DynamoRIO / DynamoRIO/dynamorio

DR cannot delete 1config file from a process with untrusted integrity level

Open
#1,057 0 comments 0 reactions 0 assignees View on GitHub
Migrated Priority-Low
Dominant language
C
Stars
3.2k
Forks
629
Avg merge
2d 18h
Merged PRs (30d)
30

Description

_From [rnk@google.com](https://code.google.com/u/rnk@google.com/) on January 17, 2013 14:08:11_

This is a cosmetic issue, but it causes a curiosity in a debug build when running on an untrusted process. Here's the stack:

0:000> k
ChildEBP RetAddr
WARNING: Stack unwind information not available. Following frames may be wrong.
16d5dcac 5ce034ed ntdll!NtRaiseHardError+0x12
16d5dcd4 5cc75d94 dynamorio!debugbox+0x4d [d:\src\dynamorio\core\win32\os.c @ 3777]
16d5e4f0 5cc762f2 dynamorio!notify+0x1e4 [d:\src\dynamorio\core\utils.c @ 1914]
16d5e580 5ce05c44 dynamorio!report_dynamorio_problem+0x502 [d:\src\dynamorio\core\utils.c @ 2175]
16d5e5b4 5ce05d0c dynamorio!os_delete_file_w+0x74 [d:\src\dynamorio\core\win32\os.c @ 5412]
16d5e7cc 5ccd2e18 dynamorio!os_delete_file+0x3c [d:\src\dynamorio\core\win32\os.c @ 5438]
16d5e7d8 5cbc1046 dynamorio!config_exit+0x48 [d:\src\dynamorio\core\config.c @ 677]
16d5e800 5cbc14c6 dynamorio!dynamo_shared_exit+0x456 [d:\src\dynamorio\core\dynamo.c @ 1047]
16d5e828 5cbc131b dynamorio!dynamo_process_exit_cleanup+0x196 [d:\src\dynamorio\core\dynamo.c @ 1222]
16d5e838 5cdd20f2 dynamorio!dynamo_process_exit+0x12b [d:\src\dynamorio\core\dynamo.c @ 1281]
16d5e848 16ce5700 dynamorio!cleanup_and_terminate+0x4b [D:\src\dynamorio\build\build_debug-i32-static-ext\core\CMakeFiles\dynamorio.dir\x86\x86.asm.obj.s @ 1270]
5ce11a4d 8b5e5f01 0x16ce5700
b014c483 00000000 0x8b5e5f01

_Original issue: http://code.google.com/p/dynamorio/issues/detail?id=1057_

Contributor guide

Open the contributing guide

Research direction

Start with core/win32/os.c at os_delete_file_w and os_delete_file, then follow the call from core/config.c at config_exit. Reproduce the debug-build cleanup from an untrusted-integrity process and inspect the reported deletion failure. Done means cleanup no longer produces the reported cosmetic debug curiosity while preserving normal configuration-file deletion behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.