DynamoRIO / DynamoRIO/dynamorio

dr_insert_clean_call with where=NULL silently adding instrs at wrong spot instead of failing

Open
#5,290 4 comments 0 reactions 0 assignees View on GitHub
Bug-ToolFail
Dominant language
C
Stars
3.2k
Forks
629
Avg merge
2d 15h
Merged PRs (30d)
31

Description

Inserting a clean call at the end of an instruction list doesn't behave as expected. When instr_get_next(instr) == NULL the call seems to be executed before instr is hit

The goal is to change this
mov rcx, [rsi+8]
call (some function)
**end of bb

To this

mov rcx, [rsi+8]
call 1st instrumentation
call (some function)
call 2nd instrumentation
**end of bb

End Behavior:

mov rcx, [rsi+8]
call 1st instrumentation
call 2nd instrumentation
call (some function)
**end of bb

Basic reproduce code. Notice how calls never goes above 0 unless ret is removed

dr_emit_flags_t on_bb_instrument(void *drcontext, void *tag, instrlist_t *bb, instr_t *inst, bool for_trace, bool translating, void *user_data) {

if (instr_is_app(inst)) {
if(instr_is_call_direct(inst)) {
dr_insert_clean_call(drcontext, bb, instr, call, false, 0);
dr_insert_clean_call(drcontext, bb, instr_get_next(instr), ret, false, 0);
}
}
else {
dr_printf("not app pc\n");
}

return DR_EMIT_DEFAULT;
}

uint calls = 0;
void call(Instr_S *CurrentInstr) {
dr_printf("%d\n", calls);
calls++;
}

void ret() {
calls--;
}

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.