Re: debugging longman dictionary

[Laurent Pinchart]

On Monday 18 March 2002 22:58, Eric Pouech wrote:
> > - it also tries to read/write to the debug registers. this produces an
> > unhandled exception. should be trivial to write an exception handler to
> > support that (right ?)
>
> how does it do the writing exactly ? (I'd suspect more the program wants
> to catch itself a watchpoint)

Here's the C code I wrote from the disassembler output. It might not be 
correct, and might not even compile, but the idea is there.

BOOL ReadWriteDR2 (DWORD command, DWORD * value)
{
        struct {
                WORD limit;
                DWORD * base;
        } idtr;

        void *int0Handler;
        DWORD int0handlerHigh;
        DWORD int0handlerLow;

        DWORD valDR2;
        BOOL  writeDR2;
 
        if ( value == 0 )
                return FALSE;
 
        if ( command == 0x1010 )
        {
                writeDR2 = FALSE;
        }
        else if ( command == 0x1011 )
        {
                writeDR2 = TRUE;
                valDR2 = *value;
        }
        else
                return FALSE;
 
        idtr = reg.IDTR;
        int0Handler = idtr.base[4] & 0xffff0000;
        int0Handler |= idtr.base[0];
 
        int0handlerLow = ((DWORD*)int0Handler)[0];
        int0handlerHigh = ((DWORD*)int0Handler)[1];
 
        /* Install the division by 0 handler:
           pop %eax
           pop %eax
           push %cs
           push %ebx
           iret
         */
        ((DWORD*)int0Handler)[0] = 0x530e5858;
        ((DWORD*)int0Handler)[1] = 0x000000cf;

        asm ( " movl %%ebx, (%0) " : "=m"(return_label1) );
        asm ( " xorl %%eax, %%eax; div %%eax, %%eax " );
 
return_label1:
        if ( writeDR2 )
        {
                reg.DR2 = valDR2;
        }
        else
        {
                valDR2 = reg.dr2;
        }
 
        idtr = reg.IDTR;
        int0Handler = idtr.base[4] & 0xffff0000;
        int0Handler |= idtr.base[0];

        /* Install the division by 0 handler:
           pop %eax
           pop %eax
           push %cs
           push %ebx
           iret
         */
        ((DWORD*)int0Handler)[0] = 0x53515858;
        ((DWORD*)int0Handler)[1] = 0x000000cf;

        asm ( " xorl %%ecx, %%ecx; movw %%ecx, %%cs " );
        asm ( " movl %%ebx, (%0) " : "=m"(return_label2) );
        asm ( " xorl %%eax, %%eax; div %%eax, %%eax " );

return_label2:
        ((DWORD*)int0Handler)[0] = int0handlerLow;
        ((DWORD*)int0Handler)[1] = int0handlerHigh;

        if ( ! writeDR2 )
                *value = valDR2;
 
        return TRUE;
}

The only call to the ReadWriteDR2 function I found in the disassembler output 
is a read call, and the DR2 value is compared with 0xffb31146. Hope this 
helps.

> > bool detect_debugger_from_TIB
> > {
> >         char *pTIB;
> >         asm ( "mov %%fs:0x18, %", "=g"(pTIB) );
> >         if ( pTIB[0x20] == 0 )
> >                 return FALSE;
> >         else
> >                 return TRUE;
> > }
>
> fs:0x18 points in memory to the TEB structure
> and offset 0x20 (from thread.h) says:
>       20 Process id (win95: debug context)
> so I assume you run it on Win9x, and got it tested this way
> (I wouldn't be surprised that under nt it did test dword 0x64 and/or
> 0x68)

You're right, that function is for Win9x. I haven't disassembled the NT 
function but I can do if needed.

Where can I find some doc about how the fs and gs registers are used ?

Laurent Pinchart