flat assembler
Message board for the users of flat assembler.

Index > Windows > IE patch causes crash

Author
Thread Post new topic Reply to topic
wisepenguin



Joined: 30 Mar 2005
Posts: 129
wisepenguin
after reading the topic "patching system dll" on this forum and
other web pages about patching, i had the idea that patching IE
would be possible.

in firefox, tabs load in the background

in IE new windows load instantly and are set as your active
window. i usually load several pages to load in the background
and its annoying to keep switching back to the original window.

i thought about patching IE so that a new window DOESN'T set the
active window. i set breakpoints in OllyDbg for the window functions like
SetForegroundWindow, SetWindowPos, CreateWindowEx, ShowWindow

anyway, i dont recommend anyone try this.

in SHDOCVW.DLL which is the web page rendering control (IE and explorer.exe use this, so be careful) there are calls to SetForegroundWindow
etc

Code:
777D3673   50               PUSH EAX
777D3674   FF15 08197677    CALL DWORD PTR DS:[<&USER32.SetForegroun>; USER32.SetForegroundWindow
    


i replaced those 2 instructions with 7 NOPs to keep the alignment,
patched the DLL and rebooted.

now IE or explorer.exe wont load, and an access violation occurs.
using OllyDbg to debug it, its setting memory which it doesnt have.

but i cant understand why it does this, as i only blocked a call to
SetForegroundWindow. i have restored the original system DLL's again
and everything is back to normal.

does anyone have any ideas ? or experience in patching IE ?
Post 01 Aug 2006, 17:33
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17342
Location: In your JS exploiting you and your system
revolution
I have no experience with patching IE. But one thing you might like to check is if 0x777d3674 is a destination from a jump. Keep the existing PUSH EAX at 0777d3673 and put POP EAX and 5 NOP's at 0x777d3674.
Post 02 Aug 2006, 01:50
View user's profile Send private message Visit poster's website Reply with quote
Madis731



Joined: 25 Sep 2003
Posts: 2140
Location: Estonia
Madis731
How does that help - wouldn't it mess up the stack. I think that the pop eax is already somewhere.

I think a better way would be to jump over the call and let the call remain there (0777D3674h). Otherwise calls or jumps to that address would pop an unknown variable from the stack and mess something up.

Of course its hard to tell what to do with only two lines visible, but disabling SetForeground doesn't help. The problem lies somewhere deeper.
Post 02 Aug 2006, 08:32
View user's profile Send private message Visit poster's website Yahoo Messenger MSN Messenger Reply with quote
zhak



Joined: 12 Apr 2005
Posts: 490
Location: Belarus
zhak
i think it would be better to look at it with our own eyes, but not to try to guess what's happening there...
wisepenguin, could you provide us with the following information:
- OS Ver and IE ver
- disassembly listing of some problem places that confused you
- your workflow (not to spend hours trying to do what's done by you already)

then we could try to figure out what's happening there.
I can guess two possible variants:
a) incorrect checksum
b) addresses that you nopped may be called from other places (but this would be seen in debugger)
Post 02 Aug 2006, 09:24
View user's profile Send private message Reply with quote
wisepenguin



Joined: 30 Mar 2005
Posts: 129
wisepenguin
thankyou all for your replies.

i will try again later today, a few different methods.

first will be to add a random character to the end of the proper
file. if it crashes then i know its the checksum thats wrong. but i dont
know how to fix that.

if thats works, then i will change push eax to push ebx, which (hopefully)
should _most_ of the time effectively disable the SetForegroundWindow
call as the chances of a valid window handle being the value of ebx
are slim.

i will provide more in depth information later as i got to rush off now,
but quickly

OS: Win XP SP2
IE ver: default built into XP SP2 ( IE.6.0.2900.2180)
SHDOCVW.DLL (6.0.2900.2180)

the 2 assembly listings in the original post are from SHDOCVW.DLL
Post 02 Aug 2006, 10:07
View user's profile Send private message Reply with quote
zhak



Joined: 12 Apr 2005
Posts: 490
Location: Belarus
zhak
I just thought that really wonderful solution would be not to make IE load pages in background, but to add tabs to IE and load pages in tabs as all good browsers do. If MS guys cannot do this, then we can!
Post 02 Aug 2006, 10:37
View user's profile Send private message Reply with quote
revolution
When all else fails, read the source


Joined: 24 Aug 2004
Posts: 17342
Location: In your JS exploiting you and your system
revolution
Madis731 wrote:
How does that help - wouldn't it mess up the stack.
The PUSH EAX is the input parameter for the API call, when the API returns is restores the stack. So, if we stop the API call then we have to manually restore the stack with POP EAX.
Post 02 Aug 2006, 11:05
View user's profile Send private message Visit poster's website Reply with quote
UCM



Joined: 25 Feb 2005
Posts: 285
Location: Canada
UCM
zhak: IE 7 has tabs.
Post 02 Aug 2006, 12:55
View user's profile Send private message Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar. Also on YouTube, Twitter.

Website powered by rwasa.