Debugging one layer deeper

on YouTube ↗54m

" summary

An instrumentation agent causes an access violation that traces all the way into the CLR: dumps from an instrumented server that crashes about once a day reveal a read at address -1+0x2c, and WinDbg with SOS shows the fault in objectnativeislockheld. The investigation uses WinDbg, reverse-engineered CLR assembly and syncblk inspection to find an -1 in m_HoldingThread inside a promoted sync block (one orphaned entry), a small repro is built that reliably reproduces the crash.

AI-written summary · about

" chapters (22)

1. 0:00Intro
2. 1:47Debugging methodology
3. 3:39What is Data Tracer
4. 4:58The problem
5. 5:55Finding the issue
6. 9:38Analyzing the code
7. 10:18Digging into the source code
8. 10:51CLR source code
9. 12:04Lockheed source code
10. 14:40Calling convention
11. 16:11Theories
12. 18:37Example
13. 19:33SynLock
14. 21:25Programmatic
15. 22:39Verifying theories
16. 26:30Orchard source code
17. 27:58Mapping instructions
18. 33:20Verification
19. 42:18Inspecting the value
20. 45:55Debugging the access violation
21. 48:59Wrapping things up
22. 51:35Conclusion

" related talks

• 58mDebugging one layer deeperKevin Gosse · NDC Oslo 2021
• 32mIntroduction to Windows Kernel Mode DebuggingYamin Tian · BSidesSF 2018
• 56mD1T2 - Attacking Microsoft’s .NET Framework Through CLRYu Hong, Shikang Xing · Hack In The Box Amsterdam 2018
• 48mDPTrace: Dual Purpose Trace for Exploitability Analysis of Program CrashesRohit Mothe, Rodrigo Rubira Branco · Black Hat USA 2016
• 21mBattle of Windows Service: A Silver Bullet to Discover File Privilege Escalation Bugs AutomaticallyWenxu Wu · Black Hat USA 2019
• 25mData-Only Pwning Microsoft Windows KernelNikita Tarakanov · Black Hat USA 2014
• 40mCommSec D1 - The Life & Death of Kernel Object AbuseSalf ElSherei, Ian Kronquist · Hack In The Box Amsterdam 2018
• 51mAutomation Techniques in C++ Reverse EngineeringRolf Rolles · Black Hat USA 2019