Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- // <copyright file="crash_test.cpp" company="Binamuse">
- // Copyright (c) 2007, 2008 All Right Reserved, http://www.binamuse.com/
- //
- // This source is subject to the Microsoft Permissive License.
- // Please see the License.txt file for more information.
- // All other rights reserved.
- //
- // THIS CODE AND INFORMATION ARE PROVIDED "AS IS" WITHOUT WARRANTY OF ANY
- // KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE
- // IMPLIED WARRANTIES OF MERCHANTABILITY AND/OR FITNESS FOR A
- // PARTICULAR PURPOSE.
- //
- // </copyright>
- // <author>Felipe Andres Manzano</author>
- // <email>feliam@binamuse.com</email>
- // <date>2012-09-10</date>
- // <summary>Generate child process with user defined behavior like crash</summary>
- //
- //crash_test.cpp : Defines the entry point for the console application.
- #include "stdafx.h"
- #include "string.h"
- #include <windows.h>
- int _tmain(int argc, TCHAR* argv[])
- {
- DWORD PID;
- PID = GetCurrentProcessId();
- _cwprintf(L"[%6d] Hi!\n",PID);
- // First commandline argument is the "command".
- // It can be "crash" or "spawn".
- if (argc < 2){
- _cwprintf(L"[%6d] No command exiting nicely\n",PID);
- goto bye;
- }
- if (wcscmp(argv[1], L"SPAWN") == 0){
- STARTUPINFO si;
- PROCESS_INFORMATION pi;
- ZeroMemory( &si, sizeof(si) );
- si.cb = sizeof(si);
- ZeroMemory( &pi, sizeof(pi) );
- TCHAR * commandline = (TCHAR*)malloc((wcslen(argv[0])+2)*2); //LEAK
- swprintf(commandline,L"%s \x00\x00", argv[0]);
- for (int i=2;i<argc;i++){
- commandline = (TCHAR*)realloc(commandline, (wcslen(commandline)+wcslen(argv[i])+2) *2);
- wcscat(commandline,argv[i]);
- wcscat(commandline,L" ");
- }
- _cwprintf(L"[%6d] Executing a new instance: <%s>\n", PID, commandline);
- // Start the child process.
- if( CreateProcess( NULL, // No module name (use command line)
- commandline, // Command line
- NULL, // Process handle not inheritable
- NULL, // Thread handle not inheritable
- FALSE, // Set handle inheritance to FALSE
- 0, // No creation flags
- NULL, // Use parent's environment block
- NULL, // Use parent's starting directory
- &si, // Pointer to STARTUPINFO structure
- &pi ) // Pointer to PROCESS_INFORMATION structure
- )
- {
- // Wait until child process exits.
- WaitForSingleObject( pi.hProcess, INFINITE );
- // Close process and thread handles.
- CloseHandle( pi.hProcess );
- CloseHandle( pi.hThread );
- }
- else
- _cwprintf(L"[%6d] CreateProcess failed (%d).\n", PID, GetLastError() );
- goto bye;
- }
- // There are several ways to crash the second argument selects the
- // crashing flavor. (If argc < 3 it will crash anyway)
- // Process should thrw one of the exeption specified here:
- // http://msdn.microsoft.com/en-us/library/windows/desktop/aa363082(v=vs.85).aspx
- _cwprintf(L"[%6d] This is a crashing process!\n",PID);
- //EXCEPTION_ACCESS_VIOLATION
- if (wcscmp(argv[1], L"EXCEPTION_ACCESS_VIOLATION") == 0 ||
- wcscmp(argv[1], L"EXCEPTION_ACCESS_VIOLATION_R") == 0){
- int *p = (int*)0x12345678;
- int value;
- _cwprintf(L"[%6d] Read memory @ %p\n",PID, p);
- value = *p;
- }
- //EXCEPTION_ACCESS_VIOLATION
- if (wcscmp(argv[1], L"EXCEPTION_ACCESS_VIOLATION_W") == 0){
- int *p = (int*)0x12345678;
- _cwprintf(L"[%6d] Write memory @ %p\n",PID,p);
- *p = 0x41424344;
- }
- //EXCEPTION_ACCESS_VIOLATION
- if (wcscmp(argv[1], L"EXCEPTION_ACCESS_VIOLATION_X") == 0){
- _cwprintf(L"[%6d] Executing at not executable memory\n",PID);
- ((void (*)()) ((void*)"notexec"))();
- }
- //EXCEPTION_ARRAY_BOUNDS_EXCEEDED ??
- //EXCEPTION_BREAKPOINT
- if (wcscmp(argv[1], L"EXCEPTION_BREAKPOINT") == 0){
- _cwprintf(L"[%6d] Executing invalid instruction\n",PID);
- __asm { __emit 0xCC;
- };
- }
- //EXCEPTION_FLT_.* ??
- //EXCEPTION_FLT_DIVIDE_BY_ZERO
- if (wcscmp(argv[1], L"EXCEPTION_FLT_DIVIDE_BY_ZERO") == 0){
- float value=0.0;
- _cwprintf(L"[%6d] Division by zero(float) @ %p\n",PID);
- value = 100/value;
- }
- //EXCEPTION_DATATYPE_MISALIGNMENT ??
- //EXCEPTION_ILLEGAL_INSTRUCTION
- if (wcscmp(argv[1], L"EXCEPTION_ILLEGAL_INSTRUCTION") == 0){
- _cwprintf(L"[%6d] Executing invalid instruction\n",PID);
- __asm { __emit 0xff;
- __emit 0xff;
- __emit 0xff;
- };
- }
- //EXCEPTION_IN_PAGE_ERROR ??
- //EXCEPTION_INT_DIVIDE_BY_ZERO
- if (wcscmp(argv[1], L"EXCEPTION_INT_DIVIDE_BY_ZERO") == 0){
- int value=0;
- _cwprintf(L"[%6d] Division by zero @ %p\n",PID);
- value = 100/value;
- }
- //EXCEPTION_INVALID_DISPOSITION ??
- //EXCEPTION_NONCONTINUABLE_EXCEPTION ??
- //EXCEPTION_PRIV_INSTRUCTION
- /*if (wcscmp(argv[1], L"EXCEPTION_PRIV_INSTRUCTION") == 0){
- _cwprintf(L"[%6d] Executing invalid instruction\n",PID);
- __asm { in $0x123, $0x123;}
- }*/
- //EXCEPTION_SINGLE_STEP ??
- //EXCEPTION_STACK_OVERFLOW
- /*if (wcscmp(argv[1], L"EXCEPTION_STACK_OVERFLOW") == 0){
- _cwprintf(L"[%6d] Exausting the stack\n",PID);
- for(;;)
- __asm { pushl 0x12345678; }
- }*/
- //This will loop for ever, used to exercise debugger timeout
- if (wcscmp(argv[1], L"TIMEOUT") == 0){
- _cwprintf(L"[%6d] Looping forever and ever\n",PID);
- for(;;)
- ;
- }
- bye:
- _cwprintf(L"[%6d] Bye!\n",PID);
- return 0;
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement