DynamoRIO / DynamoRIO/dynamorio
Crashing DR client when a process sets Trap flag
Open
Bug-DRCrash
OpSys-Windows
Status-NeedInfo
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 629
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 31
Description
Some malware changes page protection to PAGE_NOACCESS and executes a code from the code, which causes to trigger a handler, usually, the handler is registered beforehand and the handler just changes protection back to RX (or RWX) and continues execution.
When a process is under DR client, the client crashes with EXCEPTION_ACCESS_VIOLATION error instead of passing the exception to the process and continue execution.
*more about the trick: https://secrary.com/Random/anti_re_simple/
Contributor guide
Assessment
This issue has not been assessed yet.