Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

System freezes when int 3 is executed in usermode application #78

Open
b1tg opened this issue May 31, 2021 · 0 comments
Open

System freezes when int 3 is executed in usermode application #78

b1tg opened this issue May 31, 2021 · 0 comments

Comments

@b1tg
Copy link

b1tg commented May 31, 2021

System freezes when int 3 is executed in usermode application.

Description

I test HyperPlatform.sys in a Win7 x64 vm.

With windbg attached to vm, bp.exe will cause breakpoint in windbg.

Without windbg attached to vm, if i run bp.exe in vm , vm will freeze, i tried to uncomment the InterruptionVector::kBreakpointException line, but still the same issue.

const auto exception_bitmap =
// 1 << InterruptionVector::kBreakpointException |
// 1 << InterruptionVector::kGeneralProtectionException |
// 1 << InterruptionVector::kPageFaultException |
0;

bp.exe source code:

// bp.exe source code
#include <stdio.h>
#include <Windows.h>


static LONG CALLBACK VectoredHandler(
	_In_ PEXCEPTION_POINTERS ExceptionInfo
)
{
	printf("hello from exception handler \n");
	if (ExceptionInfo->ExceptionRecord->ExceptionCode == EXCEPTION_BREAKPOINT)
	{
		printf("got EXCEPTION_BREAKPOINT\n");
		//Increase EIP/RIP to continue execution.
#ifdef _WIN64
		ExceptionInfo->ContextRecord->Rip++;
#else
		ExceptionInfo->ContextRecord->Eip++;
#endif
		return EXCEPTION_CONTINUE_EXECUTION;
	}
	return EXCEPTION_CONTINUE_SEARCH;
}

int main()
{
	printf("start..\n");
	PVOID Handle = AddVectoredExceptionHandler(1, VectoredHandler);
	__debugbreak();
	RemoveVectoredExceptionHandler(Handle);
	printf("over..\n");
	return 0;
}

Expected behavior

Without windbg attached to vm, if i run bp.exe in vm , vm should not freeze and VectoredHandler should be called.

Actual behavior

Without windbg attached to vm, if i run bp.exe in vm , vm will freeze.

Steps to reproduce the problem

  • Load driver HyperPlatform in Win7 x64 virtual machine
  • run bp.exe in cmd.exe

Specifications

  • Commit: bf6a2b8

  • OS version: Host(Win10 x64 2004) (VM: Win7 x64 in Vmware Workstation)

  • Hardware: intel

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant