DynamoRIO / DynamoRIO/dynamorio

Segmentation fault when running mpengine.dll in Linux

Open
#3,216 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
3.2k
Forks
629
Avg merge
2d 15h
Merged PRs (30d)
31

Description

I am trying to instrument mpengine.dll (Windows Defender core DLL) which is loaded by Tavis Omandy's [loadlibrary](https://github.com/taviso/loadlibrary) (a tool used to run windows DLLs on Linux).
Command line:
```../bin_cov/32_build_dr/bin32/drrun -debug -- ./mpclient in/txt_file``` (mpclient loads mpengine.dll and call its entry point).
Result is SIGSEGV.

```

Calling (mpengine.dll) 0xf60f5b78

0xf724b637
>

vmheap.num_free_blocks == heapmgt->vmheap.num_blocks - unfreed_blocks || ((ever_beyond_vmm IF_WINDOWS(|| get_os_version() >= WINDOWS_VERSION_
version 7.0.17812, custom build
-no_dynamic_options -code_api -stack_size 56K -signal_stack_size 32K -max_elide_jmp 0 -max_elide_call 0 -early_inject -emulate_brk -no_inline_ignored_syscalls -native_exec_default_list '' -no_native_exec_managed_code -no_indcall2direct
0x4db2f43c 0xf74d020d
0x4db2f66c 0xf7545fed
0x4db2f690 0xf745434b
0x4db2f6a8 0xf745469c
0x4db2f6c0 0xf7454815
0x4db2f6d0 0xf76312d3
0x4db2f6e0 0x4dabc7c0
0xf7667417 0x00100083>
```

Is it possible to instrument such type of applications with DynamoRIO at all (Windows DLL loaded in Linux)?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.