+0x24]
060C230E    8B5424 28       MOV EDX,DWORD PTR SS:[ESP+0x28]
060C2312    8BC1            MOV EAX,ECX
060C2314    8B48 04         MOV ECX,DWORD PTR DS:[EAX+0x4]
060C2317    8B49 04         MOV ECX,DWORD PTR DS:[ECX+0x4]
060C231A    8D4408 04       LEA EAX,DWORD PTR DS:[EAX+ECX+0x4]
060C231E    8B08            MOV ECX,DWORD PTR DS:[EAX]
060C2320    8B51 28         MOV EDX,DWORD PTR DS:[ECX+0x28]          ; clr.79212570

B9 30 A8 18 00 8B C1 8B 48 04 8B 49 04 8D 44 08 04 8B 08 8B 51 28

             */
            
            // ECX= 791AFF10
            // DS:[791AFF38]=79212570 (clr.79212570)
            IntPtr pGetEHInfo = IntPtr.Zero;
            if (Environment.Version.Major<4)
            {
                MessageBox.Show("Not supported yet!");
            }
            else
            {
            string installedFr = GetFramework4Version();
            if (installedFr.StartsWith("4.5")||installedFr.StartsWith("4.7")||installedFr.StartsWith("4.8"))
            {
                uint edi1;
                uint eax1;

                if (IntPtr.Size==4)
                {
                edi1 = (uint)pICorJitInfo.ToInt32();
                eax1 = *(uint*)edi1;
                
                if (ReturnEHThis)
                {
                    return (IntPtr)eax1;  // clr!CEEJitInfo::`vftable'
                }
                pGetEHInfo = (IntPtr)(*(uint**)(eax1 + 0x20));  // clr!CEEJitInfo::GetEHInfo
                return pGetEHInfo;
                }
                else
                {
                ulong ledi1 = (ulong)pICorJitInfo.ToInt64();
                //MessageBox.Show("cool"+ledi1.ToString("X8"));
                ulong leax1 = *(ulong*)ledi1;

                    
                if (ReturnEHThis)
                {
                IntPtr retvalue = (IntPtr)(*(ulong*)(ledi1));  // clr!CEEJitInfo::`vftable'
                //MessageBox.Show("Offset"+retvalue.ToString("X8"));
                return retvalue;
                }
                pGetEHInfo = (IntPtr)(*(ulong**)(leax1 + (ulong)(0x20/4*IntPtr.Size)));  // clr!CEEJitInfo::GetEHInfo
                //MessageBox.Show("cool"+pGetEHInfo.ToString("X8"));
                return pGetEHInfo;
                //



                

                //MessageBox.Show("cool"+eax1.ToString("X8"));

                }
                
            }
            
            uint eax;
            uint ecx;

            eax = (uint)pICorJitInfo;
            //MessageBox.Show("cool-"+eax.ToString("X8"));
            ecx = *(uint*)(eax + 0x4);  // Stack DS:[0018A834]=791AF450 (clr.791AF450)
            ecx = *(uint*)(ecx + 0x4);  // DS:[791AF454]=00000030
            eax = ecx + eax + 0x4;  // 030+pICorJitInfo+04
            if (ReturnEHThis)
            {
                return (IntPtr)(eax);
            }
            
            ecx = *(uint*)eax;  // Stack DS:[0018A864]=791AFF10 (clr.791AFF10)

            //MessageBox.Show(((uint)pICorJitInfo).ToString("X8")+"-"+ecx.ToString("X8"));
                            
                if (installedFr.StartsWith("4.0"))
                {
                pGetEHInfo = (IntPtr)(*(void**)(ecx + 0x28));  // DS:[791AFF38]=79212570 (clr.79212570)
                return pGetEHInfo;
                }
                
                /*if (installedFr.StartsWith("4.8"))
                {
                pGetEHInfo = (IntPtr)(*(void**)(ecx + 0x20));
                return pGetEHInfo;
                }
                */

            }


            
            //uint valuem = *(uint*)(ecx + 0x28);
            

            //if
            
            //pGetEHInfo = *(void**)(ecx + 0x20);
            //pGetEHInfo = (void*)0;
            

            return pGetEHInfo;
        }

https://jsac.jpcert.or.jp/archive/2023/pdf/JSAC2023_1_4_chang_en.pdf
https://github.com/LJP-TW/JITHook/blob/main/JITUnpacker/main.cpp

https://www.cnblogs.com/wwh1004/p/17620592.html
So I know what getEHinfo address is:
getEHinfo = (getEHinfoFunc*)ICorJitInfo[8];
if you take in consideration that each element is a qword;
SelfEH also has valid value;
but it crushes
from what I could tell it tries to read something from Methodhandle - ftn and will result in any memory access violation.
Does anyone know how to solve the problem or does anyone know any x64 jitter?

January 9

clr!CEEJitInfo::getEHinfo:
00007ffd`ba03b150 4053            push    rbx
00007ffd`ba03b152 56              push    rsi
00007ffd`ba03b153 57              push    rdi
00007ffd`ba03b154 4156            push    r14
00007ffd`ba03b156 4157            push    r15
00007ffd`ba03b158 4881ec80000000 sub     rsp,80h
00007ffd`ba03b15f 48c7442448feffffff mov   qword ptr [rsp+48h],0FFFFFFFFFFFFFFFEh
00007ffd`ba03b168 488b0591be9400 mov     rax,qword ptr [clr!_security_cookie (00007ffd`ba987000)]
00007ffd`ba03b16f 4833c4          xor     rax,rsp
00007ffd`ba03b172 4889442478      mov     qword ptr [rsp+78h],rax
00007ffd`ba03b177 498bf1          mov     rsi,r9
00007ffd`ba03b17a 458bf0          mov     r14d,r8d
00007ffd`ba03b17d 488bfa          mov     rdi,rdx
00007ffd`ba03b180 4c8bf9          mov     r15,rcx
00007ffd`ba03b183 488b5928        mov     rbx,qword ptr [rcx+28h]
00007ffd`ba03b187 488b4310        mov     rax,qword ptr [rbx+10h]
00007ffd`ba03b18b 4889442430      mov     qword ptr [rsp+30h],rax
00007ffd`ba03b190 803da9be940000 cmp     byte ptr [clr!g_StackProbingEnabled (00007ffd`ba987040)],0
00007ffd`ba03b197 0f8543983300    jne     clr!CEEJitInfo::getEHinfo+0x339890 (00007ffd`ba3749e0)
00007ffd`ba03b19d 488b4310        mov     rax,qword ptr [rbx+10h]
00007ffd`ba03b1a1 4889442428      mov     qword ptr [rsp+28h],rax
00007ffd`ba03b1a6 833df3db940000 cmp     dword ptr [clr!g_fJitPerfOn (00007ffd`ba988da0)],0
00007ffd`ba03b1ad 0f8552983300    jne     clr!CEEJitInfo::getEHinfo+0x3398b5 (00007ffd`ba374a05)
00007ffd`ba03b1b3 8a4706          mov     al,byte ptr [rdi+6]
00007ffd`ba03b1b6 2407            and     al,7
00007ffd`ba03b1b8 3c07            cmp     al,7
00007ffd`ba03b1ba 0f843f491100    je      clr!CEEJitInfo::getEHinfo+0x131 (00007ffd`ba14faff)
00007ffd`ba03b1c0 498b4758        mov     rax,qword ptr [r15+58h]
00007ffd`ba03b1c4 488b5028        mov     rdx,qword ptr [rax+28h]
00007ffd`ba03b1c8 4b8d0c76        lea     rcx,[r14+r14*2]
00007ffd`ba03b1cc f60240          test    byte ptr [rdx],40h ds:00000000`00000000=??

rdx register is 0 so it crushes
does anyone knows what 40h stands for or what the above code tries to do?

January 9

I've made real progress:

            ulong ledi1 = (ulong)selfEH.ToInt64();
            //
            ulong leax1 = *(ulong*)(ledi1+0x58);

            ulong valueZero = *(ulong*)(leax1+0x28);

            ulong Pointer = leax1+0x28;

            MessageBox.Show(valueZero.ToString("X8"));
When valueZero is zero method has no exception handers;
So I've found add that EHCount from info->EHcount from CORINFO_METHOD_INFO_Fr4_x64 has invalid value;
mainly the function was called for methods with no Exception Handlers.

Edited January 9 by CodeExplorer

Sign In

calling getEHinfo in x64

Recommended Posts

CodeExplorer

CodeExplorer

CodeExplorer

Create an account or sign in to comment

Create an account

Sign in

Community

Search Engines

Code Search

File Search

Search Engines