DynamoRIO / DynamoRIO/dynamorio
On xp64 WOW64, the x64 NtGetContextThread returns success but an all-zero context
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 629
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 31
Description
Testing #1035's win32.earlythread.exe on xp64 I hit an assert:
```
05 244fee04 15109742 dynamorio!internal_error+0x124 [d:\derek\dr\git\src\core\utils.c @ 187]
06 244fef18 15106794 dynamorio!dispatch_enter_dynamorio+0x132 [d:\derek\dr\git\src\core\dispatch.c @ 690]
07 244feff4 152ad2f4 dynamorio!dispatch+0x14 [d:\derek\dr\git\src\core\dispatch.c @ 154]
08 244fea50 152f1c65 dynamorio!call_switch_stack+0x23 [D:\derek\dr\git\build_x86_dbg_tests\core\CMakeFiles\dynamorio.dir\arch\x86\x86.asm.obj.s @ 1414]
09 244fea98 152fd7ea dynamorio!asynch_take_over+0x325 [d:\derek\dr\git\src\core\win32\callback.c @ 2893]
0a 244feea4 1544eb10 dynamorio!intercept_exception+0x1f0a [d:\derek\dr\git\src\core\win32\callback.c @ 5636]
0b 0012f8d8 152c8ebf dynamorio!interception_code_array+0xb10
0c 0012fd90 152c98c9 dynamorio!os_take_over_thread+0x2bf [d:\derek\dr\git\src\core\win32\os.c @ 2129]
0d 0012fdcc 15077286 dynamorio!os_take_over_all_unknown_threads+0x1d9 [d:\derek\dr\git\src\core\win32\os.c @ 2238]
0e 0012fde4 152aca3c dynamorio!dynamorio_take_over_threads+0x16 [d:\derek\dr\git\src\core\dynamo.c @ 2652]
0f 0012fe48 152ad2c8 dynamorio!auto_setup+0x14c [d:\derek\dr\git\src\core\arch\x86_code.c @ 178]
10 00000000 00000000 dynamorio!dynamo_auto_start+0x8 [D:\derek\dr\git\build_x86_dbg_tests\core\CMakeFiles\dynamorio.dir\arch\x86\x86.asm.obj.s @ 1347]
```
thread_initexit_lock, but we had a crash.
It crashes looking at cxt64->Rip: cxt64 is all zeroes. This happens w/o
my #1035 changes:
```
0:000> p
eax=77ef1c70 ebx=22170828 ecx=00000000 edx=00000000 esi=22161030 edi=22161028
eip=15322ba0 esp=0012f88c ebp=0012f8a4 iopl=0 nv up ei pl nz na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000202
dynamorio!thread_get_context_64+0x40:
15322ba0 6a00 push 0x0
0:000> dt cxt64
Local var @ 0x12f8b0 Type _CONTEXT_64*
0x22161030
+0x000 P1Home : 0xabababab`abababab
+0x008 P2Home : 0xabababab`abababab
+0x010 P3Home : 0xabababab`abababab
+0x018 P4Home : 0xabababab`abababab
+0x020 P5Home : 0xabababab`abababab
+0x028 P6Home : 0xabababab`abababab
+0x030 ContextFlags : 0x10003
+0x034 MxCsr : 0xabababab
+0x038 SegCs : 0xabab
+0x03a SegDs : 0xabab
+0x03c SegEs : 0xabab
+0x03e SegFs : 0xabab
+0x040 SegGs : 0xabab
+0x042 SegSs : 0xabab
+0x044 EFlags : 0xabababab
+0x048 Dr0 : 0xabababab`abababab
+0x050 Dr1 : 0xabababab`abababab
+0x058 Dr2 : 0xabababab`abababab
+0x060 Dr3 : 0xabababab`abababab
+0x068 Dr6 : 0xabababab`abababab
+0x070 Dr7 : 0xabababab`abababab
+0x078 Rax : 0xabababab`abababab
+0x080 Rcx : 0xabababab`abababab
+0x088 Rdx : 0xabababab`abababab
+0x090 Rbx : 0xabababab`abababab
+0x098 Rsp : 0xabababab`abababab
+0x0a0 Rbp : 0xabababab`abababab
+0x0a8 Rsi : 0xabababab`abababab
+0x0b0 Rdi : 0xabababab`abababab
+0x0b8 R8 : 0xabababab`abababab
+0x0c0 R9 : 0xabababab`abababab
+0x0c8 R10 : 0xabababab`abababab
+0x0d0 R11 : 0xabababab`abababab
+0x0d8 R12 : 0xabababab`abababab
+0x0e0 R13 : 0xabababab`abababab
+0x0e8 R14 : 0xabababab`abababab
+0x0f0 R15 : 0xabababab`abababab
+0x0f8 Rip : 0xabababab`abababab
+0x100 FltSave : _XSAVE_FORMAT
+0x100 Header : [2] _M128A
+0x120 Legacy : [8] _M128A
+0x1a0 Xmm0 : _M128A
+0x1b0 Xmm1 : _M128A
+0x1c0 Xmm2 : _M128A
+0x1d0 Xmm3 : _M128A
+0x1e0 Xmm4 : _M128A
+0x1f0 Xmm5 : _M128A
+0x200 Xmm6 : _M128A
+0x210 Xmm7 : _M128A
+0x220 Xmm8 : _M128A
+0x230 Xmm9 : _M128A
+0x240 Xmm10 : _M128A
+0x250 Xmm11 : _M128A
+0x260 Xmm12 : _M128A
+0x270 Xmm13 : _M128A
+0x280 Xmm14 : _M128A
+0x290 Xmm15 : _M128A
+0x300 VectorRegister : [26] _M128A
+0x4a0 VectorControl : 0xabababab`abababab
+0x4a8 DebugControl : 0xabababab`abababab
+0x4b0 LastBranchToRip : 0xabababab`abababab
+0x4b8 LastBranchFromRip : 0xabababab`abababab
+0x4c0 LastExceptionToRip : 0xabababab`abababab
+0x4c8 LastExceptionFromRip : 0xabababab`abababab
0:000> p
eax=00000000 ebx=22170828 ecx=77ef1c7a edx=00000000 esi=22161030 edi=22161028
eip=15322bbd esp=0012f88c ebp=0012f8a4 iopl=0 nv up ei pl nz na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000202
dynamorio!thread_get_context_64+0x5d:
15322bbd 33c0 xor eax,eax
0:000> ?? res
long 0
0:000> dt cxt64
Local var @ 0x12f8b0 Type _CONTEXT_64*
0x22161030
+0x000 P1Home : 0
+0x008 P2Home : 0
+0x010 P3Home : 0
+0x018 P4Home : 0
+0x020 P5Home : 0
+0x028 P6Home : 0
+0x030 ContextFlags : 0x10003
+0x034 MxCsr : 0
+0x038 SegCs : 0
+0x03a SegDs : 0
+0x03c SegEs : 0
+0x03e SegFs : 0
+0x040 SegGs : 0
+0x042 SegSs : 0
+0x044 EFlags : 0
+0x048 Dr0 : 0
+0x050 Dr1 : 0
+0x058 Dr2 : 0
+0x060 Dr3 : 0
+0x068 Dr6 : 0
+0x070 Dr7 : 0
+0x078 Rax : 0
+0x080 Rcx : 0
+0x088 Rdx : 0
+0x090 Rbx : 0
+0x098 Rsp : 0
+0x0a0 Rbp : 0
+0x0a8 Rsi : 0
+0x0b0 Rdi : 0
+0x0b8 R8 : 0
+0x0c0 R9 : 0
+0x0c8 R10 : 0
+0x0d0 R11 : 0
+0x0d8 R12 : 0
+0x0e0 R13 : 0
+0x0e8 R14 : 0
+0x0f0 R15 : 0
+0x0f8 Rip : 0
+0x100 FltSave : _XSAVE_FORMAT
+0x100 Header : [2] _M128A
+0x120 Legacy : [8] _M128A
+0x1a0 Xmm0 : _M128A
+0x1b0 Xmm1 : _M128A
+0x1c0 Xmm2 : _M128A
+0x1d0 Xmm3 : _M128A
+0x1e0 Xmm4 : _M128A
+0x1f0 Xmm5 : _M128A
+0x200 Xmm6 : _M128A
+0x210 Xmm7 : _M128A
+0x220 Xmm8 : _M128A
+0x230 Xmm9 : _M128A
+0x240 Xmm10 : _M128A
+0x250 Xmm11 : _M128A
+0x260 Xmm12 : _M128A
+0x270 Xmm13 : _M128A
+0x280 Xmm14 : _M128A
+0x290 Xmm15 : _M128A
+0x300 VectorRegister : [26] _M128A
+0x4a0 VectorControl : 0
+0x4a8 DebugControl : 0
+0x4b0 LastBranchToRip : 0
+0x4b8 LastBranchFromRip : 0
+0x4c0 LastExceptionToRip : 0
+0x4c8 LastExceptionFromRip : 0
```
res is 0 (STATUS_SUCCESS), but it fills in cxt64 with zeroes (leaving
ContextFlags as it was): ??? The 32-bit context is in
ntdll!ZwDelayExecution from kernel32!SleepEx: so shouldn't it have a 64-bit
context? Does xp64 return zeroes if it's in the kernel at the time? I
don't have any mention of this behavior in #1141, and I'm sure I tested
that on xp64 as well as win7. Filing this to document the behavior.
Contributor guide
Assessment
This issue has not been assessed yet.