DynamoRIO / DynamoRIO/dynamorio

drwrap handling of stack unwinding via SEH/longjmp

Open
#685 0 comments 0 reactions 0 assignees View on GitHub
Component-Extension Migrated Priority-Medium
Dominant language
C
Stars
3.2k
Forks
629
Avg merge
2d 15h
Merged PRs (30d)
31

Description

_From [bruen...@google.com](https://code.google.com/u/109494838902877177630/) on February 17, 2012 21:24:20_

drwrap handling of stack unwinding via SEH/longjmp

tailcalls are easy to handle as we see the post eventually. an unwind that bypasses all posts, though, and that may then re-grow the stack back to the same point and make esp comparisons moot, is problematic.

currently, only in post do we try to run all the post-hooks we missed. but it gets much more complex than that: on an exception, by the time we notice anything, let's say get back to a pre hook, esp can now be lower than a wrapped esp we stored. so how do we know whether to call? can of course intercept NtContinue, but what about longjmp or other arbitrary xsp change?

in DrMem, I was only hooking alloc routines, and on exception I assumed it
would travel out of the entire nested alloc stack and I reset the whole
thing to level 0. but can't assume that for arbitrary wrapping.

xref issue #120/PR 408545: handle exception in alloc routine: adjust state on unwind

first attempt:
try to handle SEH unwind and longjmp
- when notice post-calls that were bypassed abnormally,
call the post-call hook but pass NULL as wrapcxt
so user knows it's unusual
- on NtContinue, call all post-calls bypassed by target xsp,
and verify the rest by looking at retaddr to handle the case
of unwind and then re-extend stack (not bulletproof b/c of
stale retaddrs)
- after exception, verify all stored frames
- added a test that uses longjmp so cross-platform

later:
improve SEH unwind handling
- handle SEH return to same xsp
- support the user passing a flag that says to unwind
all levels when an exception occurs, instead of waiting
and trying to detect where the app unwind ends up.
this is the only way I could get DrMem and DrHeap
to work correctly: the heuristics ended up being
insufficient, the more tests I ran.

still not perfect. leaving this case open. intercepting longjmp in libc
would be a good next step though of course easy to hand-roll.

_Original issue: http://code.google.com/p/dynamorio/issues/detail?id=685_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.