rofl0r / rofl0r/proxychains-ng

OS X: Segmentation Fault when Ran proxychains4 with alpine

Open
#111 19 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C
Stars
10.7k
Forks
1.1k
PR merge metrics
No merged PRs in 30d

Description

OS X version: El Capitan (10.11.3)
proxychains version: proxychains-ng 4.11 (via Homebrew)
alpine version: Alpine 2.20 (OSX 67 2015-01-07) (via Homebrew)

I used to ran proxychains4 alpine on my GNU/Linux desktop and it worked well.

When I tried to run the same cmd on my Mac, I got a Segmentation Fault:

$ proxychains4 alpine
[proxychains] config file found: /Users/ray/.proxychains/proxychains.conf
[proxychains] preloading /usr/local/Cellar/proxychains-ng/4.11/lib/libproxychains4.dylib
Segmentation fault: 11

Tried it in lldb and got result as below:

$ lldb proxychains4
(lldb) target create "proxychains4"
Current executable set to 'proxychains4' (x86_64).
(lldb) run alpine
Process 8226 launched: '/usr/local/bin/proxychains4' (x86_64)
[proxychains] config file found: /Users/ray/.proxychains/proxychains.conf
[proxychains] preloading /usr/local/Cellar/proxychains-ng/4.11/lib/libproxychains4.dylib
Process 8226 stopped
* thread #1: tid = 0x1ccaf, 0x00007fff5fc01000 dyld`_dyld_start, stop reason = exec
    frame #0: 0x00007fff5fc01000 dyld`_dyld_start
dyld`_dyld_start:
->  0x7fff5fc01000 <+0>: popq   %rdi
    0x7fff5fc01001 <+1>: pushq  $0x0
    0x7fff5fc01003 <+3>: movq   %rsp, %rbp
    0x7fff5fc01006 <+6>: andq   $-0x10, %rsp

And the corefile:

$ lldb proxychains4 --core /cores/core.7574
(lldb) target create "proxychains4" --core "/cores/core.7574"
warning: (x86_64) /cores/core.7574 load command 113 LC_SEGMENT_64 has a fileoff + filesize (0x28875000) that extends beyond the end of the file (0x28874000), the segment will be truncated to match
Core file '/cores/core.7574' (x86_64) was loaded.
(lldb) bt all
* thread #1: tid = 0x0000, 0x00007fff9175aa1f libheimdal-asn1.dylib`der_free_integer + 4, stop reason = signal SIGSTOP
  * frame #0: 0x00007fff9175aa1f libheimdal-asn1.dylib`der_free_integer + 4
    frame #1: 0x00007fff9175e37d libheimdal-asn1.dylib`_asn1_free + 246
    frame #2: 0x00007fff9175e3c0 libheimdal-asn1.dylib`_asn1_free + 313
    frame #3: 0x00007fff9175e42b libheimdal-asn1.dylib`_asn1_free + 420
    frame #4: 0x00007fff9175e3c0 libheimdal-asn1.dylib`_asn1_free + 313
    frame #5: 0x00007fff9175e3c0 libheimdal-asn1.dylib`_asn1_free + 313
    frame #6: 0x00007fff9175e42b libheimdal-asn1.dylib`_asn1_free + 420
    frame #7: 0x00007fff9175e3c0 libheimdal-asn1.dylib`_asn1_free + 313
    frame #8: 0x00007fff9175e3c0 libheimdal-asn1.dylib`_asn1_free + 313
    frame #9: 0x00007fff9175d77e libheimdal-asn1.dylib`_asn1_free_top + 18
    frame #10: 0x00007fff95b65bad Heimdal`krb5_free_principal + 22
    frame #11: 0x00007fff8ebbd6a3 Kerberos`krb5_free_principal + 51
    frame #12: 0x00007fff99781722 GSS`_gsskrb5_release_name + 66
    frame #13: 0x00007fff9978a99c GSS`_gss_mg_release_name + 63
    frame #14: 0x00007fff8ab6a0a3 CoreFoundation`CFRelease + 371
    frame #15: 0x00007fff9978b018 GSS`gss_release_name + 35
    frame #16: 0x0000000105ea30f9 alpine`auth_gssapi_valid + 200
    frame #17: 0x0000000105ebf102 alpine`auth_link + 28
    frame #18: 0x0000000105d14c47 alpine`main + 1159
    frame #19: 0x00007fff8ea065ad libdyld.dylib`start + 1
    frame #20: 0x00007fff8ea065ad libdyld.dylib`start + 1

  thread #2: tid = 0x0001, 0x00007fff9944d176 libsystem_kernel.dylib`__select + 10, stop reason = signal SIGSTOP
    frame #0: 0x00007fff9944d176 libsystem_kernel.dylib`__select + 10
    frame #1: 0x0000000106250aa6 libproxychains4.dylib`getmessage + 129
    frame #2: 0x0000000106250cbc libproxychains4.dylib`threadfunc + 56
    frame #3: 0x00007fff92900c13 libsystem_pthread.dylib`_pthread_body + 131
    frame #4: 0x00007fff92900b90 libsystem_pthread.dylib`_pthread_start + 168
    frame #5: 0x00007fff928fe375 libsystem_pthread.dylib`thread_start + 13

  thread #3: tid = 0x0002, 0x00007fff9944d6de libsystem_kernel.dylib`__workq_kernreturn + 10, stop reason = signal SIGSTOP
    frame #0: 0x00007fff9944d6de libsystem_kernel.dylib`__workq_kernreturn + 10
    frame #1: 0x00007fff92900729 libsystem_pthread.dylib`_pthread_wqthread + 1283
    frame #2: 0x00007fff928fe365 libsystem_pthread.dylib`start_wqthread + 13

  thread #4: tid = 0x0003, 0x00007fff9944dff6 libsystem_kernel.dylib`kevent_qos + 10, stop reason = signal SIGSTOP
    frame #0: 0x00007fff9944dff6 libsystem_kernel.dylib`kevent_qos + 10
    frame #1: 0x00007fff91520099 libdispatch.dylib`_dispatch_mgr_invoke + 216
    frame #2: 0x00007fff9151fd01 libdispatch.dylib`_dispatch_mgr_thread + 52

  thread #5: tid = 0x0004, 0x00007fff9944d6de libsystem_kernel.dylib`__workq_kernreturn + 10, stop reason = signal SIGSTOP
    frame #0: 0x00007fff9944d6de libsystem_kernel.dylib`__workq_kernreturn + 10
    frame #1: 0x00007fff92900729 libsystem_pthread.dylib`_pthread_wqthread + 1283
    frame #2: 0x00007fff928fe365 libsystem_pthread.dylib`start_wqthread + 13

  thread #6: tid = 0x0005, 0x00007fff9944d6de libsystem_kernel.dylib`__workq_kernreturn + 10, stop reason = signal SIGSTOP
    frame #0: 0x00007fff9944d6de libsystem_kernel.dylib`__workq_kernreturn + 10
    frame #1: 0x00007fff92900729 libsystem_pthread.dylib`_pthread_wqthread + 1283
    frame #2: 0x00007fff928fe365 libsystem_pthread.dylib`start_wqthread + 13

I'm not sure if those msg is enough to address the problem.
Should I recompile both proxychains and alpine from src with debug flag enabled and produce another corefile then?

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing proxychains4 alpine on OS X with the reported versions, then inspect the core backtrace around libproxychains4.dylib and Alpine's auth_gssapi_valid. Compare behavior with Alpine unproxied and collect debug builds if needed. Done means the command no longer segfaults under proxychains on the reported macOS setup, with the cause and verification documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, macos
Domain
operating-systems, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.