DynamoRIO / dynamorio

Dynamic Instrumentation Tool Platform
Other
2.67k stars 562 forks source link

<APP CRASH> - Notepad++ Crashes with droption_t #5181

Open ghost opened 3 years ago

ghost commented 3 years ago

Describe the bug I want to parse arguments send to client dll by a front-end (similar to drrun.exe) via dr_register_client . To do this I'm using droption_parser_t on client side to parse arguments, it works on simple hello worlds apps but have issues with real works apps, for example, notepad++ (64bit) crashes instantly, even if there is no other code than droption_parser_t::parse_argv.

To Reproduce Steps to reproduce the behavior:

  1. compile a client dll with following code:
    DR_EXPORT void
    dr_client_main(client_id_t id, int argc, const char *argv[])
    {
    droption_t<std::string> first_arg(DROPTION_SCOPE_CLIENT, "aaa", "", "aaaaaa",
                                         "aaaaaaaaaaaaaa");
    droption_t<unsigned int> second_arg(DROPTION_SCOPE_CLIENT, "bbb", 0, "bbbbbb",
                                             "bbbbbbbbbbbbbbb");
    std::string parse_err;
    int last_index;
    if (!droption_parser_t::parse_argv(DROPTION_SCOPE_CLIENT, argc, argv, &parse_err, &last_index))
    {
    dr_fprintf(STDERR, "Usage error: %s", parse_err.c_str());
    dr_messagebox("argument parsing error");
    dr_abort();
    }
    }

My custom front-end have following code to provide arguments to the client:

client_id_t client_id = 0;
const auto client_options = "--aaa " + first_string.string() + " " +
                                "--bbb " + std::to_string(second_arg.get_value());
if (dr_register_client(process_name, pid, false /*local*/, DR_PLATFORM_DEFAULT, client_id, 0,
client_path.string().c_str(), client_options.c_str()) != DR_SUCCESS)
{
logger.logger->critical("dr_register_client function call failed");
exit(1);
}

If I run my client dll without droption_t and just hardcode the two values it works as excepted, no crashes. My guess is that there is an issue how args are provided or how they are parsed

  1. {..}/my_front.exe -c ./yourclient.dll -- 'C:\Program Files\Notepad++\notepad++.exe'
  2. The notepad++ will not even open

Please also answer these questions:

Expected behavior Open Notepad++

Versions

derekbruening commented 3 years ago

The droption docs say that options have to be global variables. Please try with globals.

ghost commented 3 years ago

I exported options out of main functions: (both from front-end and from client side)

static droption_t<std::string> ...

But having the same issue.

derekbruening commented 3 years ago

I would suggest getting a callstack of the crash point. If it is in droption static constructors it seems odd to depend on the app.

ghost commented 3 years ago

How can I get a callback of the crash point?

derekbruening commented 3 years ago

How can I get a callback of the crash point?

There is general debugging info in the docs: https://dynamorio.org/page_debugging.html#autotoc_md150

For an early crash like this I would run drrun inside windbg and walk into the child from there; or maybe the first -msgbox_mask 15 point is early enough before the crash to attach there. The symbol loading scripts in the docs may not work at early points: I don't remember if this client init point is before or after that works. But if you walk in from the parent windbg will see dynamorio.dll and you probably don't need custom load commands.