DynamoRIO / DynamoRIO/dynamorio

Z3 not working inside a DynamoRio client.

Open
#1,881 5 comments 0 reactions 0 assignees View on GitHub
Bug-ToolFail help wanted OpSys-Windows
Dominant language
C
Stars
3.2k
Forks
629
Avg merge
2d 18h
Merged PRs (30d)
30

Description

Hi,

I was trying to use [Z3](https://github.com/Z3Prover/z3) inside a DR client in Windows. Some functions are working but it is crashing solving an expression. It is not a Z3 problem because the same code is working properly in a normal console project:

``` C
#include
#include

void testz3()
{
std::stringstream formula;
z3::context ctx;
z3::solver solver(ctx);

formula << "(declare-const x Int)";
formula << "(assert (= x 4))";

Z3_ast ast = Z3_parse_smtlib2_string(ctx, formula.str().c_str(), 0, 0, 0, 0, 0, 0);
z3::expr eq(ctx, ast);
solver.add(eq);
printf("Before check\n");
if (solver.check() == z3::sat)
printf("SAT!\n");
else
printf("UNSAT!\n");
}

int main(int ac, const char **av)
{
testz3();
return 0;
}
```

The following code of the DR client is crashing in the instruction `solver.check`:

``` C
#include
#include
#include

void testz3()
{
std::stringstream formula;
z3::context ctx;
z3::solver solver(ctx);

formula << "(declare-const x Int)";
formula << "(assert (= x 4))";

Z3_ast ast = Z3_parse_smtlib2_string(ctx, formula.str().c_str(), 0, 0, 0, 0, 0, 0);
z3::expr eq(ctx, ast);
solver.add(eq);
dr_printf("Before check\n");
if (solver.check() == z3::sat)
dr_printf("SAT!\n");
else
dr_printf("UNSAT!\n");
}

DR_EXPORT void dr_client_main(client_id_t id, int argc, const char *argv[])
{
dr_enable_console_printing();
testz3();
}
```

![image](https://cloud.githubusercontent.com/assets/5008707/13306943/a660f326-db1c-11e5-900d-e33ddd07587b.png)

I guess that DynamoRio is interfering in the execution of the Z3 project, but I don't know where.

I attach the DR client log (loglevel 5):
[Crackme.exe.0.2056.html.zip](https://github.com/DynamoRIO/dynamorio/files/145788/Crackme.exe.0.2056.html.zip)

And I attach the two projects with the Z3 console app and the DR client using Z3.
[Z3_projects.zip](https://github.com/DynamoRIO/dynamorio/files/145786/Z3_projects.zip)

Could anyone test it?

Contributor guide

Open the contributing guide

Research direction

Start with the attached Z3_projects.zip and the DR client entry point dr_client_main, comparing the standalone console program with the client at solver.check(). Inspect the attached loglevel-5 archive for the crash context. Done means identifying the DynamoRIO/Z3 interaction or a reproducible compatibility explanation.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
devtools, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.