The previous post in this series outlined how KiUserApcDispatcher operates for the purposes of enabling user mode APCs. Unlike KiUserExceptionDispatcher, which is expected to modify the return information from the context of an interrupt (or exception) in kernel mode, KiUserApcDispatcher is intended to operate on the return context of an active system call.
In this vein, the third kernel mode to user mode NTDLL “callback” that we shall be investigating, KiRaiseUserExceptionDispatcher, is fairly similar. Although in some respects akin to KiUserExceptionDispatcher, at least relating to raising an exception in user mode on the behalf of a kernel mode caller, the KiRaiseUserExceptionDispatcher “callback” really has more in common with KiUserApcDispatcher from a usage and implementation standpoint. It also so happens that the implementation of this callback routine, which is quite simple, is completely representable in C, as a standard calling convention is used.
KiRaiseUserExceptionDispatcher is used if a system call wishes to raise an exception in user mode instead of simply return an NTSTATUS, as is the standard convention. It simply constructs a standard exception record using a supplied status code (which must be written to a well-known location in the current thread’s TEB beforehand), and passes the exception to RtlRaiseException (the same routine that is used internally by the Win32 RaiseException API).
This is a fairly atypical scenario, as most errors (including bad pointer parameters) will simply result in an appropriate status code being returned by the system call, such as STATUS_ACCESS_VIOLATION.
The one place the does currently use the services of KiRaiseUserExceptionDispatcher is NtClose, the system service responsible for closing handles (which implements the Win32 CloseHandle API). When a debugger is attached to a process and a protected handle (as set by a call to SetHandleInformation with HANDLE_FLAG_PROTECT_FROM_CLOSE) is passed to NtClose, then a STATUS_HANDLE_NOT_CLOSABLE exception is raised to user mode via KiRaiseUserExceptionDispatcher. For example, one might see the following when trying to close a protected handle with a debugger attached:
(2600.1994): Unknown exception - code c0000235 (first chance) (2600.1994): Unknown exception - code c0000235 (second chance) ntdll!KiRaiseUserExceptionDispatcher+0x3a: 00000000`776920e7 8b8424c0000000 mov eax,dword ptr [rsp+0C0h] 0:000> !error c0000235 Error code: (NTSTATUS) 0xc0000235 (3221226037) - NtClose was called on a handle that was protected from close via NtSetInformationObject. 0:000> k RetAddr Call Site 00000000`7746dadd ntdll!KiRaiseUserExceptionDispatcher+0x3a 00000000`01001955 kernel32!CloseHandle+0x29 00000000`01001e60 TestApp!wmain+0x35 00000000`7746cdcd TestApp!__tmainCRTStartup+0x120 00000000`7768c6e1 kernel32!BaseThreadInitThunk+0xd 00000000`00000000 ntdll!RtlUserThreadStart+0x1d
The exception can be manually continued in a debugger to allow the program to operate after this occurs, though such a bad handle reference is typically indicative of a serious bug.
A similar behavior is activated if a program is being debugged under Application Verifier and an invalid handle is closed. This behavior of raising an exception on a bad handle closure attempt is intended as a debugging aid, since most programs do not bother to check the return value of CloseHandle.
Incidentally, bad kernel handle closure references like this in kernel mode will result in a bugcheck instead of simply raising an exception that can be caught. Drivers do not have the “luxury” of continuing when they touch a bad handle, except when probing a user handle, of course. (Old versions of Process Explorer used to bring down the box with a bugcheck due to this, for instance, if you tried to close a protected handle. This bug has fortunately since been fixed.)
Next time, we’ll take a look at KiUserCallbackDispatcher, which is used to a great degree by win32k.sys.
Tags: Exceptions, Internals, NTDLL
Interesting. But do you have an idea why ntdll!NtClose is actually implemented this way? It could just as well receive a STATUS_ACCESS_VIOLATION as the return value from the system call and call RtlRaiseException itself. I do not quite see the point why the kernel wants to initiate the exception throwing itself…
NtClose only uses exceptions for an invalid handle or for a protected handle, and only then when the auxiliary conditions (avrf or a debugger attached) are also met. The reason why it can be set to raise an exception instead of how it (usually) simply returns the status value is simply that nobody checks the return value of NtClose or CloseHandle.
If you throw an exception while the debugger is attached, it will get noticed. Returning STATUS_INVALID_HANDLE from NtClose is almost certain to be ignored. In other words, it is a debugging aid.
Oh, and the system call stub code is assumed to be the same for all system calls. This is why there is no special code user mode side in NtClose to initiate the exception. The raise user exception facility is a generic one that could be used by any system call, though currently only NtClose makes use of it.
[…] Nynaeve Adventures in Windows debugging and reverse engineering. « A catalog of NTDLL kernel mode to user mode callbacks, part 4: KiRaiseUserExceptionDispatcher […]
[…] KiRaiseUserExceptionDispatcher […]
I see — avoiding special stub code makes sense. Thanks for the explanation. (And of course I meant STATUS_INVALID_HANDLE, not STATUS_ACCESS_VIOLATION, sorry for that).