Skip to content

ntdll: loader_init() invoke breakpoint before loading dlls

Dāvis Mosāns (davispuh) requested to merge davispuh/wine:int3 into master

While using x64dbg I was experiencing incredibly strange issue - int3 was swallowed and KiUserExceptionDispatcher was never invoked.

Turns out that x64dbg (TitanEngine) expects system breakpoint to be first breakpoint that will be triggered and it always swallows it (it's hardcoded no setting to change it's behavior).

That means if you have a DLL with int3 for example

LONG ExceptionHandler(EXCEPTION_POINTERS *ExceptionInfo) {
  ExceptionInfo->ContextRecord->Rip++;
  return EXCEPTION_CONTINUE_EXECUTION;
}

BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{
    if (fdwReason == DLL_PROCESS_ATTACH)
    {
         AddVectoredExceptionHandler(1, ExceptionHandler);
         asm("int $0x03; nop; nop;");
    }
    return TRUE;
}

That int3 would be swallowed and ExceptionHandler never invoked when running under x64dbg. Now with this MR applied it works correctly and as expected (same as on Windows).

Another interesting thing is that without this MR it wouldn't just swallow int3 but even skip first nop aswell and RIP would end up on 2nd nop.

Merge request reports

Loading