You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
363 lines
8.7 KiB
363 lines
8.7 KiB
//HEADER_GOES_HERE |
|
|
|
#include "../types.h" |
|
|
|
LPTOP_LEVEL_EXCEPTION_FILTER lpTopLevelExceptionFilter; // idb |
|
|
|
struct exception_cpp_init |
|
{ |
|
exception_cpp_init() |
|
{ |
|
exception_install_filter(); |
|
j_exception_init_filter(); |
|
} |
|
} _exception_cpp_init; |
|
|
|
void __cdecl exception_install_filter() |
|
{ |
|
exception_set_filter(); |
|
} |
|
|
|
void __cdecl j_exception_init_filter() |
|
{ |
|
atexit(exception_init_filter); |
|
} |
|
|
|
void __cdecl exception_init_filter() |
|
{ |
|
exception_set_filter_ptr(); |
|
} |
|
|
|
LONG __stdcall TopLevelExceptionFilter(struct _EXCEPTION_POINTERS *ExceptionInfo) |
|
{ |
|
PEXCEPTION_RECORD v1; // esi |
|
char *v2; // eax |
|
PCONTEXT v3; // esi |
|
LONG result; // eax |
|
CHAR v5[260]; // [esp+Ch] [ebp-210h] |
|
char String1[260]; // [esp+110h] [ebp-10Ch] |
|
int a5; // [esp+214h] [ebp-8h] |
|
int a4; // [esp+218h] [ebp-4h] |
|
|
|
log_dump_computer_info(); |
|
v1 = ExceptionInfo->ExceptionRecord; |
|
v2 = exception_get_error_type(ExceptionInfo->ExceptionRecord->ExceptionCode, v5, 0x104u); |
|
log_printf("Exception code: %08X %s\r\n", v1->ExceptionCode, v2); |
|
exception_unknown_module(v1->ExceptionAddress, String1, 260, (int)&a4, (int)&a5); |
|
log_printf("Fault address:\t%08X %02X:%08X %s\r\n", v1->ExceptionAddress, a4, a5, String1); |
|
v3 = ExceptionInfo->ContextRecord; |
|
log_printf("\r\nRegisters:\r\n"); |
|
log_printf( |
|
"EAX:%08X\r\nEBX:%08X\r\nECX:%08X\r\nEDX:%08X\r\nESI:%08X\r\nEDI:%08X\r\n", |
|
v3->Eax, |
|
v3->Ebx, |
|
v3->Ecx, |
|
v3->Edx, |
|
v3->Esi, |
|
v3->Edi); |
|
log_printf("CS:EIP:%04X:%08X\r\n", v3->SegCs, v3->Eip); |
|
log_printf("SS:ESP:%04X:%08X EBP:%08X\r\n", v3->SegSs, v3->Esp, v3->Ebp); |
|
log_printf("DS:%04X ES:%04X FS:%04X GS:%04X\r\n", v3->SegDs, v3->SegEs, v3->SegFs, v3->SegGs); |
|
log_printf("Flags:%08X\r\n", v3->EFlags); |
|
exception_call_stack((void *)v3->Eip, (LPVOID)v3->Ebp); |
|
log_printf("Stack bytes:\r\n"); |
|
exception_hex_format((char *)v3->Esp, 0); |
|
log_printf("Code bytes:\r\n"); |
|
exception_hex_format((char *)v3->Eip, 16); |
|
log_printf("\r\n"); |
|
log_flush(1); |
|
if ( lpTopLevelExceptionFilter ) |
|
result = lpTopLevelExceptionFilter(ExceptionInfo); |
|
else |
|
result = 0; |
|
return result; |
|
} |
|
|
|
void __fastcall exception_hex_format(char *a1, char a2) |
|
{ |
|
unsigned int v2; // ebp |
|
char *v3; // edi |
|
unsigned int v4; // ebx |
|
unsigned int v5; // esi |
|
char *v6; // eax |
|
int v7; // ST04_4 |
|
unsigned int v8; // esi |
|
unsigned char v9; // al |
|
|
|
v2 = a2; |
|
v3 = a1; |
|
if ( a2 ) |
|
{ |
|
do |
|
{ |
|
v4 = 16; |
|
if ( v2 < 0x10 ) |
|
v4 = v2; |
|
if ( IsBadReadPtr(v3, v4) ) |
|
break; |
|
log_printf("0x%08x: "); |
|
v5 = 0; |
|
do |
|
{ |
|
v6 = "%02x "; |
|
if ( v5 >= v4 ) |
|
v6 = " "; |
|
v7 = (unsigned char)v3[v5]; |
|
log_printf(v6); |
|
if ( (v5 & 3) == 3 ) |
|
log_printf(" "); |
|
++v5; |
|
} |
|
while ( v5 < 0x10 ); |
|
v8 = 0; |
|
if ( v4 ) |
|
{ |
|
do |
|
{ |
|
if ( isprint((unsigned char)v3[v8]) ) |
|
v9 = v3[v8]; |
|
else |
|
v9 = 46; |
|
log_printf("%c", v9); |
|
++v8; |
|
} |
|
while ( v8 < v4 ); |
|
} |
|
log_printf("\r\n"); |
|
v3 += v4; |
|
v2 -= v4; |
|
} |
|
while ( v2 ); |
|
} |
|
log_printf("\r\n"); |
|
} |
|
|
|
void __fastcall exception_unknown_module(LPCVOID lpAddress, LPSTR lpString1, int iMaxLength, int a4, int a5) |
|
{ |
|
int v6; // eax |
|
char *v7; // eax |
|
unsigned int v8; // edi |
|
unsigned int v9; // esi |
|
char *v10; // eax |
|
int v11; // edx |
|
unsigned int v12; // ecx |
|
struct _MEMORY_BASIC_INFORMATION Buffer; // [esp+Ch] [ebp-24h] |
|
LPSTR lpFilename; // [esp+28h] [ebp-8h] |
|
HMODULE hModule; // [esp+2Ch] [ebp-4h] |
|
unsigned int iMaxLengtha; // [esp+38h] [ebp+8h] |
|
|
|
lpFilename = lpString1; |
|
lstrcpynA(lpString1, "*unknown*", iMaxLength); |
|
*(_DWORD *)a4 = 0; |
|
*(_DWORD *)a5 = 0; |
|
if ( VirtualQuery(lpAddress, &Buffer, 0x1Cu) ) |
|
{ |
|
hModule = (HMODULE)Buffer.AllocationBase; |
|
if ( !Buffer.AllocationBase ) |
|
hModule = GetModuleHandleA(0); |
|
if ( GetModuleFileNameA(hModule, lpFilename, iMaxLength) ) |
|
{ |
|
if ( hModule ) |
|
{ |
|
if ( *(_WORD *)hModule == 'ZM' ) |
|
{ |
|
v6 = *((_DWORD *)hModule + 15); |
|
if ( v6 ) |
|
{ |
|
v7 = (char *)hModule + v6; |
|
if ( *(_DWORD *)v7 == 'EP' ) |
|
{ |
|
v8 = *((unsigned __int16 *)v7 + 3); |
|
iMaxLengtha = 0; |
|
v9 = (_BYTE *)lpAddress - (_BYTE *)hModule; |
|
if ( *((_WORD *)v7 + 3) ) |
|
{ |
|
v10 = &v7[*((unsigned __int16 *)v7 + 10) + 40]; |
|
while ( 1 ) |
|
{ |
|
v11 = *(_DWORD *)v10; |
|
v12 = *((_DWORD *)v10 - 1); |
|
if ( *(_DWORD *)v10 <= *((_DWORD *)v10 - 2) ) |
|
v11 = *((_DWORD *)v10 - 2); |
|
if ( v9 >= v12 && v9 <= v12 + v11 ) |
|
break; |
|
++iMaxLengtha; |
|
v10 += 40; |
|
if ( iMaxLengtha >= v8 ) |
|
return; |
|
} |
|
*(_DWORD *)a4 = iMaxLengtha + 1; |
|
*(_DWORD *)a5 = v9 - v12; |
|
} |
|
} |
|
} |
|
} |
|
} |
|
} |
|
else |
|
{ |
|
lstrcpynA(lpFilename, "*unknown*", iMaxLength); |
|
} |
|
} |
|
} |
|
|
|
void __fastcall exception_call_stack(void *a1, LPVOID lp) |
|
{ |
|
_DWORD *v2; // ebx |
|
void *v3; // edi |
|
_DWORD *v4; // eax |
|
char String1[260]; // [esp+Ch] [ebp-10Ch] |
|
int a5; // [esp+110h] [ebp-8h] |
|
int a4; // [esp+114h] [ebp-4h] |
|
|
|
v2 = (unsigned int *)lp; |
|
v3 = a1; |
|
log_printf("Call stack:\r\nAddress Frame Logical addr Module\r\n"); |
|
do |
|
{ |
|
exception_unknown_module(v3, String1, 260, (int)&a4, (int)&a5); |
|
log_printf("%08X %08X %04X:%08X %s\r\n", v3, v2, a4, a5, String1); |
|
if ( IsBadWritePtr(v2, 8u) ) |
|
break; |
|
v3 = (void *)v2[1]; |
|
v4 = v2; |
|
v2 = (_DWORD *)*v2; |
|
if ( (unsigned char)v2 & 3 ) |
|
break; |
|
} |
|
while ( v2 > v4 && !IsBadWritePtr(v2, 8u) ); |
|
log_printf("\r\n"); |
|
} |
|
|
|
char *__fastcall exception_get_error_type(DWORD dwMessageId, LPSTR lpString1, DWORD nSize) |
|
{ |
|
CHAR *v3; // esi |
|
const CHAR *v4; // eax |
|
CHAR *v5; // ST10_4 |
|
DWORD v6; // ST08_4 |
|
HMODULE v7; // eax |
|
|
|
v3 = lpString1; |
|
if ( dwMessageId > EXCEPTION_FLT_DENORMAL_OPERAND ) |
|
{ |
|
if ( dwMessageId <= EXCEPTION_STACK_OVERFLOW ) |
|
{ |
|
if ( dwMessageId == EXCEPTION_STACK_OVERFLOW ) |
|
{ |
|
v4 = "STACK_OVERFLOW"; |
|
goto LABEL_42; |
|
} |
|
switch ( dwMessageId ) |
|
{ |
|
case EXCEPTION_FLT_DIVIDE_BY_ZERO: |
|
v4 = "FLT_DIVIDE_BY_ZERO"; |
|
goto LABEL_42; |
|
case EXCEPTION_FLT_INEXACT_RESULT: |
|
v4 = "FLT_INEXACT_RESULT"; |
|
goto LABEL_42; |
|
case EXCEPTION_FLT_INVALID_OPERATION: |
|
v4 = "FLT_INVALID_OPERATION"; |
|
goto LABEL_42; |
|
case EXCEPTION_FLT_OVERFLOW: |
|
v4 = "FLT_OVERFLOW"; |
|
goto LABEL_42; |
|
case EXCEPTION_FLT_STACK_CHECK: |
|
v4 = "FLT_STACK_CHECK"; |
|
goto LABEL_42; |
|
case EXCEPTION_FLT_UNDERFLOW: |
|
v4 = "FLT_UNDERFLOW"; |
|
goto LABEL_42; |
|
case EXCEPTION_INT_DIVIDE_BY_ZERO: |
|
v4 = "INT_DIVIDE_BY_ZERO"; |
|
goto LABEL_42; |
|
case EXCEPTION_INT_OVERFLOW: |
|
v4 = "INT_OVERFLOW"; |
|
goto LABEL_42; |
|
case EXCEPTION_PRIV_INSTRUCTION: |
|
v4 = "PRIV_INSTRUCTION"; |
|
goto LABEL_42; |
|
default: |
|
break; |
|
} |
|
} |
|
} |
|
else |
|
{ |
|
if ( dwMessageId == EXCEPTION_FLT_DENORMAL_OPERAND ) |
|
{ |
|
v4 = "FLT_DENORMAL_OPERAND"; |
|
goto LABEL_42; |
|
} |
|
if ( dwMessageId > EXCEPTION_IN_PAGE_ERROR ) |
|
{ |
|
switch ( dwMessageId ) |
|
{ |
|
case EXCEPTION_INVALID_HANDLE: |
|
v4 = "INVALID_HANDLE"; |
|
goto LABEL_42; |
|
case EXCEPTION_ILLEGAL_INSTRUCTION: |
|
v4 = "ILLEGAL_INSTRUCTION"; |
|
goto LABEL_42; |
|
case EXCEPTION_NONCONTINUABLE_EXCEPTION: |
|
v4 = "NONCONTINUABLE_EXCEPTION"; |
|
goto LABEL_42; |
|
case EXCEPTION_INVALID_DISPOSITION: |
|
v4 = "INVALID_DISPOSITION"; |
|
goto LABEL_42; |
|
case EXCEPTION_ARRAY_BOUNDS_EXCEEDED: |
|
v4 = "ARRAY_BOUNDS_EXCEEDED"; |
|
goto LABEL_42; |
|
} |
|
} |
|
else |
|
{ |
|
switch ( dwMessageId ) |
|
{ |
|
case EXCEPTION_IN_PAGE_ERROR: |
|
v4 = "IN_PAGE_ERROR"; |
|
goto LABEL_42; |
|
case EXCEPTION_GUARD_PAGE: |
|
v4 = "GUARD_PAGE"; |
|
goto LABEL_42; |
|
case EXCEPTION_DATATYPE_MISALIGNMENT: |
|
v4 = "DATATYPE_MISALIGNMENT"; |
|
goto LABEL_42; |
|
case EXCEPTION_BREAKPOINT: |
|
v4 = "BREAKPOINT"; |
|
goto LABEL_42; |
|
case EXCEPTION_SINGLE_STEP: |
|
v4 = "SINGLE_STEP"; |
|
goto LABEL_42; |
|
case EXCEPTION_ACCESS_VIOLATION: |
|
v4 = "ACCESS_VIOLATION"; |
|
LABEL_42: |
|
lstrcpynA(v3, v4, nSize); |
|
return v3; |
|
} |
|
} |
|
} |
|
v5 = lpString1; |
|
v6 = dwMessageId; |
|
v7 = GetModuleHandleA("NTDLL.DLL"); |
|
if ( !FormatMessageA(FORMAT_MESSAGE_FROM_HMODULE|FORMAT_MESSAGE_IGNORE_INSERTS, v7, v6, 0, v5, nSize, NULL) ) |
|
{ |
|
v4 = "*unknown*"; |
|
goto LABEL_42; |
|
} |
|
return v3; |
|
} |
|
|
|
void __fastcall exception_set_filter() |
|
{ |
|
lpTopLevelExceptionFilter = SetUnhandledExceptionFilter((LPTOP_LEVEL_EXCEPTION_FILTER)TopLevelExceptionFilter); |
|
} |
|
|
|
LPTOP_LEVEL_EXCEPTION_FILTER __cdecl exception_set_filter_ptr() |
|
{ |
|
return SetUnhandledExceptionFilter(lpTopLevelExceptionFilter); |
|
} |
|
|
|
LPTOP_LEVEL_EXCEPTION_FILTER __cdecl exception_get_filter() |
|
{ |
|
return lpTopLevelExceptionFilter; |
|
}
|
|
|