search

geohot / qira

QEMU Interactive Runtime Analyser
MIT License
3.92k stars 471 forks source link

pthreads tracing seems to not work in docker #220

Open cromize opened 5 years ago

cromize commented 5 years ago

Threads ruined my CTF.

I was using qira inside docker on latest linux kernel and found out that code in threads is not traced. Tried to run manual thread test and indeed it failed to trace thread code. I tried to run older releases without docker with no problem.

Today I tried to run same test in vagrant 14.04 trusty vm and it successfully traced pthreads. I have no idea where to even start investigating this. (maybe docker syscall translation/isolation?)

Noticed there is occasional qemu: uncaught target signal 11 (Segmentation fault) after few seconds when running thread_test.c in pthread-working qira. (trusty 14.04 vagrant)

Docker version 18.06.1-ce, build e68fc7a Ubuntu 18.04.2 LTS

cromize commented 5 years ago

Also occasional qemu: uncaught target signal 4 (Illegal instruction) when running thread_test.c.

janbbeck commented 5 years ago

I just tried the thread_test.c example in tests_manual under Ubuntu 14.04 not using Docker for qira. The executable runs fine by itself. Plain qira results in a segmentation fault right away. qira --pin works fine. showing the threads and all.

cromize commented 5 years ago

Thread tracing also fails on macOS docker, even with turned off seccomp.

cromize commented 5 years ago

Thread tracing works on qemu-3.1.0 in docker ubuntu 18.04 #210 . Older patched qemu doesn't work in 16.04 or 14.04 docker, while unpatched works fine.

root@35dbd5416858:/qira/tracers/qemu# ./qira-x86_64 ../../tests_manual/thread_test longjmp causes uninitialized stack frame : ./qira-x86_64 terminated