Rare 0xc0000018 error on w81 64b apps

c++ / delphi package - dll injection and api hooking

Re: Rare 0xc0000018 error on w81 64b apps

Postby madshi » Sun Mar 13, 2016 10:16 am

Thanks, I'll try. Would really like to use the API.
madshi
Site Admin
 
Posts: 9147
Joined: Sun Mar 21, 2004 5:25 pm

Re: Rare 0xc0000018 error on w81 64b apps

Postby Overnissen » Sun Mar 13, 2016 6:13 pm

I might not have expressed myself in a clear manner, for that I apologize.

The problem CAN be reproduced with the release drivers, since I can reproduce it by "manual" injection into a single process (Chrome.exe) without using the driver all together, so the problem would definitely be present with the release/old drivers, I just haven't seen it with the old drivers before.

I had the 0x0000018 problem on Windows10 and switched to the beta drivers, at the same time (probably, can't really remember) I implemented hooking of LoadLibrary to catch libraries as they load, but I have removed that since it would be superfluous as you mention.

Removing the LoadLibrary hooking appears to make the problem go away, so unless the problem re-appears I don''t think I'll be spending too much time trying to reproduce it, but I will of course be aware of the behavior so I can recognize it if it reappears.
Overnissen
 
Posts: 28
Joined: Mon Dec 29, 2014 6:22 pm

Re: Rare 0xc0000018 error on w81 64b apps

Postby madshi » Sun Mar 13, 2016 6:59 pm

Ah ok, that's good to hear, thanks! So the conclusion is that the new drivers are probably fine, right?
madshi
Site Admin
 
Posts: 9147
Joined: Sun Mar 21, 2004 5:25 pm

Re: Rare 0xc0000018 error on w81 64b apps

Postby Overnissen » Sun Mar 13, 2016 8:23 pm

Yes, so far I'd have to say that they're fine :)

I'll be making a new build here tonight, I got a couple of other bugs I need to fix as well, but I'll for sure keep you updated, I'll be getting feedback from the beta testers regularly. ;)

Thanks madshi :)
Overnissen
 
Posts: 28
Joined: Mon Dec 29, 2014 6:22 pm

Re: Rare 0xc0000018 error on w81 64b apps

Postby Overnissen » Mon Mar 21, 2016 3:37 pm

Yes, absolutely, the drivers are fine..

It is just that, for some odd reason, the bug that I've been experiencing (or, odd behavior) was very intermittent, sometimes showing after 5 minutes and at other occasions after 5 or 10 hours, but when using the drivers it showed up quite quickly, which again led me to falsely suspect the drivers for being the culprit to the oddity..

I did find the bug eventually, it appears that I must have been tired at the point of writing and examining the code, as the bug turned out to occur when a dns resolution request for a host/domain with no . in it was issued, just like Chrome does when it's launched (three times to be exact) - probably to determine which dns servers are used or if it's even online - or something..

In Firefox this would lead to the injected .dll getting trapped in an eternal loop, the browser's dns resolution request probably eventually times out and it it self continues, but the .dll running within the context of the browser continues using cpu resources in the loop, as the same code is called multiple times, more and more instances of the loop is running (in separate threads) and the cpu usage of the application appears to steadily increase.

It was actually by testing in Chrome that got me on the path to figure it out, since Chrome would not work at all (I was probably blocking it's dns resolution threads) while Firefox and IE would (apparently) work and Firefox would over time (use) eventually start to wind up.

Why the shell (explorer.exe) is attempting to resolve no-tld names I don't know, but then again, the explorer shell does a lot of things that are not obvious.. ;)

So eventually I caught it, when I added critical sections to the .dll to examine where it would loop and saw where it stopped and never exited.. ;)

Thanks madshi, you're the man :) :)
Overnissen
 
Posts: 28
Joined: Mon Dec 29, 2014 6:22 pm

Re: Rare 0xc0000018 error on w81 64b apps

Postby madshi » Mon Mar 21, 2016 4:41 pm

Glad to hear you got it solved - and that it wasn't my fault... :D
madshi
Site Admin
 
Posts: 9147
Joined: Sun Mar 21, 2004 5:25 pm

Re: Rare 0xc0000018 error on w81 64b apps

Postby Overnissen » Mon Mar 21, 2016 11:34 pm

No no, that was my own frag-up as usual.. ;)
Overnissen
 
Posts: 28
Joined: Mon Dec 29, 2014 6:22 pm

Previous

Return to madCodeHook

Who is online

Users browsing this forum: No registered users and 2 guests