[General] CLR hosting without the dll?

[_Mike]

Did you ever get your cross-architecture injection code working without requiring patching of the system DLLs in memory?

Only for small code pieces, and dlls which only called ntdll APIs.
Patching ntdll is required to load kernel32, the loader does a string match on the file name.
But I gave up when I couldn't get SEH working. To many things in the crt depend on it.
And 32bit and 64bit share VEHs, unless I did something wrong when trying to use them.

[Cypher]

Only for small code pieces, and dlls which only called ntdll APIs.
Patching ntdll is required to load kernel32, the loader does a string match on the file name.
But I gave up when I couldn't get SEH working. To many things in the crt depend on it.
And 32bit and 64bit share VEHs, unless I did something wrong when trying to use them.

They share VEHs? Now THAT is interesting...

[_Mike]

They share VEHs? Now THAT is interesting...

I have to do some more tests so I can't say for sure yet, but I think it should be possible to install a 64bit VEH at an address above 2^32 and it would be completely untouchable by warden. Then get a popular public hack to use the method and warden guy would be forced to go 64bit as well which would be interesting to see

[amadmonk]

FYI, I run managed code from a VEH callback every frame. I'd be curious to see what the restriction is; I'm sure that it's non-standard behavior, but *shrug* it seems to work for me.

LONG WINAPI ExceptionHandler(PEXCEPTION_POINTERS ExInfo)
{	
	if (ExInfo && ExInfo->ExceptionRecord && ExInfo->ContextRecord)
	{			
		if (((ExInfo->ContextRecord->Dr6 & 1) == 1) || ((ExInfo->ContextRecord->Dr6 & 2) == 2) || ((ExInfo->ContextRecord->Dr6 & 4) == 4) || ((ExInfo->ContextRecord->Dr6 & 8) == 8))
		{			
			ExInfo->ContextRecord->Dr6 &= ~0xF; // have to disable the bits manually
			if (ExInfo->ExceptionRecord->ExceptionCode == STATUS_SINGLE_STEP && ExInfo->ExceptionRecord->ExceptionAddress == GetRebasedAddress<PVOID>(CGGameUI__OnTerrainClick))
			{				
				ExInfo->ContextRecord->EFlags |= 0x10000; // set the resume flag so we don't loop forever
				ExInfo->ContextRecord->EFlags &= ~0x100; // turn off single-step flag (just in case!)

				float *pClickStruct = *(float **)(ExInfo->ContextRecord->Esp + 4);

				msclr::call_in_appdomain(dwDefaultAppDomainId, &UnmanagedNotifyManagedCodeOfClick, pClickStruct[2], pClickStruct[3], pClickStruct[4]);

PS: yes, I know, fugly code. I don't care ... it works, and I never have to touch it, so it never gets refactored.

[caytchen]

Huh? Thats very cool. I tried to get managed VEH a dozen ways but reentrancy MDA always got me.