DynamoRIO / DynamoRIO/dynamorio
APP CRASH (7.0.0-RC1) vmprotect protected application with "DLL Box" feature failed to run under DR
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 629
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 30
Description
**What version of DynamoRIO are you using?**
DynamoRIO-Windows-7.0.0-RC1
**Does the latest build from
https://github.com/DynamoRIO/dynamorio/wiki/Latest-Build solve the problem?**
This is the latest
**What operating system version are you running on?**
Windows XP SP3 EN 32Bit
**What application are you running?**
fciv.vmp.exe, which is a simple console application that protected by vmprotect with "DLL Box" feature.
**Is your application 32-bit or 64-bit?**
32-bit release build
**How are you running the application under DynamoRIO?**
bin32\drrun.exe -c samples\bin32\bbsize.dll -- C:\fciv.vmp.exe
**What happens when you run without any client?**
fciv.vmp.exe pop up an error message box(which is the vmprotect packer do).
**What happens when you run with debug build ("-debug" flag to
drrun/drconfig/drinject)?**
An error message box pop up as well.
**What steps will reproduce the problem?**
Run the application under DynamoRIO.
**What is the expected output? What do you see instead? Is this an
application crash, a DynamoRIO crash, a DynamoRIO assert, or a hang (see
https://github.com/DynamoRIO/dynamorio/wiki/Bug-Reporting and set the title
appropriately)?**
The expected result is that the executable print some help text to the console window, no error message box should pop up. The closest description that matches this issue is "APP CRASH," since the application does not run as expected.
**Please provide any additional information below.**
I found vmprotect hook following native apis:
```
ZwQueryAttributesFile
ZwOpenFile
ZwClose
ZwCreateSection
ZwMapViewOfSection
ZwUnmapViewOfSection
ZwQueryVirtualMemory
ZwQuerySection
```
It is the hook code who do loading the "Boxed" dll in memory, the boxed dll is not present on the disk.
The test executable can be downloaded from [here](https://drive.google.com/open?id=0B_d0NEHhu17yaGhfamtySE5nMTQ).It is not a malware, you can test it in a virtual machine.
I don't know what's wrong.Can anyone have a look into this?
Contributor guide
Assessment
This issue has not been assessed yet.