search

mohitsachan / appstract

Automatically exported from code.google.com/p/appstract
0 stars 0 forks source link

Support for managed targets is broken #18

Open GoogleCodeExporter opened 8 years ago

GoogleCodeExporter commented 8 years ago 
Invoking the main method of the target application is broken. It's assumed that 
invoking any method from any assembly other than the injected ones, is also 
broken.

When loading an assembly the CLR requests registry keys which the virtual 
registry isn't able to provide. These are all related to policies which the CLR 
needs to apply on the assembly.

The problem is tracked down to (for example) the following key: 
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default
Running with administrator privileges, it's possible to get handles until the 
Fusion subkey. Trying to get a handle to PublisherPolicy and beyond always 
results in ERROR_FILE_NOT_FOUND, even if these keys are visible and accessible 
with the regedit utility. The result is the same for both C# and native C++.

A possible cause for this issue would be that the CLR uses custom options and 
custom access rights matching the original security descriptor. For example, 
when querying such policy keys the CLR uses the custom access rights 0x20119. 
While the engine always uses default access rights.

Original issue reported on code.google.com by simon_al...@hotmail.com on 16 Jun 2010 at 6:15

GoogleCodeExporter commented 8 years ago 
It seems to be impossible to fix this issue with the current API hooks.

It needs to be investigated which COM functions are called by the CLR when 
loading assemblies, and those should be allowed to run transparent through the 
virtualization engine.

Original comment by simon_al...@hotmail.com on 6 Dec 2010 at 6:19