Fix race condition and remote hwbp removal (#44) #45
Conversation
…g registers, fix race condition for stripping ContextFlags
| ULONG OriginalContextFlags = 0; | ||
| if(IsHidden) | ||
| CONTEXT contextCopy; |
There was a problem hiding this comment.
Sorry for the delay, but I now remember why I didn't implement this. It's undocumented, but the sizeof(CONTEXT) isn't actually the maximum size a user might pass to Get/SetThreadContext. See https://github.com/x64dbg/TitanEngine/blob/x64dbg/TitanEngine/TitanEngine.Debugger.Context.cpp#L987, but I'm unfortunately not sure how to deal with this...
There was a problem hiding this comment.
Hm, I have two possible solutions in mind. I took a look at what InitializeContext does, and it calls a function called RtlGetExtendedContextLength2 to get the length for its ContextFlags.
Solution 1: Figure out the maximum size and go with that
Solution 2: The same functions also exists in the kernel, add it to the other undocumented functions and use it.
I can do one of those when I have some spare time, right now the bad fix works for me.
|
Closing this for now, a proper implementation is not trivial, and I doubt anybody really abuses this specific vector |
This fixes everything from #44 except the first detection vector. Turns out I don't need that one after all.
To keep other processes from being able to remove debug registers, I used the same logic already implemented in HookNtGetContextThread: Allow the removal unless the caller is "hidden" too. Which means that if whatever you are debugging has multiple processes, just hide all of them (could use the GUI) and you're fine.
Please test carefully :)