DynamoRIO / DynamoRIO/dynamorio
Z3 not working inside a DynamoRio client.
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 629
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 30
Description
Hi,
I was trying to use [Z3](https://github.com/Z3Prover/z3) inside a DR client in Windows. Some functions are working but it is crashing solving an expression. It is not a Z3 problem because the same code is working properly in a normal console project:
``` C
#include
#include
void testz3()
{
std::stringstream formula;
z3::context ctx;
z3::solver solver(ctx);
formula << "(declare-const x Int)";
formula << "(assert (= x 4))";
Z3_ast ast = Z3_parse_smtlib2_string(ctx, formula.str().c_str(), 0, 0, 0, 0, 0, 0);
z3::expr eq(ctx, ast);
solver.add(eq);
printf("Before check\n");
if (solver.check() == z3::sat)
printf("SAT!\n");
else
printf("UNSAT!\n");
}
int main(int ac, const char **av)
{
testz3();
return 0;
}
```
The following code of the DR client is crashing in the instruction `solver.check`:
``` C
#include
#include
#include
void testz3()
{
std::stringstream formula;
z3::context ctx;
z3::solver solver(ctx);
formula << "(declare-const x Int)";
formula << "(assert (= x 4))";
Z3_ast ast = Z3_parse_smtlib2_string(ctx, formula.str().c_str(), 0, 0, 0, 0, 0, 0);
z3::expr eq(ctx, ast);
solver.add(eq);
dr_printf("Before check\n");
if (solver.check() == z3::sat)
dr_printf("SAT!\n");
else
dr_printf("UNSAT!\n");
}
DR_EXPORT void dr_client_main(client_id_t id, int argc, const char *argv[])
{
dr_enable_console_printing();
testz3();
}
```

I guess that DynamoRio is interfering in the execution of the Z3 project, but I don't know where.
I attach the DR client log (loglevel 5):
[Crackme.exe.0.2056.html.zip](https://github.com/DynamoRIO/dynamorio/files/145788/Crackme.exe.0.2056.html.zip)
And I attach the two projects with the Z3 console app and the DR client using Z3.
[Z3_projects.zip](https://github.com/DynamoRIO/dynamorio/files/145786/Z3_projects.zip)
Could anyone test it?
Contributor guide
Research direction
Start with the attached Z3_projects.zip and the DR client entry point dr_client_main, comparing the standalone console program with the client at solver.check(). Inspect the attached loglevel-5 archive for the crash context. Done means identifying the DynamoRIO/Z3 interaction or a reproducible compatibility explanation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- devtools, operating-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100