DynamoRIO / DynamoRIO/dynamorio

CRASH (themida-hostname.exe) multi threaded self modification

Open
#2,294 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
3.2k
Forks
629
Avg merge
2d 15h
Merged PRs (30d)
31

Description

With version 6.2.0-2 of DynamoRio
The latest build does not solve the problem

On Windows 7, with a 32 bit application, themida-hostname.exe the classic hostname software packed with themida

I run it with (no client)
C:\rio\bin32\drrun.exe -debug -- themida-hostname.exe

The expected output is a line with the hostname.
Instead we get a crash with
`ASSERT(!info.overlap || (f != NULL && TEST(FRAG_IS_TRACE, f->flags)));`

The problem seems to come from two threads doing self modifications on the same memory page.
With a race condition, we have two exceptions EXCEPTION_ACCESS_VIOLATION.

Both threads end up in function `handle_modified_code`
First one goes normally, ending removing the interval from the exec list to continue write.
But second one logs
Region for 0x101a1f3 not exec, probably data on same page
WARNING: region now writable: assuming another thread already flushed it
going to flush again just to make sure
ASSERT(!info.overlap || (f != NULL && TEST(FRAG_IS_TRACE, f->flags)));

Condition `base_pc < (bb_pend + PAGE_SIZE) && (base_pc + size) > bb_pstart` was not true for the second thread because size was not expanded after `get_memory_info` to the exec area size.

Returning NULL from `handle_modified_code` to re-execute the faulting write instead of asserting provides a correct behavior in this case.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.