Function SetupCrashDebugging

src/windows/CrashDebugger.cpp:441–593

Hijacks the Abort function from MSVCRT.DLL or UCRTBASE.DLL, gets information on loaded modules, and sets up an unhandled exception filter.

// gets information on loaded modules, and sets up an unhandled
// exception filter.
void SetupCrashDebugging()
{
#ifdef ALLOW_ABORT_HIJACKING
#ifdef FILE_DEBUG_HIJACKER
	FILE* something = fopen("something.txt", "w");
#endif
	
	// Step 1. Hijack abort()
	if (sizeof(uintptr_t) > 4)
	{
		HijackDbgPrint("Abort hijack disabled.  The target is 64-bit.");
		return;
	}
	
	void* patchAt = (void*) &abort;
	
	// We need to find the actual address of abort() from within the loaded libraries.
	// This means that just "&abort" does not do as it links to our thunk which jumps
	// indirectly to the actual loaded abort().
	//
	// Now, import thunks are typically encoded in FF 25 XX XX XX XX. So, check for
	// those bytes' presence.
	uint8_t* abortPtr = (uint8_t*) &abort;
	if (abortPtr[0] != 0xFF || abortPtr[1] != 0x25)
	{
		// Wow! It looks like this ain't an import thunk of a known kind.
		auto x = abortPtr;
		HijackDbgPrint("Abort hijack may be ineffective.  The import thunk looks weird.  Here is a dump:");
		HijackDbgPrint("%02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x %02x",
			x[0], x[1], x[2], x[3], x[4], x[5], x[6], x[7],
			x[8], x[9], x[10], x[11], x[12], x[13], x[14], x[15]);
	}
	else
	{
		// It is.  This means that the address we're looking for is after the FF 25 bytes.
		void*** ptr = (void***)(abortPtr + 2);
		
		// ptr - The address of the offset of the FF 25 XX XX XX XX instruction
		// *ptr - The address where the JMP loads the address to jump to
		// **ptr = The address to jump to
		
		HijackDbgPrint("Found import thunk at %p, jumping to indirection via %p", ptr, *ptr);
		HijackDbgPrint("The indirection leads to %p", **ptr);
		
		patchAt = **ptr;
	}
	
	uintptr_t Patch[2];
	Patch[0] = 0x25FF9090;                     // NOP; NOP; JMP [modrm]
	Patch[1] = (uintptr_t) &HijackedAbortPtr;  // [absolute indirect 32-bit address]
	
	if (!PatchMemory((void*) patchAt, Patch, sizeof Patch))
	{
		HijackDbgPrint("Abort hijack disabled.  Could not write 8 bytes to %p.", &abort);
		return;
	}
	
	HijackDbgPrint("Abort hijack engaged.  abort() = %p, patched at %p, hijacked to %p", &abort, patchAt, &HijackedAbort);