none
uiautomationcore!MessageBuilder::WriteEventArgs has bug??? RRS feed

  • 问题

  • can somebody review code of the function uiautomationcore!MessageBuilder::WriteEventArgs

    dll version as below:

    Loaded symbol image file: uiautomationcore.dll
        Image path: C:\Windows\System32\uiautomationcore.dll
        Image name: uiautomationcore.dll
        Browse all global symbols  functions  data
        Timestamp:        Tue Jul 14 09:10:53 2009 (4A5BDB1D)
        CheckSum:         0009856F
        ImageSize:        0008C000
        File version:     7.0.0.0
        Product version:  6.1.7600.16385
        File flags:       0 (Mask 3F)
        File OS:          40004 NT Win32
        File type:        2.0 Dll
        File date:        00000000.00000000
        Translations:     0409.04b0
        CompanyName:      Microsoft Corporation
        ProductName:      Microsoft® Windows® Operating System
        InternalName:     UIAutomationCore.dll
        OriginalFilename: UIAutomationCore.dll
        ProductVersion:   6.1.7600.16385
        FileVersion:      7.0.0.0 (win7_rtm.090713-1255)
        FileDescription:  Microsoft UI Automation Core
        LegalCopyright:   © Microsoft Corporation. All rights reserved.


    I disassembly this function, and found a bug.

    HRESULT MessageBuilder::WriteEventArgs(struct xxx* p1, unsigned int p2)
    {
    	MessageBuilder* pThis = this;
    	
    	HRESULT hr;
    
    	unsigned int type = [p1+0]; // seems param count...
    	hr = this->WriteByte(type);
    	if ( FAILED(hr) )
    		return hr;
    
    	hr = this->WriteAutomationId([ebx+4], 2);
    	if ( FAILED(hr) )
    		return hr;
    	
    	switch ( type )
    	{
    		case 0:
    		{
    			// do nothing
    			hr = S_OK;
    		}
    		break;
    		case 1:
    		{
    			hr = this->WriteAutomationId([p1+8], 0);
    			if ( FAILED(hr) )
    				break;
    			
    			hr = this->WriteObj();
    			if ( FAILED(hr) )
    				break;
    			
    			hr = this->WriteObj();
    		}
    		break;
    		case 2:
    		{
    			hr = this->WriteByte([p1+8]);
    			if ( FAILED(hr) )
    				break;
    			
    			hr = this->WriteIntArray([p1+0Ch], [p1+10h]);
    		}
    		break
    		case 3:
    		{
    			hr = this->WriteByte([p1+8]);
    			if ( FAILED(hr) )
    				break;
    			
    			hr = this->WriteDouble((double)[p1+10h]);				
    		}
    		break;
    		case 4:
    		{
    			hr = this->WriteIntArray([p1+8], [p1+0Ch]);
    		}
    		break;
    		default:
    		{
    			Error::ProtocolError(L"Recived invalid enum for EventArgsType");
    		}
    		break;
    	}
    
    	return hr;
    }

    when type is not in [0-4], return value is undefined. maybe I'm wrong, but can anybody verify this ? thanks in advance.

    assembly code

    uf uiautomationcore!MessageBuilder::WriteEventArgs
    uiautomationcore!MessageBuilder::WriteEventArgs:
    63ad1fe5 8bff            mov     edi,edi
    63ad1fe7 55              push    ebp
    63ad1fe8 8bec            mov     ebp,esp
    63ad1fea 51              push    ecx
    63ad1feb 53              push    ebx
    63ad1fec 8b5d08          mov     ebx,dword ptr [ebp+8]
    63ad1fef 56              push    esi
    63ad1ff0 57              push    edi
    63ad1ff1 ff33            push    dword ptr [ebx]
    63ad1ff3 8bf1            mov     esi,ecx
    63ad1ff5 8975fc          mov     dword ptr [ebp-4],esi
    63ad1ff8 e803ebffff      call    uiautomationcore!MessageBuilder::WriteByte (63ad0b00)
    63ad1ffd 85c0            test    eax,eax
    63ad1fff 7c78            jl      uiautomationcore!MessageBuilder::WriteEventArgs+0x94 (63ad2079)  Branch
    
    uiautomationcore!MessageBuilder::WriteEventArgs+0x1c:
    63ad2001 8b4304          mov     eax,dword ptr [ebx+4]
    63ad2004 6a02            push    2
    63ad2006 50              push    eax
    63ad2007 8bce            mov     ecx,esi
    63ad2009 e8d9edffff      call    uiautomationcore!MessageBuilder::WriteAutomationId (63ad0de7)
    63ad200e 85c0            test    eax,eax
    63ad2010 7c67            jl      uiautomationcore!MessageBuilder::WriteEventArgs+0x94 (63ad2079)  Branch
    
    uiautomationcore!MessageBuilder::WriteEventArgs+0x2d:
    63ad2012 8b03            mov     eax,dword ptr [ebx]
    63ad2014 83e800          sub     eax,0
    63ad2017 745e            je      uiautomationcore!MessageBuilder::WriteEventArgs+0x92 (63ad2077)  Branch
    
    uiautomationcore!MessageBuilder::WriteEventArgs+0x34:
    63ad2019 48              dec     eax
    63ad201a 7464            je      uiautomationcore!MessageBuilder::WriteEventArgs+0x9b (63ad2080)  Branch
    
    uiautomationcore!MessageBuilder::WriteEventArgs+0x37:
    63ad201c 48              dec     eax
    63ad201d 7439            je      uiautomationcore!MessageBuilder::WriteEventArgs+0x73 (63ad2058)  Branch
    
    uiautomationcore!MessageBuilder::WriteEventArgs+0x3a:
    63ad201f 48              dec     eax
    63ad2020 7417            je      uiautomationcore!MessageBuilder::WriteEventArgs+0x54 (63ad2039)  Branch
    
    uiautomationcore!MessageBuilder::WriteEventArgs+0x3d:
    63ad2022 48              dec     eax
    63ad2023 740c            je      uiautomationcore!MessageBuilder::WriteEventArgs+0x4c (63ad2031)  Branch
    
    uiautomationcore!MessageBuilder::WriteEventArgs+0x40:
    63ad2025 6838a6aa63      push    offset uiautomationcore!`string' (63aaa638)
    63ad202a e85dfbfeff      call    uiautomationcore!Error::ProtocolError (63ac1b8c)
    63ad202f eb48            jmp     uiautomationcore!MessageBuilder::WriteEventArgs+0x94 (63ad2079)  Branch
    
    uiautomationcore!MessageBuilder::WriteEventArgs+0x4c:
    63ad2031 ff730c          push    dword ptr [ebx+0Ch]
    63ad2034 ff7308          push    dword ptr [ebx+8]
    63ad2037 eb33            jmp     uiautomationcore!MessageBuilder::WriteEventArgs+0x87 (63ad206c)  Branch
    
    uiautomationcore!MessageBuilder::WriteEventArgs+0x54:
    63ad2039 ff7308          push    dword ptr [ebx+8]
    63ad203c 8bce            mov     ecx,esi
    63ad203e e8bdeaffff      call    uiautomationcore!MessageBuilder::WriteByte (63ad0b00)
    63ad2043 85c0            test    eax,eax
    63ad2045 7c32            jl      uiautomationcore!MessageBuilder::WriteEventArgs+0x94 (63ad2079)  Branch
    
    uiautomationcore!MessageBuilder::WriteEventArgs+0x62:
    63ad2047 dd4310          fld     qword ptr [ebx+10h]
    63ad204a 51              push    ecx
    63ad204b 51              push    ecx
    63ad204c 8bce            mov     ecx,esi
    63ad204e dd1c24          fstp    qword ptr [esp]
    63ad2051 e8dceaffff      call    uiautomationcore!MessageBuilder::WriteDouble (63ad0b32)
    63ad2056 eb1b            jmp     uiautomationcore!MessageBuilder::WriteEventArgs+0x8e (63ad2073)  Branch
    
    uiautomationcore!MessageBuilder::WriteEventArgs+0x73:
    63ad2058 ff7308          push    dword ptr [ebx+8]
    63ad205b 8bce            mov     ecx,esi
    63ad205d e89eeaffff      call    uiautomationcore!MessageBuilder::WriteByte (63ad0b00)
    63ad2062 85c0            test    eax,eax
    63ad2064 7c13            jl      uiautomationcore!MessageBuilder::WriteEventArgs+0x94 (63ad2079)  Branch
    
    uiautomationcore!MessageBuilder::WriteEventArgs+0x81:
    63ad2066 ff7310          push    dword ptr [ebx+10h]
    63ad2069 ff730c          push    dword ptr [ebx+0Ch]
    
    uiautomationcore!MessageBuilder::WriteEventArgs+0x87:
    63ad206c 8bce            mov     ecx,esi
    63ad206e e8b4ebffff      call    uiautomationcore!MessageBuilder::WriteIntArray (63ad0c27)
    
    uiautomationcore!MessageBuilder::WriteEventArgs+0x8e:
    63ad2073 85c0            test    eax,eax
    63ad2075 7c02            jl      uiautomationcore!MessageBuilder::WriteEventArgs+0x94 (63ad2079)  Branch
    
    uiautomationcore!MessageBuilder::WriteEventArgs+0x92:
    63ad2077 33c0            xor     eax,eax
    
    uiautomationcore!MessageBuilder::WriteEventArgs+0x94:
    63ad2079 5f              pop     edi
    63ad207a 5e              pop     esi
    63ad207b 5b              pop     ebx
    63ad207c c9              leave
    63ad207d c20800          ret     8
    
    uiautomationcore!MessageBuilder::WriteEventArgs+0x9b:
    63ad2080 8b4308          mov     eax,dword ptr [ebx+8]
    63ad2083 6a00            push    0
    63ad2085 50              push    eax
    63ad2086 8bce            mov     ecx,esi
    63ad2088 e85aedffff      call    uiautomationcore!MessageBuilder::WriteAutomationId (63ad0de7)
    63ad208d 85c0            test    eax,eax
    63ad208f 7ce8            jl      uiautomationcore!MessageBuilder::WriteEventArgs+0x94 (63ad2079)  Branch
    
    uiautomationcore!MessageBuilder::WriteEventArgs+0xac:
    63ad2091 ff750c          push    dword ptr [ebp+0Ch]
    63ad2094 8b4dfc          mov     ecx,dword ptr [ebp-4]
    63ad2097 83ec10          sub     esp,10h
    63ad209a 8bfc            mov     edi,esp
    63ad209c 8d7310          lea     esi,[ebx+10h]
    63ad209f a5              movs    dword ptr es:[edi],dword ptr [esi]
    63ad20a0 a5              movs    dword ptr es:[edi],dword ptr [esi]
    63ad20a1 a5              movs    dword ptr es:[edi],dword ptr [esi]
    63ad20a2 a5              movs    dword ptr es:[edi],dword ptr [esi]
    63ad20a3 e86efaffff      call    uiautomationcore!MessageBuilder::WriteObj (63ad1b16)
    63ad20a8 85c0            test    eax,eax
    63ad20aa 7ccd            jl      uiautomationcore!MessageBuilder::WriteEventArgs+0x94 (63ad2079)  Branch
    
    uiautomationcore!MessageBuilder::WriteEventArgs+0xc7:
    63ad20ac ff750c          push    dword ptr [ebp+0Ch]
    63ad20af 8b4dfc          mov     ecx,dword ptr [ebp-4]
    63ad20b2 83ec10          sub     esp,10h
    63ad20b5 8bfc            mov     edi,esp
    63ad20b7 8d7320          lea     esi,[ebx+20h]
    63ad20ba a5              movs    dword ptr es:[edi],dword ptr [esi]
    63ad20bb a5              movs    dword ptr es:[edi],dword ptr [esi]
    63ad20bc a5              movs    dword ptr es:[edi],dword ptr [esi]
    63ad20bd a5              movs    dword ptr es:[edi],dword ptr [esi]
    63ad20be e853faffff      call    uiautomationcore!MessageBuilder::WriteObj (63ad1b16)
    63ad20c3 ebae            jmp     uiautomationcore!MessageBuilder::WriteEventArgs+0x8e (63ad2073)  Branch



    • 已编辑 DianDianDie 2016年12月15日 3:55 add comment
    2016年12月15日 3:49

答案

  • >>下面的汇编码是调用WriteEventArgs的地方,如果该函数返回值错误的话,后面的应该也会受到影响,具体啥影响还没看!只是觉得这个函数内部的处理的不够周全!

    hr = this->WriteByte(type);
    if ( FAILED(hr) )
    	return hr;
    

    从这段代码来看,如果范围超过0-4,返回的hr应该为S_OK。类似于Case 0,只是添加了错误处理。应该不会有影响。Error::ProtocolError具体做什么暂时还看不出来。可能会触发exception也可能只是单纯的记录错误。需要查看函数定义才能知道。

    Best Regards,
    Sera Yu


    MSDN Community Support
    Please remember to click "Mark as Answer" the responses that resolved your issue, and to click "Unmark as Answer" if not. This can be beneficial to other community members reading this thread. If you have any compliments or complaints to MSDN Support, feel free to contact MSDNFSF@microsoft.com.

    • 已标记为答案 DianDianDie 2016年12月15日 10:08
    2016年12月15日 9:34

全部回复

  • Hi DianDianDie,

    感谢在MSDN论坛发帖。

    >>when type is not in [0-4], return value is undefined. maybe I'm wrong, but can anybody verify this ? thanks in advance.

    在我看来,返回值并不是不确定的。返回之前,hr会被赋值为WriteAutomationId的结果。并且如果你的值不在0-4的范围内,会触发一个Error::ProtocolError。意味着虽然服务器接收的响应完成,但是有协议错误。所以这并不属于bug。

    希望可以帮助到你。

    -----

    Thanks for posting here.

    This forum is a Chinese forum. If your mother tongue is English, please post on this forum.

    https://social.msdn.microsoft.com/Forums/vstudio/en-US/home?forum=vcgeneral

    In my opinion, the return value is not undefined. Before it returns, it will be set to the result of WriteAutomationId. And if the type is not in [0-4], there will be a Error::ProtocolError which means the response received from the server was complete but indicated a protocol-level error.

    Hope this could be help of you.

    Best Regards,
    Sera Yu


    MSDN Community Support
    Please remember to click "Mark as Answer" the responses that resolved your issue, and to click "Unmark as Answer" if not. This can be beneficial to other community members reading this thread. If you have any compliments or complaints to MSDN Support, feel free to contact MSDNFSF@microsoft.com.

    2016年12月15日 6:44
  • hi,Sera Yu!

    非常感谢回复!
    我看了下uiautomationcore!Error::ProtocolError函数的汇编码,貌似没有啥特殊处理,只是记录了下error!

    逆向能力有限,也许是我没注意到某些地方?
    下面的汇编码是调用WriteEventArgs的地方,如果该函数返回值错误的话,后面的应该也会受到影响,具体啥影响还没看!只是觉得这个函数内部的处理的不够周全!

    uiautomationcore!RemoteEventCallbackProxy::CrossProcess_OnEvent+0x8c:
    63ac3a58 ff760c          push    dword ptr [esi+0Ch]
    63ac3a5b 8d8de8efffff    lea     ecx,[ebp-1018h]
    63ac3a61 57              push    edi
    63ac3a62 e87ee50000      call    uiautomationcore!MessageBuilder::WriteEventArgs (63ad1fe5)
    63ac3a67 85c0            test    eax,eax
    63ac3a69 7caa            jl      uiautomationcore!RemoteEventCallbackProxy::CrossProcess_OnEvent+0x49 (63ac3a15)  Branch
    
    uiautomationcore!RemoteEventCallbackProxy::CrossProcess_OnEvent+0x9f:
    63ac3a6b ff760c          push    dword ptr [esi+0Ch]
    63ac3a6e 8d8de8efffff    lea     ecx,[ebp-1018h]
    63ac3a74 ffb5e0efffff    push    dword ptr [ebp-1020h]
    63ac3a7a 53              push    ebx
    63ac3a7b e8e3e20000      call    uiautomationcore!MessageBuilder::WriteCacheResponse (63ad1d63)
    63ac3a80 85c0            test    eax,eax
    63ac3a82 7c91            jl      uiautomationcore!RemoteEventCallbackProxy::CrossProcess_OnEvent+0x49 (63ac3a15)


    顺便说一句:

    可以说中文啊,真好

    2016年12月15日 8:32
  • >>下面的汇编码是调用WriteEventArgs的地方,如果该函数返回值错误的话,后面的应该也会受到影响,具体啥影响还没看!只是觉得这个函数内部的处理的不够周全!

    hr = this->WriteByte(type);
    if ( FAILED(hr) )
    	return hr;
    

    从这段代码来看,如果范围超过0-4,返回的hr应该为S_OK。类似于Case 0,只是添加了错误处理。应该不会有影响。Error::ProtocolError具体做什么暂时还看不出来。可能会触发exception也可能只是单纯的记录错误。需要查看函数定义才能知道。

    Best Regards,
    Sera Yu


    MSDN Community Support
    Please remember to click "Mark as Answer" the responses that resolved your issue, and to click "Unmark as Answer" if not. This can be beneficial to other community members reading this thread. If you have any compliments or complaints to MSDN Support, feel free to contact MSDNFSF@microsoft.com.

    • 已标记为答案 DianDianDie 2016年12月15日 10:08
    2016年12月15日 9:34

  • 从这段代码来看,如果范围超过0-4,返回的hr应该为S_OK。类似于Case 0,只是添加了错误处理。应该不会有影响。Error::ProtocolError具体做什么暂时还看不出来。可能会触发exception也可能只是单纯的记录错误。需要查看函数定义才能知道。

    就是这里返回了一个S_OK 我觉得不太合理!因为调用Error::ProtocolError
    应该是出错了,至于对后面的影响是啥不清楚,算了,现在先不管了!
    精力有限!

    再次感谢回复!

    2016年12月15日 10:07