I'm investigating how C:\Windows\System32\SystemPropertiesAdvanced.exe on Windows 2008 interacts with explorer.exe when updating system environment variables. When updating environment variables this way, explorer.exe will dynamically update its environment block to pick up the changes. I'm aware of multiple ways, to remotely inject environment variables, but was curious as to the implementation SystemPropertiesAdvanced.exe uses.
When I press the OK button on the SystemPropertiesAdvanced dialog after updating an environment variable, a new thread is created. Debugging this thread I've come to the following lines of interest:
WINSTA!WinStationBSMWorkerThread:
75b292bc 8bff mov edi,edi
75b292be 55 push ebp
75b292bf 8bec mov ebp,esp
75b292c1 51 push ecx
75b292c2 8365fc00 and dword ptr [ebp-4],0
75b292c6 53 push ebx
75b292c7 56 push esi
75b292c8 8b7508 mov esi,dword ptr [ebp+8]
75b292cb 837e4000 cmp dword ptr [esi+40h],0
75b292cf 57 push edi
75b292d0 0f95c0 setne al
75b292d3 50 push eax
75b292d4 ff763c push dword ptr [esi+3Ch]
75b292d7 8d4624 lea eax,[esi+24h]
75b292da ff7638 push dword ptr [esi+38h]
75b292dd ff7628 push dword ptr [esi+28h]
75b292e0 50 push eax
75b292e1 ff7620 push dword ptr [esi+20h] ds:0023:00404468={SYSDM!szUserEnv (6b3ec434)}
75b292e4 8d4614 lea eax,[esi+14h]
75b292e7 ff761c push dword ptr [esi+1Ch]
75b292ea ff7618 push dword ptr [esi+18h]
75b292ed 50 push eax
75b292ee ff7610 push dword ptr [esi+10h]
75b292f1 ff760c push dword ptr [esi+0Ch]
75b292f4 ff7608 push dword ptr [esi+8]
75b292f7 ff7604 push dword ptr [esi+4]
75b292fa ff36 push dword ptr [esi]
75b292fc e821fdffff call WINSTA!WinStationBroadcastSystemMessageWorker (75b29022)
75b29301 8d7e44 lea edi,[esi+44h]
75b29304 57 push edi
75b29305 894508 mov dword ptr [ebp+8],eax
75b29308 ff15d810b275 call dword ptr [WINSTA!_imp__EnterCriticalSection (75b210d8)]
75b2930e 33db xor ebx,ebx
75b29310 43 inc ebx
75b29311 837e3000 cmp dword ptr [esi+30h],0
75b29315 0f85663d0000 jne WINSTA!WinStationBSMWorkerThread+0x5b (75b2d081)
75b2931b 57 push edi
75b2931c 895e2c mov dword ptr [esi+2Ch],ebx
75b2931f ff15d410b275 call dword ptr [WINSTA!_imp__LeaveCriticalSection (75b210d4)]
75b29325 837dfc00 cmp dword ptr [ebp-4],0
75b29329 0f85683d0000 jne WINSTA!WinStationBSMWorkerThread+0x7c (75b2d097)
75b2932f 8b4508 mov eax,dword ptr [ebp+8]
75b29332 5f pop edi
75b29333 5e pop esi
75b29334 5b pop ebx
75b29335 c9 leave
75b29336 c20400 ret 4
I believe that the call to WINSTA!WinStationBroadcastSystemMessageWorker is some how letting explorer.exe know that it should pick up these new environment variables. It's interesting that the reference at 75b292e1 is being identified as SYSDM!szUserEnv by the debugger.
Perhaps not your standard inquiry, but maybe there are other reverse engineers out there. :)
[at 100rep I'll set the "tags" properly]
Cheers
Pradeep Prem Kamal explains how to use WM_SETTINGCHANGE and SendMessageTimeout to update all top-level processes in his blog post here. Another example (in Delphi) can be found here.
My guess is that WINSTA!WinStationBroadcastSystemMessageWorker wraps updating the user environment variables (SYSDM!szUserEnv ?) and makes the SendMessageTimeout call.
Related
How to identify the device by pci capability id?
this is my code:
I try to access 34h and check if the capability id exists on the first loop
If it exists, it points to the next pointer, But there seems to be some problems in the steps of getting the pointer and putting the address.
'''
push eax
push edi
push esi
mov cx,100
;mov edi,[esi]
add edi,52 ;access 34h
lopreg:
mov eax,edi ;read
mov dx,0cf8h
out dx,eax
mov dx,0cfch
in eax,dx
cmp cx,100 ;first time
je first
cmp ah,10
jne nextreg
jmp ispcie
first:
cmp ah,0
je ending
sub edi,52
movzx bx,ah
add di,bx
loop lopreg
jmp ending
ispcie:
call set_cur
mov ah,09h
lea dx,regmem ;print pcie
int 21h
jmp ending
nextreg:
cmp al,0
je ending
movzx bx,al ;
add di,bx
loop lopreg
ending:
pop esi
pop edi
pop eax
ret
'''
This answer is written with the assumption that this code is looking for the PCI Express Capability.
There are several problems in this code.
At the first label, it should use al instead of ah to determine the offset of the first capability.
The Capability ID of the PCI Express capability is 10h, not 10.
After reading each capability header, al contains the capability id and ah contains the next pointer. So cmp ah, 10 should be cmp al, 10h .
At the nextreg label, it should use ah instead of al to determine the offset of the next capability.
On each iteration, it adds bx to di without removing the previous offset.
It's not clear what edi is initialized to, but if it does not have bit 31 set, then this code won't be reading PCI config space at all.
This should work:
mov cx,100
;mov edi,[esi]
add edi,52 ;access 34h
lopreg:
mov eax,edi ;read
mov dx,0cf8h
out dx,eax
mov dx,0cfch
in eax,dx
cmp cx,100 ;first time
je first
cmp al,10h
jne nextreg
jmp ispcie
first:
cmp al,0
je ending
sub edi,52
movzx bx,al
add di,bx
loop lopreg
jmp ending
ispcie:
call set_cur
mov ah,09h
lea dx,regmem ;print pcie
int 21h
jmp ending
nextreg:
cmp ah,0
je ending
sub di, bx
movzx bx,ah
add di,bx
loop lopreg
ending:
A better approach is to keep the original address in edi without changing it, and use lea eax, [edi+ebx] for each new offset.
There's no need to use ecx as a loop counter and the logic is a bit convoluted. It can be straightened out a bit to flow more clearly.
Here's how I would write it:
lea eax,[edi+34h]
mov dx,0cf8h
out dx,eax
mov dx,0cfch
in al,dx ; read offset of first capability
cmp al,0
je ending
movzx ebx,al
lopreg:
lea eax,[edi+ebx] ; offset of next capability is in ebx
mov dx,0cf8h
out dx,eax
mov dx,0cfch
in eax,dx ; read capability header
cmp al,10h ; check if it is the PCI Express capability
je ispcie
nextreg:
cmp ah,0 ; check if it is the end of the capability list
je ending
movzx ebx, ah ; set up ebx with the offset of the next capability
jmp lopreg
ispcie:
; base of device PCI config space is in edi
; offset of PCI Express Capability is in ebx
...
ending:
(I don't know what set_cur and regmem are so I didn't attempt to write that part of the code.)
I'd like to know why my code isn't working when I'm trying to use stack.
Program have to print name of itself.
Here is code without using stack, which is working:
format elf executable
entry _start
segment readable executable
strlen:
mov ebx,0
strlen_loop:
cmp byte [eax+ebx],0
je strlen_end
inc ebx
jmp strlen_loop
strlen_end:
inc ebx
ret
_start:
mov eax,[esp+4]
call strlen
mov eax,4
mov ecx,[esp+4]
mov edx,ebx
mov ebx,0
int 80h
mov eax,1
mov ebx,0
int 80h
Here is code with using stack (program just exits/doing nothing):
format elf executable
entry _start
segment readable executable
strlen:
mov ebx,0
strlen_loop:
cmp byte [eax+ebx],0
je strlen_end
inc ebx
jmp strlen_loop
strlen_end:
inc ebx
ret
_start:
mov eax,[esp+4]
call strlen
push ebx
mov eax,4
mov ebx,0
mov ecx,[esp+4]
pop edx
int 80h
mov eax,1
mov ebx,0
int 80h
I'm new in Linux development, but if I understood your problem, you have a mistake in this block:
mov eax,4
mov ebx,0
mov ecx,[esp+4] ; you wrote 'push' instruction above so value of 4 is incorrect now
pop edx
int 80h
You can just swap these two lines to fix this:
pop edx
mov ecx,[esp+4]
Below is block of the code of an app I am reversing.
Please forgive me I new to world of reversing but I figured out that something is happening here and I thought I must change je to jmp but I am not sure if it's correct.
_unit34::TApplication.Run
Push ebp
ebp,esp
ecx
Push ebx
Push esi
Push edi
Mov dword ptr [ebp-4],eax
Mov. Eax,dword ptr [ebp-4]
Mov byte ptr [eax+0AD],1
XOR edx,edx
Push ebp
Push. 4E2B09
Push dword ptr fs:[edx]
Mov dword ptr fs:[edx],esp
Mov Eax,4D6574; DoneApplication
Call AddExitProc
Mov eax, dword ptr [ebp-4]
Mov eax, dword ptr [ebp+44]
Test eax,eax
Je 004E2AF1
Can someone explain a bit of what's happening there?
And how can I change je to jmp using Interactive Delphi reconstructor?
Can someone explain a bit of what's happening there?
Push ebp
mov ebp,esp
Sets up a stack frame.
??? ecx
Push ebx
Push esi
Push edi
Save non-volatile registers
Mov dword ptr [ebp-4],eax
Save the Self pointer
Mov. Eax,dword ptr [ebp-4]
Unfortunate stack trashing :-(
Mov byte ptr [eax+0AD],1
Self.SomeBoolean:= true
XOR edx,edx
Push ebp
Push. 4E2B09
Push dword ptr fs:[edx]
Mov dword ptr fs:[edx],esp
try
Mov Eax,4D6574; DoneApplication
Call AddExitProc
Mov eax, dword ptr [ebp-4]
Set the exit proc for the application
Mov eax, dword ptr [ebp+44]
SomeObject:= somevar
Test eax,eax
Je 004E2AF1
If (Assigned(SomeObject)) then .....
And how can I change je to jmp using Interactive Delphi reconstructor?
That particular change should make no sense here, because it would invoke an exception. The je is invoked when the object is nil. This is the error condition. You will change the program to always crash with an error.
However if you absolutly must do it, just change the opcode from $74 to $EB (for a byte offset jump) or from $0F84 to $90E9 (for a long jump).
I'd use a hex editor.
None of these changes will have a happy outcome unless you know exactly what you're doing.
Where to start
Get expertise in Delphi coding and view a lot of CPU output.
Press Ctrl + Alt + C to see what code Delphi produces.
This will take a number of months to years to master however.
About reversing
If you want to get into reversing IDA pro is a much better tool.
It has a freeware edition you can start with.
I'm messing around with ASM in Delphi. From my understanding, EAX holds Result. In the following, I have to put RET at the end, otherwise Result is not correct (it is correct if the input is 0). What am I doing wrong, or should I say, what don't I understand about this?
function MSb(const Val: Integer): Integer;
label
Go;
asm
CMP EAX, 0
JNZ Go
MOV EAX, -1
RET
Go:
BSR EBX, EAX
MOV EAX, EBX
RET
end;
If I say the following:
MOV Result, EBX
Then I get the following compilation:
MOV [EPB-$04], EBX
MOV EAX, [EPB-$04]
However, my code above has the following postscript:
MOV EAX, EDX
RET
At least without optimization enabled, your function has a pre-amble and a post-amble. Have a look at it:
Project46.dpr.13: asm
0041A1F4 55 push ebp
0041A1F5 8BEC mov ebp,esp
0041A1F7 83C4F8 add esp,-$08
0041A1FA 8945F8 mov [ebp-$08],eax
Project46.dpr.14: CMP EAX, 0
0041A1FD 83F800 cmp eax,$00
Project46.dpr.15: JNZ Go
0041A200 7506 jnz $0041a208
Project46.dpr.16: MOV EAX, -1
0041A202 B8FFFFFFFF mov eax,$ffffffff
Project46.dpr.17: RET
0041A207 C3 ret
Project46.dpr.19: BSR EBX, EAX
0041A208 0FBDD8 bsr ebx,eax
Project46.dpr.20: MOV EAX, EBX
0041A20B 89D8 mov eax,ebx
Project46.dpr.21: RET
0041A20D C3 ret
Project46.dpr.22: end;
0041A20E 8B45FC mov eax,[ebp-$04]
0041A211 59 pop ecx
0041A212 59 pop ecx
0041A213 5D pop ebp
0041A214 C3 ret
So the pre-amble sets up the stack frame. It saves away the ebp register, and modifies both the ebp and esp registers. Notice also the post-amble. You do need to execute that code to restore the saved registers.
The usual way to deal with this is to jump to the end of the function instead of using ret. So write your code like this:
function MSb(const Val: Integer): Integer;
asm
CMP EAX, 0
JNZ ##go
MOV EAX, -1
JMP ##exit
##go:
BSR EBX, EAX
MOV EAX, EBX
##exit:
end;
This way you ensure that the post-amble is executed. You really should get into the habit of writing the code this way to ensure that any pre-amble is executed.
Now, beyond that I suspect that the problem you mention in the question actually relates to a compiler bug relating to your use of a Pascal label rather than an asm label. Well, perhaps it is a compiler bug, but perhaps it is just a mistake to use a Pascal label. Consider the following program:
{$APPTYPE CONSOLE}
function MSb(const Val: Integer): Integer;
asm
CMP EAX, 0
JNZ ##Go
MOV EAX, -1
JMP ##exit
##Go:
BSR EBX, EAX
MOV EAX, EBX
##exit:
end;
function MSb2(const Val: Integer): Integer;
label
Go;
asm
CMP EAX, 0
JNZ Go
MOV EAX, -1
RET
Go:
BSR EBX, EAX
MOV EAX, EBX
end;
begin
Writeln(Msb(0));
Writeln(Msb(1));
Writeln(Msb2(0));
Writeln(Msb2(1));
Readln;
end.
The output when compiled with optimization is:
-1
0
-1
4
So, what about that rather odd 4. Well, let's look at the assembled code for Msb2, which is essentially your code:
004059E8 83F800 cmp eax,$00
004059EB 7506 jnz $004059f3
004059ED B8FFFFFFFF mov eax,$ffffffff
004059F2 C3 ret
004059F3 0FBDD8 bsr ebx,eax
004059F6 89D8 mov eax,ebx
004059F8 8BC2 mov eax,edx
004059FA C3 ret
Why on earth is the value of edx, a volatile register whose value has not been assigned, being moved into eax just before the function returns. This is the problem that you are reporting. My guess is that the use of a Pascal label is confusing the assembler. Stick to asm labels.
Here is the assembled code for Msb:
004059D4 83F800 cmp eax,$00
004059D7 7506 jnz $004059df
004059D9 B8FFFFFFFF mov eax,$ffffffff
004059DE C3 ret
004059DF 0FBDD8 bsr ebx,eax
004059E2 89D8 mov eax,ebx
004059E4 C3 ret
That's more like it! Notice how the compiler knows that there is no post-able here, and replaces the jmp ##exit with a straight ret.
What am I doing wrong, or should I say, what don't I understand about
this?
Basically as clearly stated the pre and post-ambles but also be careful when using assembler code. Parameters are passed in different ways depending upon calling conventions. Your code will run fine with the Pascal (ironically obsolete) calling convention, if you remove the label, the RET and use assembler labels (##). It is good practice to always indicate a calling convention for assembly code, since Result may refer indeed to EAX or a local variable for holding it. EAX maps directly to Result when using the Register (default) calling convention.
I'm trying to recompile the (old) TProfDHTMLEdit unit in 64bit environment with Delphi XE5. The component is old and dismissed but I need it because I could not found anything similar to easily substitute it for my purpose.
I'm having trouble with three internal routines that are hard coded directly in asm. I'm not capable to convert them in pure Pascal. Anyone has already solved a similar problem?
The parts to convert are:
procedure TProfOleControl.GetEventMethod(DispID: TDispID; var Method: TMethod);
asm
{$IFDEF WIN32}
PUSH EBX
PUSH ESI
PUSH EDI
PUSH ECX
MOV EBX,EAX
MOV ECX,[EBX].TProfOleControl.FControlData
MOV EDI,[ECX].TControlData2.EventCount
MOV ESI,[ECX].TControlData2.EventDispIDs
XOR EAX,EAX
JMP ##1
##0: CMP EDX,[ESI].Integer[EAX*4]
JE ##2
INC EAX
##1: CMP EAX,EDI
JNE ##0
XOR EAX,EAX
XOR EDX,EDX
JMP ##3
##2: PUSH EAX
CMP [ECX].TControlData2.Version, 401
JB ##2a
MOV EAX, [ECX].TControlData2.FirstEventOfs
TEST EAX, EAX
JNE ##2b
##2a: MOV EAX, [EBX]
CALL TObject.ClassParent
CALL TObject.InstanceSize
ADD EAX, 7
AND EAX, not 7
##2b: ADD EBX, EAX
POP EAX
MOV EDX,[EBX][EAX*8].TMethod.Data
MOV EAX,[EBX][EAX*8].TMethod.Code
##3: POP ECX
MOV [ECX].TMethod.Code,EAX
MOV [ECX].TMethod.Data,EDX
POP EDI
POP ESI
POP EBX
{$ENDIF}
end;
or
procedure TProfOleControl.InvokeEvent(DispID: TDispID; var Params: TDispParams);
var
EventMethod: TMethod;
begin
GetEventMethod(DispID, EventMethod);
if Integer(EventMethod.Code) < $10000 then Exit;
try
{$IFDEF WIN32}
asm
PUSH EBX
PUSH ESI
MOV ESI, Params
MOV EBX, [ESI].TDispParams.cArgs
TEST EBX, EBX
JZ ##7
MOV ESI, [ESI].TDispParams.rgvarg
MOV EAX, EBX
SHL EAX, 4
XOR EDX, EDX
ADD ESI, EAX
##1: SUB ESI, 16
MOV EAX, dword ptr [ESI]
CMP AX, varSingle
JA ##3
JE ##5
##2: TEST DL,DL
JNE ##2a
MOV ECX, ESI
INC DL
TEST EAX, varArray
JNZ ##6
MOV ECX, dword ptr [ESI+8]
JMP ##6
##2a: TEST EAX, varArray
JZ ##5
PUSH ESI
JMP ##6
##3: CMP AX, varDate
JA ##2
##4: PUSH dword ptr [ESI+12]
##5: PUSH dword ptr [ESI+8]
##6: DEC EBX
JNE ##1
##7: MOV EDX, Self
MOV EAX, EventMethod.Data
CALL EventMethod.Code
POP ESI
POP EBX
end
{$ENDIF}
except
Application.HandleException(Self)
end
end;
There seem to be slightly adjusted versions of the methods of TOleControl with the same name. TOleControl is one of the VCL's own types, you can check the XE5 implementation (which quite possibly does use pure Pascal) to get something that already mostly works.