DOS ain't dead

Discovered a NEW BUG in DPMILD32 (DOSX)

posted by DOS386, 18.12.2009, 03:21


  if ?DPMI10
                test    cs:bEnvFlgs,ENVFL_DONTUSEDPMI1
                jnz     UseStdAlloc
;---------------------- some apps have to be loaded at their ImageBase
;---------------------- although relocs are NOT stripped!


Excellent "design"


                test    [edx.IMAGE_NT_HEADERS.FileHeader.Characteristics],IMAGE_FILE_DLL
                jz              @F
;---------------------- for dlls dont use the prefered load address unless
;---------------------- relocs are stripped or DPMILDR=1024 is set
                test    cs:bEnvFlgs2, ENVFL2_USEPREFADDR
                jnz     @F
                test    [edx.IMAGE_NT_HEADERS.FileHeader.Characteristics],IMAGE_FILE_RELOCS_STRIPPED
                jz              UseStdAlloc
@@:
                mov     ebx, [edx.IMAGE_NT_HEADERS.OptionalHeader.ImageBase]
                mov     ecx, eax
                mov     edx, 1
                push    eax
                mov     ax, 0504h
                int     31h
                pop     eax
                jc              UseStdAlloc
                mov     xmemhdl, esi
                mov     edi, ebx
                jmp     allocok
UseStdAlloc:
  endif


test edx.IMAGE_NT_HEADERS.FileHeader.Characteristics],IMAGE_FILE_RELOCS_STRIPPED

is faulty, this bit is "not used" in PE. PE loaders in both ME and XP don't look at this bit, they check the directory instead.

So the correct way would be:

1. Peek both directory entries
2. If both are ZERO, assume "IMAGE_FILE_RELOCS_STRIPPED"
3. If RVA is valid and (size is >=8 and divisible by 4), assume "relox are avaiable"
4. Otherwise give up "broken relox, can't load"

---
This is a LOGITECH mouse driver, but some software expect here
the following string:*** This is Copyright 1983 Microsoft ***

Complete thread:

• [BUG] unreadable reloXection deadlocks DPMILD32 - DOS386, 12.06.2008, 23:58 (DOSX)
  • BUG? What BUG? - Japheth, 13.06.2008, 08:40
    • BUG? What BUG? - DOS386, 14.06.2008, 15:02
      • BUG? What BUG? - Japheth, 14.06.2008, 15:57
        • 1. Closed: NOT a BUG | 2. Closed: NOT a BUG | 3. Closed: NB - DOS386, 19.06.2008, 09:04
          • 1. Closed: NOT a BUG | 2. Closed: NOT a BUG | 3. Closed: NB - DOS386, 19.06.2008, 09:06
          • 1. Closed: NOT a BUG | 2. Closed: NOT a BUG | 3. Closed: NB - Japheth, 19.06.2008, 10:29
            • 1. Closed: NOT a BUG | 2. Closed: NOT a BUG | 3. Closed: NB - DOS386, 20.06.2008, 09:51
            • Discovered a NEW BUG in DPMILD32 - DOS386, 18.12.2009, 03:21
              • Discovered a NEW BUG in DPMILD32 - Japheth, 19.12.2009, 07:44
                • Discovered a NEW BUG in DPMILD32 - DOS386, 19.12.2009, 14:04