DynamoRIO / DynamoRIO/dynamorio
load_dynamo() can silently fail during child / code injection on Windows
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 629
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 31
Description
# Describe the bug
During the code injection / dynamorio bringup within the target process, `LoadLibrary("dynamorio.dll")` can fail for any number of reasons. Worse is that there is no error logged and no notification to the user of this failure and `drrun.exe` waits for the process to exit as if everything is nominal.
# To Reproduce
Explicitly reproducing this might be difficult (ASLR randomness), but I have attached a TTD trace that can be used in WinDBG Preview to observe the execution of `drrun.exe` and the target process `ida64.exe` in an instance of this failure.
TTD Traces: https://drive.google.com/open?id=1URuyKYhMzR9QcBbYXVlnL9OB25cfGYnW
The code for the stub is found [here](https://github.com/DynamoRIO/dynamorio/blob/aa941e63c228be342897f010fac98d0270c4cb79/core/drlibc/drlibc_x86.asm#L661). To debug the `load_dynamo()` stub in the child trace, open `ida6401.run` with WinDBG Preview and run the following commands:
```
bp 0x0000026fe7df0000
g
```
The LoadLibrary call that fails is a few instructions later, at `0000026fe7df0015`. This is because the **static** imagebase for `dynamorio.dll` conflicted with libraries already loaded by the process.
(`dynamorio.dll` should be rebasable imo, but that's an entirely separate issue...)
Oh, and the command run in the VM was:
```
"C:\Users\User\Desktop\DynamoRIO-Windows-8.0.0-1\bin64\drrun.exe" -t drcov -- "C:\Program Files\IDA Freeware 7.0\ida64.exe"
```
# Expected behavior
If dynamorio cannot successfully initialize within the child process, there should be a message printed from `drrun.exe` stating such failure *and the child should exit*.
Alternatively, the injected stub should pop a [MessageBox](https://docs.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-messagebox) or something to notify of such failure.
In my opinion, it makes no sense to let the child process continue running if dynamorio cannot be injected. Why would I want it to continue running if the instrumentation can't be loaded?!? It's both confusing and less-indicative that something has gone very wrong.
# Versions
* Dynamorio 8.0.0-1 release for Windows, off the releases page.
* 64bit Windows 10 Enterprise, 1909 (18363.720)
* from https://developer.microsoft.com/en-us/windows/downloads/virtual-machines/
* Target / Child I tested with was IDA 7.0 Free (64-bit)
* https://www.hex-rays.com/products/ida/support/download_freeware/
# Additional context
The enterprise VM has some of the 'exploit guard' mitigations on, like high-entropy ASLR. These could be aggravating the issue but i'm not sure.
Special thanks to @toshipiazza for sweating it out with me while we spitballed ideas on the erratic failures. We burned a solid 6-8 hours tracking this issue down 😬
Contributor guide
Assessment
This issue has not been assessed yet.