How to get the Address of a ntdll function when it's loaded twice? - ntdll

I intend to hook into a ntdll function ZwTerminateProcess, but am having a problem with x64, because if a x86 app is running in a windows x64 , it is loaded with two ntdlls:
One from System32 path and the other one from SysWOW64.
Until here I have no problems, except: the first ntdll(system32) don't show up when I list dlls using CreateToolhelp32Snapshot() or EnumProcessModules() and when I use GetModuleHandle() the return is the hModule from the second ntdll(SysWOW64).
I was thinking that maybe the first dll was loaded with LOAD_LIBRARY_AS_DATAFILE flag but if it were the case the app would not be able to use the function from the first ntdll(System32). I have tried to hook the ZwTerminateProcess() in the second ntdll but it doesn't work. Does anyone have some idea of how to help me?
Please let me know if more clarification is required.
Thank you, Douglas.

Related

How do I use sqlite3_key()?

I built sqlcipher with mingw.
I wanted to access sqlite(DB) encrypted in mfc(C++).
So, sqlite3_open () was applied correctly. but, sqlite3_open() did not return a result, so I wanted to use sqlite3_key().
When using sqlite3_key(), sqlite3_key() is not defined.
How do I use sqlite3_key()? Or how do I activate sqlite3_key() function?
sqlite3_open(...) will return a result code. If you are not receiving SQLITE_OK as a result, you may wish to investigate the error code with sqlite3_errcode(...) Alternatively, you might review your build process to make sure everything is compiling properly.

How to know, if running on device or simulator in react native

To distinguish between development mode and production mode in react native there is the __DEV__ constant defined, when Debug = True.
Is there a similar constant defined, that lets me know within the code, if the code is running on the device or in the simulator?
Where else could I get this kind of information from.
You can use this package, then just do :
console.log(DeviceInfo.getModel()); // it returns 'Simulator'
Since G. Hamaide's answer was posted, the DeviceInfo package has added the method isEmulator.
DeviceInfo.isEmulator()
there's a caveat here, DeviceInfo.isEmulator() returns a promise, so if you use if(DeviceInfo.isEmulator()), it'll return true even if running on a real device.
Use DeviceInfo.isEmulatorSync() or if(await DeviceInfo.isEmulator()).

The type 'foo.Info.AgentDetails' exists in both 'foo.dll' and 'foo.dll'

In my asp.net web application, one of my page, I am storing a list of objects(List<AgentDetails>) to ViewState. After that when I try to get it back as (List<AgentDetails>)ViewState["ViewStateAgentDetails"], i gets an error like
The type 'foo.Info.AgentDetails' exists in both 'foo.dll' and 'foo.dll'
I can't understand what is happening here.
I got stuck with this issue.
Could anybody help me out of this?
Thanks in advance.
If i interpret it correctly from answer to my comment, i can see that there might be some other DLL , that can have different dll name says bar.dll, but ultimately has same namespace and class name. So to fix this , find that second DLL, and use extern or change namespace to solve this error.
More explanation - http://blogs.msdn.com/b/abhinaba/archive/2005/11/30/498278.aspx
How do you allow two DLL's with same namespace.class to exist in the same application?

ASP.Net || iTextSharp in dotnet cannot use iTextAsian

I am having trouble with iTextAsian which cause me done nothing but finding solution all this week, it would be great if I can have the solution here.
My situation is I have a project which is using iTextSharp for a while, I had two blocks of code as following, please note that both of them are worked for me
Block 1:
Private Function aFunc() as returnType
iTextSharp.text.io.StreamUtil.AddToResourceSearch(
System.Reflection.Assembly.Load("iTextAsian")
)
Dim font As Font = MyPDF.GetFont
End Function
Protected Friend Shared Function GetFont() As Font
Return New Font(
BaseFont.CreateFont(
"STSong-Light",
"UniGB-UCS2-H",
BaseFont.NOT_EMBEDDED
)
)
End Function
Block 2 (current)
Public Shared Function GetChineseFont() As iTextSharp.text.Font
iTextSharp.text.io.StreamUtil.AddToResourceSearch(
System.Reflection.Assembly.Load("iTextAsian")
)
Return New Font(
BaseFont.CreateFont(
"STSong-Light",
"UniGB-UCS2-H",
BaseFont.NOT_EMBEDDED
)
)
End Function
I am using iTextAsia2.1 and it used to work fine for me, but it start to pop me ""Font 'STSong-Light' with 'UniGB-UCS2-H' is not recognized."" exception on my development server since last week.
The weirdest thing is the version of my website between dev and production server are same, but this block of code worked only on production server, I am wondering whats the matter and I am afraid that one day this exception will appear on my production server.
Please suggest me some solution please.
Thanks for your time!
Are you taken update?
The error will come when some clash between older version and newer version or font missing etc. please check this link.
http://www.excindex.com/web/831818.html
http://www.csharpcode.info/ask-235324.html
http://itext-general.2136553.n4.nabble.com/Asian-font-not-recognized-after-update-td2991134.html
http://stderr.org/doc/libitext-java-doc/www/tutorial/ch09.html
Before you start anything, What I think, you just download your production all dll and put in your local development. Check wheather the issue solved
Sorry all, I finally figure it out, its because the following block should not contains in a Shared function
iTextSharp.text.io.StreamUtil.AddToResourceSearch(
System.Reflection.Assembly.Load("iTextAsian")
)
I now called this line in Application_Start of global.asax and the problem is solved, thanks for your time and suggestions!

Websphere & Tivoli: NPE while trying to create PDAuthorizationContext

I am getting the following error when I try to start my Application...
[java.lang.IllegalStateException: java.lang.NullPointerException^M
at com.tivoli.pd.jutil.kb$1.run(kb$1.java:41)^M
at java.security.AccessController.doPrivileged(AccessController.java:229
)^M
at com.tivoli.pd.jutil.kb.c(kb.java:141)^M
at com.tivoli.pd.jutil.kb.(kb.java:56)^M
at com.tivoli.pd.jutil.PDContext.(PDContext.java:76)^M
at com.tivoli.pd.jazn.PDAuthorizationContext.(PDAuthorizationConte
xt.java:66)^M
I double checked the config file was accessible and I could read it. The code I am using looks as follows...
aC = new PDAuthorizationContext(cFile);
Is there a way to get more information on what is causing the NPE?
More information!!!
After debuging a bit, it appears the issue comes from this code (they use progaurd so it is a little hard to be 100% confident)...
Certificate[] arrayOfCertificate1 = ((KeyStore)???).getCertificateChain("DefaultID");
//Throws Null pointer (presumably because array is null)
Certificate localCertificate1 = arrayOfCertificate1[0];
EVEN MORE INFO
This appears to be some kind of dependency conflict (guess), because if I just create a sample App using PDAuthorizationContext it works fine.
Problem was related to the PD.jar version that I was using. Although I thought I was using one version I was using another. This was because on version was registered in my WebSphere library (under build path in eclipse). Once the proper library was introduced everything worked.

Resources