DynamoRIO / DynamoRIO/dynamorio

Dr. STrace internal crash occurs while attempting to trace a .exe

Open
#4,871 1 comment 0 reactions 0 assignees View on GitHub
Bug-ToolCrash OpSys-Windows
Dominant language
C
Stars
3.2k
Forks
629
Avg merge
2d 15h
Merged PRs (30d)
31

Description

**Describe the bug**

I was attempting to use drstrace.exe to follow the execution of a .exe and then a drstrace.exe crash occurs.

The following is the command line I use

C:\Users\scf>c:\Users\scf\Desktop\Stuff\DrMemory-Windows-2.3.0-1\bin\drstrace.exe -dr_ops "-dumpcore_mask 0x8bff" -no_follow_children "C:\Program Files\corz\checksum\checksum.exe" vrd("C:\Users\scf\Desktop\Stuff\tw") "C:\ProgramData\myHashes"

**To Reproduce**
Steps to reproduce the behavior:
1. I downloaded the checksum utility from https://corz.org/windows/software/checksum/#section-Download (I have a problem using that app on my machine where it won't verify the hashes and I was aiming to investigate that with drstrace.exe)
2. See above. It fails, with or without the dr_ops
3. I see

```
C:\Users\scf>c:\Users\scf\Desktop\Stuff\DrMemory-Windows-2.3.0-1\bin\drstrace.exe -dr_ops "-dumpcore_mask 0x8bff" -no_follow_children "C:\Program Files\corz\checksum\checksum.exe" vrd("C:\Users\scf\Desktop\Stuff\tw") "C:\ProgramData\myHashes"

_EVENT_BASIC_INFORMATION structure has unknown types_EVENT_BASIC_INFORMATION structure has unknown types_ALPC_BASIC_INFORMATION structure has unknown types_ALPC_BASIC_INFORMATION structure has unknown types_ALPC_BASIC_INFORMATION structure has unknown types_ALPC_BASIC_INFORMATION structure has unknown types_ALPC_BASIC_INFORMATION structure has unknown types_ALPC_BASIC_INFORMATION structure has unknown types
```

Please also answer these questions:
- What happens when you run without any client? The checksum.exe program does not crash
- What happens when you run with debug build ("-debug" flag to drrun/drconfig/drinject)? I still see a crash
```
C:\Users\scf>c:\Users\scf\Desktop\Stuff\DrMemory-Windows-2.3.0-1\bin\drstrace.exe -debug -no_follow_children "C:\Program Files\corz\checksum\checksum.exe" vrd("C:\Users\scf\Desktop\Stuff\tw") "C:\ProgramData\myHashes"

_EVENT_BASIC_INFORMATION structure has unknown types_EVENT_BASIC_INFORMATION structure has unknown types_ALPC_BASIC_INFORMATION structure has unknown types_ALPC_BASIC_INFORMATION structure has unknown types_ALPC_BASIC_INFORMATION structure has unknown types_ALPC_BASIC_INFORMATION structure has unknown types_ALPC_BASIC_INFORMATION structure has unknown types_ALPC_BASIC_INFORMATION structure has unknown types
```

**Expected behavior**
I expect to be about to get an drstrace log I can inspect.

**Screenshots or Pasted Text**

See above

**Versions**
- What version of DynamoRIO are you using? The 2.3.0 release:
- Does the latest build from https://github.com/DynamoRIO/dynamorio/releases solve the problem? This was latest
- What operating system version are you running on? ("Windows 10" is *not* sufficient: give the release number.) This is on Windows 21H1 - 19043.928
- Is your application 32-bit or 64-bit?

**Additional context**

[checksum.exe.13092.00000000.ldmp.zip](https://github.com/DynamoRIO/dynamorio/files/6360686/checksum.exe.13092.00000000.ldmp.zip)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.