search

DynamoRIO / dynamorio

Dynamic Instrumentation Tool Platform
Other
2.64k stars 560 forks source link

CRASH when using dtltrace #3670

Open jackery001 opened 5 years ago

jackery001 commented 5 years ago

When using drltrace to record the call of adobe's program to cooltype, a crash occurs. After preliminary analysis, the reason for the crash is that the first parameter of the thread_get_mcontext function is NULL. I don't know why the parameter is empty.

os: win10 1809x64 17763.503 command line: drrun.exe -c drltrace.dll -only_to_lib CoolType -- "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" stack information: DrLTrace internal crash at PC 0x69bbb1e7. Please report this at http://dynamorio.org/issues. Program aborted. 0xc0000005 0x00000000 0x69bbb1e7 0x69bbb1e7 0x00000000 0x00000004 Base: 0x69b10000 Registers: eax=0x1ef1e914 ebx=0x1eef5040 ecx=0x000004e3 edx=0x00000000 esi=0x1ef1e914 edi=0x1eeff2fc esp=0x1ef1e904 ebp=0x00000003 eflags=0x00010 version 7.0.0, build 1 edx is the first parameter of the thread_get_mcontext.

hgreving2304 commented 5 years ago

Are you able to run w/ debug and generate a log file, and maybe a call stack of the crash?

On Tue, Jun 4, 2019 at 6:22 PM jackery001 notifications@github.com wrote:

When using drltrace to record the call of adobe's program to cooltype, a crash occurs. After preliminary analysis, the reason for the crash is that the first parameter of the thread_get_mcontext function is NULL. I don't know why the parameter is empty.

os: win10 1809x64 17763.503 command line: drrun.exe -c drltrace.dll -only_to_lib CoolType -- "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" stack information: DrLTrace internal crash at PC 0x69bbb1e7. Please report this at http://dynamorio.org/issues. Program aborted. 0xc0000005 0x00000000 0x69bbb1e7 0x69bbb1e7 0x00000000 0x00000004 Base: 0x69b10000 Registers: eax=0x1ef1e914 ebx=0x1eef5040 ecx=0x000004e3 edx=0x00000000 esi=0x1ef1e914 edi=0x1eeff2fc esp=0x1ef1e904 ebp=0x00000003 eflags=0x00010 version 7.0.0, build 1 edx is the first parameter of the thread_get_mcontext.

— You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub https://github.com/DynamoRIO/dynamorio/issues/3670?email_source=notifications&email_token=AKK7Q5POWLXZ37Y7544TD2LPY4IN3A5CNFSM4HTKTT4KYY3PNVWWK3TUL52HS4DFUVEXG43VMWVGG33NNVSW45C7NFSM4GXVFGWQ, or mute the thread https://github.com/notifications/unsubscribe-auth/AKK7Q5K5SGRBTUCQMAZVLU3PY4IN3ANCNFSM4HTKTT4A .

jackery001 commented 5 years ago

Are you able to run w/ debug and generate a log file, and maybe a call stack of the crash? … On Tue, Jun 4, 2019 at 6:22 PM jackery001 @.***> wrote: When using drltrace to record the call of adobe's program to cooltype, a crash occurs. After preliminary analysis, the reason for the crash is that the first parameter of the thread_get_mcontext function is NULL. I don't know why the parameter is empty. os: win10 1809x64 17763.503 command line: drrun.exe -c drltrace.dll -only_to_lib CoolType -- "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" stack information: DrLTrace internal crash at PC 0x69bbb1e7. Please report this at http://dynamorio.org/issues. Program aborted. 0xc0000005 0x00000000 0x69bbb1e7 0x69bbb1e7 0x00000000 0x00000004 Base: 0x69b10000 Registers: eax=0x1ef1e914 ebx=0x1eef5040 ecx=0x000004e3 edx=0x00000000 esi=0x1ef1e914 edi=0x1eeff2fc esp=0x1ef1e904 ebp=0x00000003 eflags=0x00010 version 7.0.0, build 1 edx is the first parameter of the thread_get_mcontext. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#3670?email_source=notifications&email_token=AKK7Q5POWLXZ37Y7544TD2LPY4IN3A5CNFSM4HTKTT4KYY3PNVWWK3TUL52HS4DFUVEXG43VMWVGG33NNVSW45C7NFSM4GXVFGWQ>, or mute the thread https://github.com/notifications/unsubscribe-auth/AKK7Q5K5SGRBTUCQMAZVLU3PY4IN3ANCNFSM4HTKTT4A .

An assertion error occurs when the log is printed. The cause of the error cannot be seen from the existing log. as follows: SYSLOG_ERROR: Application C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe (10996). Internal Error: DynamoRIO debug check failure: D:\dynamorio_package\core\win32\callback.c:3716 instr_get_opcode(&instr) == OP_lea && (opnd_get_disp(instr_get_src(&instr, 0)) == 0x10 || opnd_get_disp(instr_get_src(&instr, 0)) == 0x2dc) (Error occurred @0 frags) version 7.0.0, build 1