DynamoRIO / DynamoRIO/dynamorio

with DR in parent and child, add consistency for code changed via IPC

Open
#1,646 0 comments 0 reactions 0 assignees View on GitHub
OpSys-Windows Transparency
Dominant language
C
Stars
3.2k
Forks
629
Avg merge
2d 15h
Merged PRs (30d)
31

Description

Code modification via IPC is a longstanding open issue (cases 68/204553 and 8321/212756 in our old tracker in case there are references in the code). Today we just log some of the actions (e.g., "WARNING: ProtectVirtualMemory called on process xxx" or the IPC_ALERT macros). We're talking about remote NtProtectVirtualMemory, NtWriteVirtualMemory, etc. on Windows: we're not trying to handle code changed via the kernel's debugger interface.

For DR in the parent it would be possible to notify the child DR about the code change. Probably we'd use a nudge, and we'd have the parent check the child drmarker first to avoid nudging native processes.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.