Neo23x0 / Raccine

A Simple Ransomware Vaccine
The Unlicense
942 stars 123 forks source link

Unable to kill / invalid handle #77

Closed Neo23x0 closed 3 years ago

Neo23x0 commented 3 years ago

@Eran-YT

There's a problem in blocking mode. Raccine is unable to end itself.

Screenshot 2020-10-27 093019

Caused at this position by an invalid handle.

Screenshot 2020-10-27 093638

Screenshot 2020-10-27 093609

JohnLaTwC commented 3 years ago

The crash is due to a double-close on the wrapped process handle returned from createChildProcessWithDebugger. When this function is about to return, the destructor is called on ProcessHandleWrapper and ThreadHandleWrapper. The destructor calls Close() which calls CloseHandle on the process handle. Later in main when hProcess goes out of scope, the destructor is called again which results in the double-close on handle.

    ~HandleWrapper()
    {
        Close();
    }

    void Close()
    {
        if (m_handle != traits::InvalidValue) {
            traits::Close(m_handle);
            m_handle = traits::InvalidValue;
        }
    }

...
struct ProcessHandleTraits
{
    typedef HANDLE HandleType;
    inline static const HANDLE InvalidValue = NULL;

    static void Close(HANDLE value)
    {
        CloseHandle(value); <<<<<<<<<<<<<<<<<<
    }
};

The phProcess param is declared as pass by reference so need to understand why a temp ProcessHandleWrapper is allocated and destroyed during createChildProcessWithDebugger.

DWORD createChildProcessWithDebugger(std::wstring command_line,
                                    DWORD dwAdditionalCreateParams,
                                    ProcessHandleWrapper& phProcess,
                                    ThreadHandleWrapper& phThread)

image