DynamoRIO / DynamoRIO/dynamorio
Segmentation fault when running mpengine.dll in Linux
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 629
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 31
Description
I am trying to instrument mpengine.dll (Windows Defender core DLL) which is loaded by Tavis Omandy's [loadlibrary](https://github.com/taviso/loadlibrary) (a tool used to run windows DLLs on Linux).
Command line:
```../bin_cov/32_build_dr/bin32/drrun -debug -- ./mpclient in/txt_file``` (mpclient loads mpengine.dll and call its entry point).
Result is SIGSEGV.
```
Calling (mpengine.dll) 0xf60f5b78
0xf724b637
>
vmheap.num_free_blocks == heapmgt->vmheap.num_blocks - unfreed_blocks || ((ever_beyond_vmm IF_WINDOWS(|| get_os_version() >= WINDOWS_VERSION_
version 7.0.17812, custom build
-no_dynamic_options -code_api -stack_size 56K -signal_stack_size 32K -max_elide_jmp 0 -max_elide_call 0 -early_inject -emulate_brk -no_inline_ignored_syscalls -native_exec_default_list '' -no_native_exec_managed_code -no_indcall2direct
0x4db2f43c 0xf74d020d
0x4db2f66c 0xf7545fed
0x4db2f690 0xf745434b
0x4db2f6a8 0xf745469c
0x4db2f6c0 0xf7454815
0x4db2f6d0 0xf76312d3
0x4db2f6e0 0x4dabc7c0
0xf7667417 0x00100083>
```
Is it possible to instrument such type of applications with DynamoRIO at all (Windows DLL loaded in Linux)?
Contributor guide
Assessment
This issue has not been assessed yet.