APP CRASH: infinite loop decoding one selfmod bb in Audiotran

_From [byron.c....@gmail.com](https://code.google.com/u/101184679827294438523/) on May 06, 2014 22:26:25_
- DynamoRIO version 4.2.0-3 (downloaded binaries)
- Windows 7 SP 1 x64 in VirtualBox
- Audiotran (32-bit): download the "Vulnerable App" from http://www.exploit-db.com/exploits/31766/ + Behavior is the same when running with
- no client/no options
- debug
- debug with log level 1, 2 or 3 (higher generates *GB logs)
- Infinite loop begins before the app window displays on the screen.

At log level 3, the infinite loop generates a long sequence of entries identical to this one:

--------------- Repeating log fragment --------------

dispatch: target = 0x11025f9e

interp: start_pc = 0x11025f9e
new shared vm area: 0x11025000-0x11026000 W-S- unexpected vm area mmsa.dll
0x11025f9e f3 aa rep stos %al %edi %ecx -> %es:(%edi) %edi %ecx
0x11025fa0 5f pop %esp (%esp) -> %edi %esp
0x11025fa1 fc cld
0x11025fa2 83 c6 04 add $0x00000004 %esi -> %esi
0x11025fa5 e9 75 ff ff ff jmp $0x11025f1f
end_pc = 0x11025faa

fragment overlaps selfmod area, inserting sandboxing
stack vs 0x11025f9e: official 0x00090000..0x00190000, esp 0x0018f2ca
writes memory: rep stos %al %edi %ecx -> %es:(%edi) %edi %ecx

interp: start_pc = 0x11025f9e
0x11025f9e f3 aa rep stos %al %edi %ecx -> %es:(%edi) %edi %ecx
0x11025fa0 5f pop %esp (%esp) -> %edi %esp
0x11025fa1 fc cld
0x11025fa2 83 c6 04 add $0x00000004 %esi -> %esi
0x11025fa5 e9 75 ff ff ff jmp $0x11025f1f
end_pc = 0x11025faa

exit_branch_type=0x100 target=0x11025f9e l->flags=0x8901
exit_branch_type=0x100 target=0x11025f9e l->flags=0x8901
exit_branch_type=0x100 target=0x11025fa0 l->flags=0x8901
exit_branch_type=0x0 target=0x11025f1f l->flags=0x9801
stack vs 0x11025f9e: official 0x00090000..0x00190000, esp 0x0018f2ca
Fragment 80393, tag 0x11025f9e, flags 0x86b0, private, size 221, cannot be trace:
[mmsa.dll~_+0xf2e,~.end-0x3c062]
Entry into F80393(0x11025f9e).0x16ef1004

Exit from F80393(0x11025f9e).0x16ef1070
(cannot link F80393->F80393) (unknown reason)
Sandboxing exit from fragment 0x11025f9e @0x16ef1070
set next_tag to 0x11025f9e
Fragment 0x11025f9e self-write -> 0x11025000-0x11026000 selfmod exec counter reset, old count=1
WARNING: fragment 0x11025f9e @0x16ef1070 overwrote its own code
fragment_delete: *0x16615fd4 F80393(0x11025f9e).0x16ef1004 bb 0x0

--------------- Repeating log fragment --------------

_Original issue: http://code.google.com/p/dynamorio/issues/detail?id=1442_

Reproduce the Audiotran crash with DynamoRIO 4.2.0-3 on Windows 7 and no client or options, then compare the repeated log fragment at log level 3. Start with the self-modifying block at 0x11025f9e and its sandboxing, fragment deletion, and repeated dispatch. Done means the infinite loop is eliminated and the application reaches its window.

Written by the indexing model from the issue text.