DynamoRIO / DynamoRIO/dynamorio

Extend client.truncate test to cover DR hook truncation

Open
#1,632 0 comments 0 reactions 1 assignee Claimed by @byron-hawkins View on GitHub
Bug-DRCrash Component-Tests OpSys-Windows Priority-Low
Dominant language
C
Stars
3.2k
Forks
629
Avg merge
2d 18h
Merged PRs (30d)
30

Description

The client.truncate test currently omits the following important cases:
1. Truncating basic blocks at a single instruction, either by modifying the test client or using `-max_bb_instrs 1`. This encounters a bug on Windows when decoding hooked functions. If the hook overlaps multiple instructions, truncation will require DR to resume decoding at the second instruction of the function, which is under the hook. Since decoding should always start in the app address space, DR is not currently aware that the second BB start pc is under a hook, and decodes it incorrectly, causing a crash.
2. Truncation of the hook in `LdrInitializeThunk` which on 32-bit displaces two original app instructions (other hooks only displace a single app instruction, so they do not have issues with truncation).
3. Selfmod.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.