DynamoRIO / DynamoRIO/dynamorio
Extend client.truncate test to cover DR hook truncation
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 629
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 30
Description
The client.truncate test currently omits the following important cases:
1. Truncating basic blocks at a single instruction, either by modifying the test client or using `-max_bb_instrs 1`. This encounters a bug on Windows when decoding hooked functions. If the hook overlaps multiple instructions, truncation will require DR to resume decoding at the second instruction of the function, which is under the hook. Since decoding should always start in the app address space, DR is not currently aware that the second BB start pc is under a hook, and decodes it incorrectly, causing a crash.
2. Truncation of the hook in `LdrInitializeThunk` which on 32-bit displaces two original app instructions (other hooks only displace a single app instruction, so they do not have issues with truncation).
3. Selfmod.
Contributor guide
Assessment
This issue has not been assessed yet.