{"id":4530,"date":"2017-12-28T15:01:31","date_gmt":"2017-12-28T15:01:31","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=4530"},"modified":"2017-12-28T16:13:04","modified_gmt":"2017-12-28T16:13:04","slug":"weird-dll-behavior","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2017\/12\/28\/weird-dll-behavior\/","title":{"rendered":"Weird DLL behavior"},"content":{"rendered":"<p>I was toying around with the static DLL loading and came across a very strange behavior.<\/p>\n<p>So&#8230; I created a small .exe file that depends on dll1.dll and dll2.dll, linked statically, and calls function1 and function2 from each DLL respectively.<\/p>\n<pre>...\r\nStart:\r\n invoke function1 ; from dll1.dll\r\n invoke function2 ; from dll2.dll\r\n invoke ExitProcess,0\r\n\r\n<\/pre>\n<p>When loaded (and when the respective function is called) the DLLs create one of the following files:<\/p>\n<ul>\n<li>DLL1.DLL\n<ul>\n<li>c:\\test\\dll1_attached &#8211; DLL is loaded (attached)<\/li>\n<li>c:\\test\\dll1_detached &#8211; DLL is unloaded (detached)<\/li>\n<li>c:\\test\\dll1_function &#8211; &#8216;function&#8217; is called<\/li>\n<\/ul>\n<\/li>\n<li>DLL2.DLL\n<ul>\n<li>c:\\test\\dll2_attached &#8211; DLL is loaded (attached)<\/li>\n<li>c:\\test\\dll2_detached &#8211; DLL is unloaded (detached)<\/li>\n<li>c:\\test\\dll2_function &#8211; &#8216;function&#8217; is called<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>I then modified the section attributes for dll2.dll so that its .text section doesn&#8217;t have code execution rights.<\/p>\n<pre> Name: .text\r\n VirtualSize: 0x00000070\r\n VirtualAddress: 0x00001000\r\n SizeOfRawData: 0x00000200\r\n PointerToRawData: 0x00000400\r\n PointerToRelocations: 0x00000000\r\n PointerToLinenumbers: 0x00000000\r\n NumberOfRelocations: 0x0000\r\n NumberOfLinenumbers: 0x0000\r\n Characteristics: 0x00000000 &lt;---- no flags<\/pre>\n<p>The dll1.dll .text section looks like this:<\/p>\n<pre> Name: .text\r\n VirtualSize: 0x00000070\r\n VirtualAddress: 0x00001000\r\n SizeOfRawData: 0x00000200\r\n PointerToRawData: 0x00000400\r\n PointerToRelocations: 0x00000000\r\n PointerToLinenumbers: 0x00000000\r\n NumberOfRelocations: 0x0000\r\n NumberOfLinenumbers: 0x0000\r\n Characteristics: 0x60000020 &lt;---- (CODE, EXECUTE, READ)<\/pre>\n<p>I then tested this file set on on Win 10 x64. After dropping the files into VM I ran the test.exe.<\/p>\n<p>The first run shows the expected behaviour &#8211; i.e. the application crashes:<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/12\/dll1.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-4535\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/12\/dll1.png\" alt=\"\" width=\"500\" height=\"266\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/12\/dll1.png 995w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/12\/dll1-300x159.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/12\/dll1-768x408.png 768w\" sizes=\"(max-width: 500px) 100vw, 500px\" \/><\/a><\/p>\n<p>There is an event logged in the Event Logs as well:<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/12\/dllcrash.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-full wp-image-4538\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/12\/dllcrash.png\" alt=\"\" width=\"429\" height=\"376\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/12\/dllcrash.png 429w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/12\/dllcrash-300x263.png 300w\" sizes=\"(max-width: 429px) 100vw, 429px\" \/><\/a><\/p>\n<p>To my surprise, when I re-run the test.exe it&#8230; actually works:<a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/12\/dll2.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-4536\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/12\/dll2.png\" alt=\"\" width=\"500\" height=\"261\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/12\/dll2.png 979w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/12\/dll2-300x157.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/12\/dll2-768x402.png 768w\" sizes=\"(max-width: 500px) 100vw, 500px\" \/><\/a><\/p>\n<p>Running it again and again I am getting inconsistent results. I drop the files into a win10 VM and sometimes it crashes with the first run, same as described above. And sometimes it runs smoothly.<\/p>\n<p>For the same set of files tested on Win7 x64 &#8211; I get the &#8216;dll1_attached&#8217; created, but then the test.exe crashes.<\/p>\n<p>When dropped into XP VM, it works w\/o any issues (files are created).<\/p>\n<p>When I manipulate .text section attributes for dll1.dll the application always crashes. So, it would seem that the section of the first DLL cannot be modified, but the second one can.<\/p>\n<p>I am now scratching my head&#8230; Looks like a potential DLL mapping bug?<\/p>\n<p>The memory layout looks like this:<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/12\/dllmem.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-full wp-image-4542\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/12\/dllmem.png\" alt=\"\" width=\"565\" height=\"185\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/12\/dllmem.png 565w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2017\/12\/dllmem-300x98.png 300w\" sizes=\"(max-width: 565px) 100vw, 565px\" \/><\/a><\/p>\n<p>Ideas?<\/p>\n<p>You can grab the files <a href=\"https:\/\/hexacorn.com\/examples\/2017-12-28_weirddll.zip\">here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I was toying around with the static DLL loading and came across a very strange behavior. So&#8230; I created a small .exe file that depends on dll1.dll and dll2.dll, linked statically, and calls function1 and function2 from each DLL respectively. &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2017\/12\/28\/weird-dll-behavior\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[58],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/4530"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=4530"}],"version-history":[{"count":5,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/4530\/revisions"}],"predecessor-version":[{"id":4543,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/4530\/revisions\/4543"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=4530"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=4530"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=4530"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}