Surprise Exception Handlers Peter Ferrie Senior Anti-virus Researcher 11 June,

Corrupted! A program that causes this message to appear: would probably be considered corrupted and not worthy of attention. 2 Peter Ferrie, Microsoft Corporation

Empty! Especially if it looks like this… 3 Peter Ferrie, Microsoft Corporation

Empty! 4 Peter Ferrie, Microsoft Corporation Entry Point

Empty! 5 Peter Ferrie, Microsoft Corporation C3 RET

Empty! So the main file does nothing. If we assume that the structure is normal, then we could check the import table. Just in case. 6 Peter Ferrie, Microsoft Corporation

Empty! 7 Peter Ferrie, Microsoft Corporation SEH.DLL

Empty! 8 Peter Ferrie, Microsoft Corporation a

Empty! So the search moves to SEH.DLL, and the mysterious function called ‘a’. 9 Peter Ferrie, Microsoft Corporation

‘A’ function 10 Peter Ferrie, Microsoft Corporation

Failure To Launch CODE: push esi CODE: xor esi, esi CODE: lods dword ptr fs:[esi] CODE: inc eax CODE: CODE: loc_401006: CODE: dec eax CODE: xchg eax, esi CODE: lodsd CODE: inc eax CODE: A jnz short loc_ CODE: C mov dword ptr [esi], offset sub_ CODE: pop esi At this point, eax is zero, which means a load failure. A DLL that fails to load causes the message to appear. 11 Peter Ferrie, Microsoft Corporation

I’m OK, You’re OK But what happens when we click on ‘OK’? 12 Peter Ferrie, Microsoft Corporation

Surprise! 13 Peter Ferrie, Microsoft Corporation

Not OK The code runs. 14 Peter Ferrie, Microsoft Corporation

How Did That Happen? Let’s revisit the code: CODE: xor esi, esi CODE: lods dword ptr fs:[esi] CODE: inc eax CODE: CODE: loc_401006: CODE: dec eax CODE: xchg eax, esi CODE: lodsd CODE: inc eax CODE: A jnz short loc_ CODE: C mov dword ptr [esi], offset sub_ CODE: pop esi 15 Peter Ferrie, Microsoft Corporation

Not OK A standard search and replace of the topmost SEH handler. Why does it work? The secret is in what Windows does after the DLL refuses to load. First comes the call to NtRaiseHardError() to display the message. However, next comes a called to RtlRaiseStatus(). This is intended to notify a debugger of the problem. RtlRaiseStatus() calls NtRaiseException(). Which raises an exception. Which, without a debugger, calls the topmost SEH handler. Which is now inside the DLL that was supposed to have terminated. 16 Peter Ferrie, Microsoft Corporation

Not OK Nothing significant has changed in the process environment. So the DLL is free to run normally. So is the EXE, if it wants to. This technique works only for statically-linked DLLs. LoadLibrary() failures do not call the SEH handler. 17 Peter Ferrie, Microsoft Corporation

Really Not OK Just a little something to add to the workload. 18 Peter Ferrie, Microsoft Corporation