Sample trcapi is causing an exception on a .NET (64 bit COR) executable
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 6.4k
- Forks
- 1.2k
- PR merge metrics
- No merged PRs in 30d
Description
Describe the bug
I am using trcapi to trace a malware sample. The malware sample executes normally without trcapi. However,
with tracapi(withdll.exe 64 bit since it is 64 bit COR), it is raising an exception.
The malware sample doesn't seem to have any anti-debug anit-hooking check.
Command-line test case
withdll.exe /d:trcapi64.dll Installer.exe
Expected behavior
Installer.exe creates a suspended process InstallUtil.exe. so we are expecting to see a CreateProcess event.
But it crashed half way:
20230124111232276 3532 50.60: trcapi64: 001 -RaiseException(,,,) ->
20230124111232276 ---- --.00: Error 1810889600 in (null).
```
Version 4.0.1 of Detours
```
Additional context
I am still trying to debug it and narrow down the issue a bit.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the reported 64-bit case with withdll.exe /d:trcapi64.dll Installer.exe, using Detours version 4.0.1. Inspect the trace around RaiseException and the attempted suspended InstallUtil.exe creation; done means the sample runs without crashing and the expected CreateProcess event appears.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- devtools, operating-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100