SideChannelMarvels / Tracer

Set of Dynamic Binary Instrumentation and visualization tools for execution traces.
GNU General Public License v3.0
297 stars 70 forks source link

Bug: Trace into fork + exec can not be parsed correctly, trace done with tracergrind #26

Open aeakoski opened 5 years ago

aeakoski commented 5 years ago

Getting error message when parsing a tracergrind trace with tools such as texttrace or sqlitetrace. An example of the error message is as follows

Disassembly failure at ExecMsg 279925!
Invalid message of type 192 encountered.

The error appears when you try to parse the trace of a program that uses fork and exec. The numbers stays the same between runs but changes when the program under trace is recompiled.

The bear bone source of a c++ program to reproduce the error is the following:

#include <iostream>
#include <unistd.h>
#include <sys/wait.h>

int main( int argc, char * argv[]) {

    int pid, status;

    if (pid = fork()) {
        // Parent process
        waitpid(pid, &status, 0); // Wait for the child to exit
    } else {
        // Child process
        const char executable[] = "./wbDES"; // The binary from Wyseur 2007 white box challenge
        execl(executable, executable, argv[1], argv[2], argv[3], argv[4], argv[5], argv[6], argv[7], argv[8], NULL);
    }
    return 0;
}

Compiled with g++ simple-tester.cpp -o w.out -m32 Traced with ``` valgrind --tool=tracergrind --output=t.grind --trace-children=yes --vex-iropt-register-updates=allregs-at-mem-access w.out 11 22 33 44 55 66 77 88


Error produced with ``` texttrace t.grind tt.tt ``` 
Alternatively with ``` sqlitetrace t.grind t.sqlite ``` but I guess they both use the same parser where the error occurs(?).

Any thoughts as to why this might happen or where I can look to find and maybe to fix the issue is appreciated, happy to help!