Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Bug, Crash, XP] kernel32.dll not redirected to progwrp.dll in its LoadLibrary(). Causing to can't create CrashDumps, etc. (#crashpad_client_win, InitializeProcThreadAttributeList, Err: 0x47E) #323

Closed
IDA-RE-things opened this issue Mar 5, 2024 · 8 comments
Closed

[Bug, Crash, XP] kernel32.dll not redirected to progwrp.dll in its LoadLibrary(). Causing to can't create CrashDumps, etc. (#crashpad_client_win, InitializeProcThreadAttributeList, Err: 0x47E) #323

IDA-RE-things opened this issue Mar 5, 2024 · 8 comments

Comments

@IDA-RE-things
Copy link

IDA-RE-things commented Mar 5, 2024 •
edited
Loading

Originally posted by @IDA-RE-things in #318 (comment)
Same error on WinXp x86 with v122 (and earler) and without any additional flags. Just starting Chrome.exe.
Or on other machine start Chrome_proxy.exe, than do something with UI, and it crashes with error.
debug.log in English:

[0305/195254.482:ERROR:crashpad_client_win.cc(476)] InitializeProcThreadAttributeList (size): The specified program requires a newer version of Windows. (0x47E)
[0305/195306.311:ERROR:crashpad_client_win.cc(144)] crash server failed to launch, self-terminating

"The specified program requires a newer version of Windows. (0x47E)"
--WTF ?
Ok... I'm go to source code and found this file:
\third_party\crashpad\crashpad\client\crashpad_client_win.cc

Then found this line some code above before error happened:
GET_FUNCTION(L"kernel32.dll", ::InitializeProcThreadAttributeList);
So the code trying to load the function from original kernel32.dll, without your (@win32ss) API-wrapper progwrp.dll, resulting in error ?

Originally posted by @IDA-RE-things in #318 (comment)

UPD: have seen inside -- currently its done only for "dxgi.dll"
@IDA-RE-things IDA-RE-things changed the title [Bug] All dynamically calls from Chrome by Loadlibrary() for kernel32.dll etc wrapped dlls, must be catched by wrapper to itself. [Bug] All dynamically calls from Chrome by LoadLibrary() for kernel32.dll etc wrapped dlls, must be catched by wrapper to itself. Mar 5, 2024
@IDA-RE-things IDA-RE-things changed the title [Bug] All dynamically calls from Chrome by LoadLibrary() for kernel32.dll etc wrapped dlls, must be catched by wrapper to itself. [Bug] All dynamically calls from Chrome by LoadLibrary() for kernel32.dll etc wrapped dlls, must be catched by wrapper to itself. Else it causes random crashes/issues Mar 5, 2024
This was referenced Mar 6, 2024
Closed
Closed
@IDA-RE-things IDA-RE-things changed the title [Bug] All dynamically calls from Chrome by LoadLibrary() for kernel32.dll etc wrapped dlls, must be catched by wrapper to itself. Else it causes random crashes/issues [Bug] All dynamically calls from Chrome by LoadLibrary() for kernel32.dll etc wrapped dlls, must be catched by wrapper to itself. Else it causes random crashes/issues on WinXP Mar 6, 2024
@IDA-RE-things IDA-RE-things changed the title [Bug] All dynamically calls from Chrome by LoadLibrary() for kernel32.dll etc wrapped dlls, must be catched by wrapper to itself. Else it causes random crashes/issues on WinXP [Bug] All dynamically calls from Chrome by LoadLibrary() for kernel32.dll etc wrapped dlls, must be catched by wrapper to itself (progwrp.dll). Else it causes random crashes/issues on WinXP Mar 6, 2024
@IDA-RE-things IDA-RE-things changed the title [Bug] All dynamically calls from Chrome by LoadLibrary() for kernel32.dll etc wrapped dlls, must be catched by wrapper to itself (progwrp.dll). Else it causes random crashes/issues on WinXP [Bug] All dynamically calls from Chrome by LoadLibrary() for kernel32.dll etc wrapped dlls (looking then for new API functions), must be catched by wrapper to itself (progwrp.dll). Else it causes random crashes/issues on WinXP Mar 6, 2024
@IDA-RE-things IDA-RE-things changed the title [Bug] All dynamically calls from Chrome by LoadLibrary() for kernel32.dll etc wrapped dlls (looking then for new API functions), must be catched by wrapper to itself (progwrp.dll). Else it causes random crashes/issues on WinXP [Bug,Cause] All dynamically calls from Chrome by LoadLibrary() for kernel32.dll etc wrapped dlls (looking then for new API functions), must be catched by wrapper to itself (progwrp.dll). Else it causes random crashes/issues on WinXP Mar 6, 2024
@andika207
Copy link

you can edit this long title and shorten it so you keep this repo clean from crap like this.

@IDA-RE-things
Copy link
Author

you can edit this long title and shorten it so you keep this repo clean from crap like this.

Yes, its long. But ok, propose your title to be seen by new reporting bugs people (which is more and more), and to be seen by @win32ss as high priority issue ?

@IDA-RE-things IDA-RE-things changed the title [Bug,Cause] All dynamically calls from Chrome by LoadLibrary() for kernel32.dll etc wrapped dlls (looking then for new API functions), must be catched by wrapper to itself (progwrp.dll). Else it causes random crashes/issues on WinXP [Bug, Cause, Pinned] Wrong handling of kernel32 Vista API, on WinXP, by progwrp.dll. Causing random crashes/issues in many users Mar 6, 2024
@eXPc023
Copy link

eXPc023 commented Mar 6, 2024

XP SP3? Any updates? Personally I just use a SP3 installation media from 2008 and everything runs just fine. Do you have any theme packs that modify your shell32.dll? That's causing issues, making some programs fail to run. For example: If you install Issopack to make your XP look like Vista, you wouldn't be able to start 360Chrome anymore, due to changed base of shell32.dll.
It also made the January 2003 beta of Counter-Strike 1.6 (the latest OS it can run on is XP) fail to run.

@IDA-RE-things
Copy link
Author

IDA-RE-things commented Mar 6, 2024 •
edited
Loading

XP SP3? Any updates? Personally I just use a SP3 installation media from 2008 and everything runs just fine. Do you have any theme packs that modify your shell32.dll?

I don't know for now what is caused initial crash, But while Chrome tryes to create crushdump or something else, It Crashes 2nd time, because its not found this function "InitializeProcThreadAttributeList" via LoadLibrary()/GetProcAddress() in original kernel32.dll, which must be redirected to progwrp.dll. As I have looked inside this dll, At this time progwrp.dll only catches "dxgi.dll" to itself (in LoadLibrary wrapper). All other libs going to its original from \system32.

My initial post with code example:
#323 (comment)

So may be initial crash caused by same issue with LoadLibrary() anywhere else

@IDA-RE-things IDA-RE-things changed the title [Bug, Cause, Pinned] Wrong handling of kernel32 Vista API, on WinXP, by progwrp.dll. Causing random crashes/issues in many users [Bug, Cause, XP] kernel32.dll not redirected to progwrp.dll in LoadLibrary(). Causing to can't create CrashDumps etc Mar 6, 2024
@grof017
Copy link

grof017 commented Mar 6, 2024 •
edited
Loading

[0305/195254.482:ERROR:crashpad_client_win.cc(476)] InitializeProcThreadAttributeList (size): The specified program requires a newer version of Windows. (0x47E)
[0305/195306.311:ERROR:crashpad_client_win.cc(144)] crash server failed to launch, self-terminating

XP SP3 SSE2 here is the same problem.

@IDA-RE-things IDA-RE-things changed the title [Bug, Cause, XP] kernel32.dll not redirected to progwrp.dll in LoadLibrary(). Causing to can't create CrashDumps etc [Bug, Crash, XP] kernel32.dll not redirected to progwrp.dll in its LoadLibrary(). Causing to can't create CrashDumps, etc. (#crashpad_client_win, InitializeProcThreadAttributeList, Err: 0x47E) Mar 6, 2024
@win32ss
Copy link
Owner

win32ss commented Mar 7, 2024

I have now made a change to prevent this from happening again. I had not caught this at first after implementing a limited form of progwrp-based function redirection to reduce the need for me to make redundant patches to third-party repositories (gclient sync constantly reverts changes even with -M or -3 switches).

The problem with InitializeProcThreadAttributeList is that StartupInfo and process functions also need to be modified to work with it. This will be done soon to meet the objectives of progwrp for Applications, but for now the function will have to be ignored below Vista.

@IDA-RE-things
Copy link
Author

Thanks. Waiting for changes.....

@Zero3K Zero3K mentioned this issue Mar 7, 2024
Closed
@IDA-RE-things IDA-RE-things mentioned this issue Mar 8, 2024
Closed
@Zero3K
Copy link

Zero3K commented Mar 9, 2024

A hotfix release was made a couple of hours ago. It fixes this issue amongst others.

This was referenced Mar 9, 2024
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
6 participants
@Zero3K @IDA-RE-things @andika207 @grof017 @win32ss @eXPc023