DynamoRIO / DynamoRIO/dynamorio

On xp64 WOW64, the x64 NtGetContextThread returns success but an all-zero context

Open
#1,637 0 comments 0 reactions 0 assignees View on GitHub
Bug-DRCrash OpSys-Windows Priority-Low
Dominant language
C
Stars
3.2k
Forks
629
Avg merge
2d 15h
Merged PRs (30d)
31

Description

Testing #1035's win32.earlythread.exe on xp64 I hit an assert:

```
05 244fee04 15109742 dynamorio!internal_error+0x124 [d:\derek\dr\git\src\core\utils.c @ 187]
06 244fef18 15106794 dynamorio!dispatch_enter_dynamorio+0x132 [d:\derek\dr\git\src\core\dispatch.c @ 690]
07 244feff4 152ad2f4 dynamorio!dispatch+0x14 [d:\derek\dr\git\src\core\dispatch.c @ 154]
08 244fea50 152f1c65 dynamorio!call_switch_stack+0x23 [D:\derek\dr\git\build_x86_dbg_tests\core\CMakeFiles\dynamorio.dir\arch\x86\x86.asm.obj.s @ 1414]
09 244fea98 152fd7ea dynamorio!asynch_take_over+0x325 [d:\derek\dr\git\src\core\win32\callback.c @ 2893]
0a 244feea4 1544eb10 dynamorio!intercept_exception+0x1f0a [d:\derek\dr\git\src\core\win32\callback.c @ 5636]
0b 0012f8d8 152c8ebf dynamorio!interception_code_array+0xb10
0c 0012fd90 152c98c9 dynamorio!os_take_over_thread+0x2bf [d:\derek\dr\git\src\core\win32\os.c @ 2129]
0d 0012fdcc 15077286 dynamorio!os_take_over_all_unknown_threads+0x1d9 [d:\derek\dr\git\src\core\win32\os.c @ 2238]
0e 0012fde4 152aca3c dynamorio!dynamorio_take_over_threads+0x16 [d:\derek\dr\git\src\core\dynamo.c @ 2652]
0f 0012fe48 152ad2c8 dynamorio!auto_setup+0x14c [d:\derek\dr\git\src\core\arch\x86_code.c @ 178]
10 00000000 00000000 dynamorio!dynamo_auto_start+0x8 [D:\derek\dr\git\build_x86_dbg_tests\core\CMakeFiles\dynamorio.dir\arch\x86\x86.asm.obj.s @ 1347]
```

thread_initexit_lock, but we had a crash.

It crashes looking at cxt64->Rip: cxt64 is all zeroes. This happens w/o
my #1035 changes:

```
0:000> p
eax=77ef1c70 ebx=22170828 ecx=00000000 edx=00000000 esi=22161030 edi=22161028
eip=15322ba0 esp=0012f88c ebp=0012f8a4 iopl=0 nv up ei pl nz na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000202
dynamorio!thread_get_context_64+0x40:
15322ba0 6a00 push 0x0
0:000> dt cxt64
Local var @ 0x12f8b0 Type _CONTEXT_64*
0x22161030
+0x000 P1Home : 0xabababab`abababab
+0x008 P2Home : 0xabababab`abababab
+0x010 P3Home : 0xabababab`abababab
+0x018 P4Home : 0xabababab`abababab
+0x020 P5Home : 0xabababab`abababab
+0x028 P6Home : 0xabababab`abababab
+0x030 ContextFlags : 0x10003
+0x034 MxCsr : 0xabababab
+0x038 SegCs : 0xabab
+0x03a SegDs : 0xabab
+0x03c SegEs : 0xabab
+0x03e SegFs : 0xabab
+0x040 SegGs : 0xabab
+0x042 SegSs : 0xabab
+0x044 EFlags : 0xabababab
+0x048 Dr0 : 0xabababab`abababab
+0x050 Dr1 : 0xabababab`abababab
+0x058 Dr2 : 0xabababab`abababab
+0x060 Dr3 : 0xabababab`abababab
+0x068 Dr6 : 0xabababab`abababab
+0x070 Dr7 : 0xabababab`abababab
+0x078 Rax : 0xabababab`abababab
+0x080 Rcx : 0xabababab`abababab
+0x088 Rdx : 0xabababab`abababab
+0x090 Rbx : 0xabababab`abababab
+0x098 Rsp : 0xabababab`abababab
+0x0a0 Rbp : 0xabababab`abababab
+0x0a8 Rsi : 0xabababab`abababab
+0x0b0 Rdi : 0xabababab`abababab
+0x0b8 R8 : 0xabababab`abababab
+0x0c0 R9 : 0xabababab`abababab
+0x0c8 R10 : 0xabababab`abababab
+0x0d0 R11 : 0xabababab`abababab
+0x0d8 R12 : 0xabababab`abababab
+0x0e0 R13 : 0xabababab`abababab
+0x0e8 R14 : 0xabababab`abababab
+0x0f0 R15 : 0xabababab`abababab
+0x0f8 Rip : 0xabababab`abababab
+0x100 FltSave : _XSAVE_FORMAT
+0x100 Header : [2] _M128A
+0x120 Legacy : [8] _M128A
+0x1a0 Xmm0 : _M128A
+0x1b0 Xmm1 : _M128A
+0x1c0 Xmm2 : _M128A
+0x1d0 Xmm3 : _M128A
+0x1e0 Xmm4 : _M128A
+0x1f0 Xmm5 : _M128A
+0x200 Xmm6 : _M128A
+0x210 Xmm7 : _M128A
+0x220 Xmm8 : _M128A
+0x230 Xmm9 : _M128A
+0x240 Xmm10 : _M128A
+0x250 Xmm11 : _M128A
+0x260 Xmm12 : _M128A
+0x270 Xmm13 : _M128A
+0x280 Xmm14 : _M128A
+0x290 Xmm15 : _M128A
+0x300 VectorRegister : [26] _M128A
+0x4a0 VectorControl : 0xabababab`abababab
+0x4a8 DebugControl : 0xabababab`abababab
+0x4b0 LastBranchToRip : 0xabababab`abababab
+0x4b8 LastBranchFromRip : 0xabababab`abababab
+0x4c0 LastExceptionToRip : 0xabababab`abababab
+0x4c8 LastExceptionFromRip : 0xabababab`abababab
0:000> p
eax=00000000 ebx=22170828 ecx=77ef1c7a edx=00000000 esi=22161030 edi=22161028
eip=15322bbd esp=0012f88c ebp=0012f8a4 iopl=0 nv up ei pl nz na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000202
dynamorio!thread_get_context_64+0x5d:
15322bbd 33c0 xor eax,eax
0:000> ?? res
long 0
0:000> dt cxt64
Local var @ 0x12f8b0 Type _CONTEXT_64*
0x22161030
+0x000 P1Home : 0
+0x008 P2Home : 0
+0x010 P3Home : 0
+0x018 P4Home : 0
+0x020 P5Home : 0
+0x028 P6Home : 0
+0x030 ContextFlags : 0x10003
+0x034 MxCsr : 0
+0x038 SegCs : 0
+0x03a SegDs : 0
+0x03c SegEs : 0
+0x03e SegFs : 0
+0x040 SegGs : 0
+0x042 SegSs : 0
+0x044 EFlags : 0
+0x048 Dr0 : 0
+0x050 Dr1 : 0
+0x058 Dr2 : 0
+0x060 Dr3 : 0
+0x068 Dr6 : 0
+0x070 Dr7 : 0
+0x078 Rax : 0
+0x080 Rcx : 0
+0x088 Rdx : 0
+0x090 Rbx : 0
+0x098 Rsp : 0
+0x0a0 Rbp : 0
+0x0a8 Rsi : 0
+0x0b0 Rdi : 0
+0x0b8 R8 : 0
+0x0c0 R9 : 0
+0x0c8 R10 : 0
+0x0d0 R11 : 0
+0x0d8 R12 : 0
+0x0e0 R13 : 0
+0x0e8 R14 : 0
+0x0f0 R15 : 0
+0x0f8 Rip : 0
+0x100 FltSave : _XSAVE_FORMAT
+0x100 Header : [2] _M128A
+0x120 Legacy : [8] _M128A
+0x1a0 Xmm0 : _M128A
+0x1b0 Xmm1 : _M128A
+0x1c0 Xmm2 : _M128A
+0x1d0 Xmm3 : _M128A
+0x1e0 Xmm4 : _M128A
+0x1f0 Xmm5 : _M128A
+0x200 Xmm6 : _M128A
+0x210 Xmm7 : _M128A
+0x220 Xmm8 : _M128A
+0x230 Xmm9 : _M128A
+0x240 Xmm10 : _M128A
+0x250 Xmm11 : _M128A
+0x260 Xmm12 : _M128A
+0x270 Xmm13 : _M128A
+0x280 Xmm14 : _M128A
+0x290 Xmm15 : _M128A
+0x300 VectorRegister : [26] _M128A
+0x4a0 VectorControl : 0
+0x4a8 DebugControl : 0
+0x4b0 LastBranchToRip : 0
+0x4b8 LastBranchFromRip : 0
+0x4c0 LastExceptionToRip : 0
+0x4c8 LastExceptionFromRip : 0
```

res is 0 (STATUS_SUCCESS), but it fills in cxt64 with zeroes (leaving
ContextFlags as it was): ??? The 32-bit context is in
ntdll!ZwDelayExecution from kernel32!SleepEx: so shouldn't it have a 64-bit
context? Does xp64 return zeroes if it's in the kernel at the time? I
don't have any mention of this behavior in #1141, and I'm sure I tested
that on xp64 as well as win7. Filing this to document the behavior.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.