DynamoRIO / DynamoRIO/dynamorio

Crashing DR client when a process sets Trap flag

Open
#3,783 13 comments 0 reactions 0 assignees View on GitHub
Bug-DRCrash OpSys-Windows Status-NeedInfo
Dominant language
C
Stars
3.2k
Forks
629
Avg merge
2d 15h
Merged PRs (30d)
31

Description

Some malware changes page protection to PAGE_NOACCESS and executes a code from the code, which causes to trigger a handler, usually, the handler is registered beforehand and the handler just changes protection back to RX (or RWX) and continues execution.

When a process is under DR client, the client crashes with EXCEPTION_ACCESS_VIOLATION error instead of passing the exception to the process and continue execution.

*more about the trick: https://secrary.com/Random/anti_re_simple/

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.