DynamoRIO / DynamoRIO/dynamorio

Transparency violation in results of PR_GET_AUXV prctl when early injection is used

Open
#7,491 3 comments 0 reactions 0 assignees View on GitHub
OpSys-Linux Transparency
Dominant language
C
Stars
3.2k
Forks
629
Avg merge
2d 15h
Merged PRs (30d)
31

Description

When using early injection, results of PR_GET_AUXV prctl aren't correctly intercepted. As the real executable being exec'd is libdynamorio.so, this causes transparency violation.

Here's a reproducing case,

```C
#include
#include
#include
#include

int
main(void)
{
unsigned long my_auxv[128], my_at_entry;
prctl(0x41555856, my_auxv, sizeof(my_auxv), 0, 0);

for (int i = 0; my_auxv[i]; i += 2) {
if (my_auxv[i] == AT_ENTRY) {
my_at_entry = my_auxv[i + 1];
printf("PR_GET_AUXV: AT_ENTRY = 0x%lx\n", my_at_entry);
break;
}
}

unsigned long at_entry = getauxval(AT_ENTRY);

printf("getauxval: AT_ENTRY = 0x%lx\n", at_entry);

if (at_entry == my_at_entry)
puts("Entry point matches");
else
puts("Entry point mismatches");

return 0;
}
```

Running the case without DynamoRIO, with early injection or with late injection shows different results,

Without DynamoRIO,

```shell
$ ./test
PR_GET_AUXV: AT_ENTRY = 0x564c938a5080
getauxval: AT_ENTRY = 0x564c938a5080
Entry point matches
```

With late injection,

```shell
$ ./build/bin64/drrun -late -- ./test

PR_GET_AUXV: AT_ENTRY = 0x55b14aca4080
getauxval: AT_ENTRY = 0x55b14aca4080
Entry point matches

```

With early injection,

```shell
$ ./build/bin64/drrun ./test

PR_GET_AUXV: AT_ENTRY = 0x7f89a66c558d
getauxval: AT_ENTRY = 0x7f89a23fb080
Entry point mismatches

```

This could be reproduced on both glibc x86_64 and musl x86_64, actually it should be unrelated to architecture or libc implementation.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.