DynamoRIO / DynamoRIO/dynamorio
Dr. STrace internal crash occurs while attempting to trace a .exe
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 629
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 31
Description
**Describe the bug**
I was attempting to use drstrace.exe to follow the execution of a .exe and then a drstrace.exe crash occurs.
The following is the command line I use
C:\Users\scf>c:\Users\scf\Desktop\Stuff\DrMemory-Windows-2.3.0-1\bin\drstrace.exe -dr_ops "-dumpcore_mask 0x8bff" -no_follow_children "C:\Program Files\corz\checksum\checksum.exe" vrd("C:\Users\scf\Desktop\Stuff\tw") "C:\ProgramData\myHashes"
**To Reproduce**
Steps to reproduce the behavior:
1. I downloaded the checksum utility from https://corz.org/windows/software/checksum/#section-Download (I have a problem using that app on my machine where it won't verify the hashes and I was aiming to investigate that with drstrace.exe)
2. See above. It fails, with or without the dr_ops
3. I see
```
C:\Users\scf>c:\Users\scf\Desktop\Stuff\DrMemory-Windows-2.3.0-1\bin\drstrace.exe -dr_ops "-dumpcore_mask 0x8bff" -no_follow_children "C:\Program Files\corz\checksum\checksum.exe" vrd("C:\Users\scf\Desktop\Stuff\tw") "C:\ProgramData\myHashes"
_EVENT_BASIC_INFORMATION structure has unknown types_EVENT_BASIC_INFORMATION structure has unknown types_ALPC_BASIC_INFORMATION structure has unknown types_ALPC_BASIC_INFORMATION structure has unknown types_ALPC_BASIC_INFORMATION structure has unknown types_ALPC_BASIC_INFORMATION structure has unknown types_ALPC_BASIC_INFORMATION structure has unknown types_ALPC_BASIC_INFORMATION structure has unknown types
```
Please also answer these questions:
- What happens when you run without any client? The checksum.exe program does not crash
- What happens when you run with debug build ("-debug" flag to drrun/drconfig/drinject)? I still see a crash
```
C:\Users\scf>c:\Users\scf\Desktop\Stuff\DrMemory-Windows-2.3.0-1\bin\drstrace.exe -debug -no_follow_children "C:\Program Files\corz\checksum\checksum.exe" vrd("C:\Users\scf\Desktop\Stuff\tw") "C:\ProgramData\myHashes"
_EVENT_BASIC_INFORMATION structure has unknown types_EVENT_BASIC_INFORMATION structure has unknown types_ALPC_BASIC_INFORMATION structure has unknown types_ALPC_BASIC_INFORMATION structure has unknown types_ALPC_BASIC_INFORMATION structure has unknown types_ALPC_BASIC_INFORMATION structure has unknown types_ALPC_BASIC_INFORMATION structure has unknown types_ALPC_BASIC_INFORMATION structure has unknown types
```
**Expected behavior**
I expect to be about to get an drstrace log I can inspect.
**Screenshots or Pasted Text**
See above
**Versions**
- What version of DynamoRIO are you using? The 2.3.0 release:
- Does the latest build from https://github.com/DynamoRIO/dynamorio/releases solve the problem? This was latest
- What operating system version are you running on? ("Windows 10" is *not* sufficient: give the release number.) This is on Windows 21H1 - 19043.928
- Is your application 32-bit or 64-bit?
**Additional context**
[checksum.exe.13092.00000000.ldmp.zip](https://github.com/DynamoRIO/dynamorio/files/6360686/checksum.exe.13092.00000000.ldmp.zip)
Contributor guide
Assessment
This issue has not been assessed yet.