ntdll: loader_init() invoke breakpoint before loading dlls
While using x64dbg I was experiencing incredibly strange issue - int3
was swallowed and KiUserExceptionDispatcher
was never invoked.
Turns out that x64dbg (TitanEngine) expects system breakpoint to be first breakpoint that will be triggered and it always swallows it (it's hardcoded no setting to change it's behavior).
That means if you have a DLL with int3
for example
LONG ExceptionHandler(EXCEPTION_POINTERS *ExceptionInfo) {
ExceptionInfo->ContextRecord->Rip++;
return EXCEPTION_CONTINUE_EXECUTION;
}
BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{
if (fdwReason == DLL_PROCESS_ATTACH)
{
AddVectoredExceptionHandler(1, ExceptionHandler);
asm("int $0x03; nop; nop;");
}
return TRUE;
}
That int3
would be swallowed and ExceptionHandler
never invoked when running under x64dbg.
Now with this MR applied it works correctly and as expected (same as on Windows).
Another interesting thing is that without this MR it wouldn't just swallow int3
but even skip first nop
aswell and RIP would end up on 2nd nop
.