Problem - GDI+ or WinDbg?

[zedd151]

Win7
got stuck forever inside
invoke GdiplusShutdown,GDItoken

Using Windbg? If not, under which debugger? You did not specify.
If you were running under Windbg, we already determined that Windbg was the problem. Not that call to GdiplusShutdown.

[greenozon]

nope, Olly v2

[greenozon]

IDA 9.1 = OK
Olly 1 stucks as well

is it kind of new anti-dbg trick? :)

[zedd151]

Okay thanks. Now that is very interesting.

You said windows 7.
Is that 32 bit or 64? Home or Pro?

I wonder which OS sinsi was running when he initially encountered this issue.

I am thinking the problem could be OS specific, or even gdiplus version specific...

It ran fine for me under ollydbg 1.10, x32dbg, and 64 bit version under x64dbg, in Windows 10 Professional 64 bit version 22H2.

greenozon, have you experienced any problems running any programs that use gdiplus? Or is this only seen while running inside of those debuggers?

[TimoVJL]

simple way to check a gdiplus.dll version, if import library was used:

Code Select Expand

char szTmp[260];
HMODULE hMod = GetModuleHandle("gdiplus.dll");
GetModuleFileName(hMod, szTmp,sizeof(szTmp));
MessageBox(0, szTmp, "info", MB_OK);