DynamoRIO / DynamoRIO/dynamorio

Read-only ELF flat mappings misidentified as loaded modules

Open
#8,117 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
3.2k
Forks
629
Avg merge
2d 18h
Merged PRs (30d)
30

Description

If an application flat-maps an ELF file as read-only (e.g., `r--s`), DynamoRIO sees the ELF program header and assumes it is a loaded module. This results in incorrect DR-internal module mappings if the ELF image's virtual-address span exceeds the flat mapping’s length.

Example scenario:
1. AppX maps the 29 KiB `libfoo.so` file as read-only data. Because the system uses 64 KiB pages, the mapping occupies one 64 KiB page at address `A`.
2. The ELF program headers describe a loaded layout spanning about 200 KiB.
3. AppX creates an anonymous JIT region inside that larger address range and executes code from it.
4. When DynamoRIO attaches using `dr_app_setup_and_start()`, its address space scan incorrectly treats the full ELF layout as libfoo.so. It therefore reports the JIT code as part of `libfoo.so`.

Code path:

In the `os_walk_address_space()` function, DR checks only if a header is present, not if it is an actual module:

https://github.com/DynamoRIO/dynamorio/blob/fb0dd19fe01674d888eef97dcda288b9fcc63a6d/core/unix/os.c#L10276-L10279

Interestingly, the mmap interceptor already accounts for a similar case:

https://github.com/DynamoRIO/dynamorio/blob/fb0dd19fe01674d888eef97dcda288b9fcc63a6d/core/unix/os.c#L8968-L8981

Contributor guide

Open the contributing guide

Research direction

Start in core/unix/os.c at os_walk_address_space() around lines 10276-10279 and compare its ELF-header check with the mmap interceptor around lines 8968-8981. Trace how a read-only flat mapping is classified, then verify that the mapped file is not treated as a module spanning its full ELF virtual-address range and that the anonymous JIT region is not reported as part of it.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, linux
Domain
operating-systems
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
70/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.