"Rejecting IJW module" exception injecting into .net

[rob191]

When injecting any c++ dll via DetourCreateProcessWithDlls into a .net 2 executable that is configured with both .net 2 and .net 4 as supported runtimes, the clr throws exception code e0434352 (error "ERR: Rejecting IJW module built against v2.0.50727 because it could be loaded into another runtime in this process.") and the program terminates. The same exe will load just fine with detours if the useLegacyV2RuntimeActivationPolicy option is set to true in the .net exe's .config file. The clr function throwing the error and terminating the process is clr!PEFile::CheckForDisallowedInProcSxSLoadWorker and if that function is bypassed then the exe will load properly with detours. Other methods of injecting the same dll using createremotethread or queueapc do not cause any issue and the exe loads fine.

I assume the issue has to do with the IAT method of injecting the dll but I am having trouble pinpointing the exact reason or modification from detours causing the issue to see if it can be corrected.

This is easily reproduced with the detours withdll exe, simple32.dll and an appropriate .net app to inject into. I have attached a sample project. If you build it in release mode and run "withdll.exe /d:simple32.dll DotNetAppTest.exe" you should reproduce the crash.

DotNetAppTest.zip

[sonyps5201314]

you can try detours in my project to fix this problem,
https://developercommunityapi.westus.cloudapp.azure.com/storage/temp/11277-filetracker-bug-fix-src.zip,
I hope official will merge my modification to official repo.

[rob191]

you can try detours in my project to fix this problem,

I have built your version and it does appear to fix the issue. I cannot read the comments in your code, there appears to be an encoding issue. Would you mind explaining a little about what the issue with .net was and how you fixed it? It appears that detours was not adding all of the appropriate information to the modified import table, is that correct?

[rob191]

I was able to open up your changes with chinese encoding and translate your comments. I will test the changes more but it does seem like they should be a welcome contribution to the trunk provided there are no issues.

[jgdrg]

Hi. I'm seeing the same issue. The link posted by sonyps5201314 no longer works. Can anyone point me at the zip file or the code change that needs to be made?

[rob191]

Lucky for you I'm a hoarder :P found it still in my downloads folder and uploaded to dropbox https://www.dropbox.com/s/ko4wrjclmklfyrr/11277-filetracker-bug-fix-src.zip?dl=1 The modifications have been running on hundreds of thousands of endpoints with no issues and the problem resolved. Why nobody is merging these fixes into the repository is beyond me.

[jgdrg]

Thanks for that. I notice that there are multiple changes and comments are all in Chinese. Would you know which of the changes fixed the "Rejecting IJW module" exception for .Net 2 executable that is configured with both .Net 2 and .nNet 4 as supported runtimes?

[bgianfo]

@rob191, @sonyps5201314 if would you send a PR we would be happy to work on getting it merged. As far as I can tell a PR was never submitted, and hence we don't know anything about these private fixes. :)

[riverar]

11277-filetracker-bug-fix-src.zip

Adding ZIP directly here, to account for potential Dropbox link death.

[bgianfo]

Uh I don't think I, or anyone should touch that zip with a 10 foot pole :) I hope @sonyps5201314, as the assumed original author of the changes, would be willing to submit a patch, as that's the only valid way to accept those changes.

[riverar]

Was just mirroring it before it vanished for visitors, no action needed on your part. The ZIP has no executable images. Agree without @sonyps5201314 there are some unresolved legal issues.