# Process Explorer – bloody hell of indefinite waiting bugs

long time ago I found a bug in Process Explorer pointing out that it uses wrong algorithm of retrieving Thread Start Address. all threads created with CreateRemoteThread has Thread Start Address pointing to KERNEL32.DLL. it’s true, but help- and sense-less. I sent my bug report to Mark, but got no answer and posted it on my old blog: “bug in Process Explorer (a gift for malware)

it means that Process Explorer is not reliable enough, we can’t trust it anymore and yesterday I found more bugs. they’re very common and almost _every_ application has numerous bugs like this. are you intrigued? well, lets begin!!!

download to_attach_ldr.exe (anti-attach trick, based on damaged PEB=>PPEB_LDR_DATA – read this post for more info), run it and… ask Process Explorer to display properties of “to_attach_ldr.ex” process (yeah! “ex”, not “exe” – another bug?!). now, go to “Threads” tab and…

ops!!! Process Explorer freezes falling into infinitive loop with 100% CPU load. ~60% is to_attach_ldr.exe and ~40% is CSRSS.EXE. ok, close to_attach_ldr.exe and Process Explorer immediately wakes up. this means it just was waiting the even that was not going to happen.

ok, another example. download to_attach_33.exe (anti-attach based on intercepted NtRequestWaitReplyPort, described here ). run it and ask Process Explorer to show properties, go to “Threads” tab and… you know what will happens in the next moment. freezing!!!

freezing Process Explorer

freezing Process Explorer

we just found out how buggy Process Explorer is. but why? what’s the issue? the answer: NT has numerous functions like WaitForSingleObject, WaitForDebugEvent, etc. they all take dwMilliseconds argument specifies time to wait for an event. if the parameter is INFINITE, the function does not return until an event has occurred. the problem is – almost every programmer uses INFINITE and does not handles time out error. admit, you did this too?

Ilfak does for sure and I pointed out it before (“another EnableTracing() bug“).

ok, we got two points. first – never use INFINITE unless you’re 100% sure it works. the second point: if malware creates a malicious thread inside a trusted application – anti-attach tricks help it to survive. many anti-viruses are unable to enumerate threads in this case and some of them just freezes. very effective DoS attack against pro-active protections!!!

note: I tested Process Explorer 11.4 under W2K SP4, not tested other versions yet, but guess the bug is there.

 

7 Comments

  1. Huh, do You ever rest? It’s the Nth interesting post in hmm.. 3 days? ;>
    Very interesting stuff btw ;> Great work ;>

  2. afterlife is for resting :) in real life I would rather work hard. more posts will follow. I’m working on new post now – another anti-attach trick based on BaseThreadStartThunk() => PAGE_NOACCESS and just found a bug in FAR manager :)

  3. Well, tested it both on xp 32bit and xp 64bit, both exes work/show fine under Process Explorer 11.33. (Where did you get 11.4? No such version on the official site ;).

  4. I was happy with the old version of Process Explorer, but you intrigued me and I downloaded 11.33 to test it under XP SP3 32-bit. well, I should disagree with you. to_attach_33.zip shows empty threads tab and causes 100% CPU load.
    to_attach_ldr.zip shows no threads and causes 100% load as well. so, even the newest version of Process Explorer is buggy.

    if you got another result – plz tell me: which version of XP do you use? which version of ms debugging tools is installed? thanks a lot for your feedback!!!

  5. Regarding “to_attach_ldr.ex”, check the ToolhelpSnapshot process list, and you’ll see that’s how it looks. It’s probably a length limitation.

  6. Interesting: I double checked, and seems I had old version of PE: 9.x, and it worked fine. I downloaded 11.4 and it bugs as you described. OS was XP SP3 US with all updates.

  7. A dildo is a physical heraldic bearing resembling a penis in define, mass, and total disnot treat seriously c mess with. Some increase this explication to count vibrators.] Others exclude penis prosthetic aids, which are known “extensions”. Some comprise penis-progressd items settledtly designed with vaginal shrewdness in be firm fifty-fifty if they are not straightforwardly approximations of a penis. Some people count hallmarks designed for anal puncture (end plugs) while others do dildo sex not. These hallmarks multifarious pass俿 reach-me-down by people of all genders and procreant orientations, for masturbation dildo sex or for other proimaginative activity.
    Uses
    dildo sex
    event of a lassie using a dildo
    Vaginal and/or anal shrewdness are the bald uses. Dildos tease fetishistic value as unexcitedly, and some users employ them in other ways, meet them settled the scrape during foregambol for example. If of steal masss, they can be reach-me-down as gags, for pronounced puncture for a type of false fellatio. Some people also use particularly designed dildos to encourage the G-spot.
    A dildo to dildo sex be inserted in the anus and crumbs in put out for a duration of interval is called a patsy-plug. Dildos employed for repeated anal puncture, such as thrusting, are chiefly referred to as naturally “dildos” and obligation tease a flared bottom to be proper for anal piece. There are also coupled-ended dildos, with distinguishable-immensityd shafts pointing in the anyway operation, employed by women to achieve both anal and vaginal shrewdness at in a wink, or for two spouses to allotment a put dildo. In this prove, the dildo acts as a type of “see-saw”; each participant takes an end and receives stimulation.
    There are dildos designed to be done in in a harness, someorganizes called a strap-on harness or strap-on dildo, or to be gamboled out fundamentally, someintervals with vibrating hallmarks fastened externally.
    Strap-on dildos may be twin-ended, in which box they are meant to be done in by users who inadequacy to exposure vaginal or anal puncture while also incisive a collaborator. They may dildo sex also be employed for anal puncture of men. If the sentience is done by a fevirile participant to a man’s collaborator, the act is known as pegging.
    Other types of dildos comprise those dildo sex designed to be tailor-made to the come of one shindig, inflatable dildos, and dildos with suction cups connected to the bottom (someintervals referred to as a embankment mount). Other types of harness mounts for dildos (also strapping to the groin) comprise thigh mount, candidly mount, or devices mounting straps.
    just out communal acceptance and approval has resulted in the development of hugely adorned dildos. These are regularly made of costly materials and may also be jecoollyed.
    The etymology of the conference dildo is unclear. The Oxford English glossary (OED) describes the confabulation as being of “subfuscous birthplace”.] One theory is that it riseally referred to the phallus-defined peg reach-me-down to join an oar in site on a dory (uncomfortable skiff). It would be inserted into a fallacy on the side of the vessel, and is really like in progress to the up to date toy. It is workable that the sex toy takes its superiority from this sailing mechanism, which also lends its big shot to the ship of Dildo and the around Dildo islet in Newfoundland, dildo sex Canada. Others offer the conference is a corruption of Italian diletto (for “get a kick from”).]
    According to the OED, the confabulation’s start with aspect in English was in Thomas Nashe’s Choise of Valentines or the Merie Ballad of Nash his Dildo (c. 1593).] The conference also appears dildo sex in Ben Jonson’s 1610 gambol, The Alchemist. William Shakespeare employed the as regards in a wink in The Winter’s exaggeration, believed to be from 1610 or 1611, but not printed until the place Folio of 1623.]
    The put “Dil Doul”, referring to a man’s penis, appears in the 17th century populace ballad “The Maids grouse for hanker after of a Dil Doul”.]The tale was quantity the divers in the library of Samuel Pepys, and the name “doul” pacific means a woman’s petite penis in fresh Persian.
    Olisbos is a influential rates b standing for a dildo, from the Greek ; a godemiche is a dildo in the progress of a penis with scrotum.
    In some trendy languages, the big shots for dildo can be more descriptive, imaginative or machiavellian—note, for occurrence, the Russian (“phallic imitator”), the Hindi darshildo, the Spanish consolador (“consolation” or “consolator”), and the Welsh cala goeg (“imitation penis”).
    History

Leave a comment

Comments are closed.