DynamoRIO / DynamoRIO/dynamorio

CRASH : On cmake builds - "Could not read process memory" on trying to inject x86-64 process from WOW64 (32bits) using any tool/client since PRi#803

Open
#4,927 8 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
3.2k
Forks
629
Avg merge
2d 18h
Merged PRs (30d)
30

Description

## Describe the bug

Upon using any given tool (drcov/drstrace) or empty client to trace a 32 bits PE executable spawning a 64 bits PE executable, DynamoRIO throws an error stating that it cannot read memory (twice), than informs that he cannot inject to the target process due to "`Failed to follow into child process : Option propagation failed to find ProcessParameters.`"
Reading loaded modules in spawned target process using `Process Hacker 2` shows that DynamoRIO.dll is injected into the process at the time of the assert-popup stating "`Failed to follow into child process : Option propagation failed to find ProcessParameters.`".

Using old injection (adding `-late` option to `drrun.exe`) shows a different error (and no memory read error) : `"Failed to follow into child process: Failed to get context of child thread"`.

Additional information: the process is spawned and stays in a suspended state in both cases (`-late` or not). This might indicate that `dr_inject_process_create` is working fine but later injection fails (I guess that those are the API used by drrun, but I did not check that).

This behavior happens since [PRi#803](https://github.com/DynamoRIO/dynamorio/pull/4653). Any version prior to this PR just do not try to follow the child process.

## To Reproduce
Steps to reproduce the behavior:
### Create an empty client
```C
#include "dr_api.h"
DR_EXPORT void
dr_client_main(client_id_t id, int argc, const char* argv[]){ }
```
Compile it in 32 and 64 bits.

### Create the following application
Application is named "ConsoleApplication1.exe".
```C
#include "stdafx.h"
#include "windows.h"

int main()
{
STARTUPINFO si = { 0 };
PROCESS_INFORMATION pi = { 0 };
wchar_t cmd[] = L"C:\\fullprojectpath\\x64\\Release\\ConsoleApplication2.exe";
PVOID oldvalue;
#ifdef WIN32
MessageBoxA(nullptr, "ConsoleApp", "x86", MB_OK);
#else
MessageBoxA(nullptr, "ConsoleApp", "x64", MB_OK);
#endif
if (CopyFileA("ConsoleApplication1.exe", "ConsoleApplication2.exe", true)) {
int FLAGS = 0;
if (!Wow64DisableWow64FsRedirection(&oldvalue) || !CreateProcess(nullptr, cmd, 0, 0, 0, FLAGS, 0, 0, &si, &pi)) {
MessageBoxA(nullptr, "ConsoleApp", "Err spawning 64bits proc", MB_OK);
}
ExitProcess(0);
}
return 0;
}
```

Build it as x64 and win32 app.

### Instrument with drrun

Instrumenting the 32bits `ConsoleApplication1.exe`:
```
bin32\drrun.exe -debug -c32 .\dummy32.dll -- -c64 .\dummy64.dll -- .\ConsoleApplication1.exe
```
**Versions**
- This happens since [PRi#803](https://github.com/DynamoRIO/dynamorio/pull/4653). Still occurs on latest cronbuild.
- Reproduced behavior on Windows 7 SP1 6.1.7601 and on Windows 10 Build 18363.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.