Weird behaviour of C++ destructors

前端 未结 8 1325
无人及你
无人及你 2020-12-17 03:29
#include 
#include 
using namespace std;

int main()
{
    vector< vector > dp(50000, vector(4, -1));
    c         


        
8条回答
  •  无人及你
    2020-12-17 04:08

    http://www.symantec.com/connect/articles/windows-anti-debug-reference

    read sections 2 "PEB!NtGlobalFlags" and 2 "Heap flags"

    think this may explain it ...


    EDIT: added solution

    in your handler for CREATE_PROCESS_DEBUG_EVENT, add the following

    // hack 'Load Configuration Directory' in exe header to point to a new block that specfies GlobalFlags 
    IMAGE_DOS_HEADER dos_header;
    ReadProcessMemory(cpdi.hProcess,cpdi.lpBaseOfImage,&dos_header,sizeof(IMAGE_DOS_HEADER),NULL);
    IMAGE_OPTIONAL_HEADER32 pe_header;
    ReadProcessMemory(cpdi.hProcess,(BYTE*)cpdi.lpBaseOfImage+dos_header.e_lfanew+4+sizeof(IMAGE_FILE_HEADER),&pe_header,offsetof(IMAGE_OPTIONAL_HEADER32,DataDirectory),NULL);
    IMAGE_LOAD_CONFIG_DIRECTORY32 ilcd;
    ZeroMemory(&ilcd,sizeof(ilcd));
    ilcd.Size = 64; // not sizeof(ilcd), as 2000/XP didn't have SEHandler
    ilcd.GlobalFlagsClear = 0xffffffff; // clear all flags.  this is as we don't want dbg heap
    BYTE *p = (BYTE *)VirtualAllocEx(cpdi.hProcess,NULL,ilcd.Size,MEM_COMMIT|MEM_RESERVE,PAGE_READWRITE);
    WriteProcessMemory(cpdi.hProcess,p,&ilcd,ilcd.Size,NULL);
    BYTE *dde = (BYTE*)cpdi.lpBaseOfImage+dos_header.e_lfanew+4+sizeof(IMAGE_FILE_HEADER)+offsetof(IMAGE_OPTIONAL_HEADER32,DataDirectory)+sizeof(IMAGE_DATA_DIRECTORY)*IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG;
    IMAGE_DATA_DIRECTORY temp;
    temp.VirtualAddress = p-cpdi.lpBaseOfImage;
    temp.Size = ilcd.Size;
    DWORD oldprotect;
    VirtualProtectEx(cpdi.hProcess,dde,sizeof(temp),PAGE_READWRITE,&oldprotect);
    WriteProcessMemory(cpdi.hProcess,dde,&temp,sizeof(temp),NULL);
    VirtualProtectEx(cpdi.hProcess,dde,sizeof(temp),oldprotect,&oldprotect);
    

提交回复
热议问题