DynamoRIO / DynamoRIO/dynamorio
Transparency violation in results of PR_GET_AUXV prctl when early injection is used
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 629
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 31
Description
When using early injection, results of PR_GET_AUXV prctl aren't correctly intercepted. As the real executable being exec'd is libdynamorio.so, this causes transparency violation.
Here's a reproducing case,
```C
#include
#include
#include
#include
int
main(void)
{
unsigned long my_auxv[128], my_at_entry;
prctl(0x41555856, my_auxv, sizeof(my_auxv), 0, 0);
for (int i = 0; my_auxv[i]; i += 2) {
if (my_auxv[i] == AT_ENTRY) {
my_at_entry = my_auxv[i + 1];
printf("PR_GET_AUXV: AT_ENTRY = 0x%lx\n", my_at_entry);
break;
}
}
unsigned long at_entry = getauxval(AT_ENTRY);
printf("getauxval: AT_ENTRY = 0x%lx\n", at_entry);
if (at_entry == my_at_entry)
puts("Entry point matches");
else
puts("Entry point mismatches");
return 0;
}
```
Running the case without DynamoRIO, with early injection or with late injection shows different results,
Without DynamoRIO,
```shell
$ ./test
PR_GET_AUXV: AT_ENTRY = 0x564c938a5080
getauxval: AT_ENTRY = 0x564c938a5080
Entry point matches
```
With late injection,
```shell
$ ./build/bin64/drrun -late -- ./test
PR_GET_AUXV: AT_ENTRY = 0x55b14aca4080
getauxval: AT_ENTRY = 0x55b14aca4080
Entry point matches
```
With early injection,
```shell
$ ./build/bin64/drrun ./test
PR_GET_AUXV: AT_ENTRY = 0x7f89a66c558d
getauxval: AT_ENTRY = 0x7f89a23fb080
Entry point mismatches
```
This could be reproduced on both glibc x86_64 and musl x86_64, actually it should be unrelated to architecture or libc implementation.
Contributor guide
Assessment
This issue has not been assessed yet.