DynamoRIO / DynamoRIO/dynamorio
Read-only ELF flat mappings misidentified as loaded modules
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 629
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 30
Description
If an application flat-maps an ELF file as read-only (e.g., `r--s`), DynamoRIO sees the ELF program header and assumes it is a loaded module. This results in incorrect DR-internal module mappings if the ELF image's virtual-address span exceeds the flat mapping’s length.
Example scenario:
1. AppX maps the 29 KiB `libfoo.so` file as read-only data. Because the system uses 64 KiB pages, the mapping occupies one 64 KiB page at address `A`.
2. The ELF program headers describe a loaded layout spanning about 200 KiB.
3. AppX creates an anonymous JIT region inside that larger address range and executes code from it.
4. When DynamoRIO attaches using `dr_app_setup_and_start()`, its address space scan incorrectly treats the full ELF layout as libfoo.so. It therefore reports the JIT code as part of `libfoo.so`.
Code path:
In the `os_walk_address_space()` function, DR checks only if a header is present, not if it is an actual module:
https://github.com/DynamoRIO/dynamorio/blob/fb0dd19fe01674d888eef97dcda288b9fcc63a6d/core/unix/os.c#L10276-L10279
Interestingly, the mmap interceptor already accounts for a similar case:
https://github.com/DynamoRIO/dynamorio/blob/fb0dd19fe01674d888eef97dcda288b9fcc63a6d/core/unix/os.c#L8968-L8981
Contributor guide
Research direction
Start in core/unix/os.c at os_walk_address_space() around lines 10276-10279 and compare its ELF-header check with the mmap interceptor around lines 8968-8981. Trace how a read-only flat mapping is classified, then verify that the mapped file is not treated as a module spanning its full ELF virtual-address range and that the anonymous JIT region is not reported as part of it.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, linux
- Domain
- operating-systems
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 70/100