CRASH at int 0x2e on win10 1909 at DR init
I've hit this in two scenarios now: one investigating Dr. Memory symbol generation problems for 32-bit on win10 1909, and another with plain DR doing a bisect for #4421 .
The second is simpler. I'm just running:
bin32/drrun -stderr_mask 15 -t drcov -- suite/tests/bin/common.segfault.exe
The crash is reported like this:
---------------------------
DrCov Notice: D:\derek\dr\git\build_x86_dbg_tests\suite\tests\bin\common.segfault.exe(9984)
---------------------------
Application D:\derek\dr\git\build_x86_dbg_tests\suite\tests\bin\common.segfault.exe (9984). DrCov internal crash at PC 0x5fab9a42. Please report this at http://dynamorio.org/issues. Program aborted.
0xc0000005 0x00000000 0x5fab9a42 0x5fab9a42 0x00000000 0xffffffff
Base: 0x5f840000
Registers: eax=0x00000023 ebx=0x7682f4b0 ecx=0x0000004c edx=0x00fee42c
esi=0x00000000 edi=0x00fefe44 esp=0x00fee424 ebp=0x00fee46c
eflags=0x00010202
version 8.0.18439, custom build
-no_dynamic_options -client_lib 'D:\derek\dr\git\build_x86_dbg_tests\clients\lib32\debug\drcov.dll;0;' -client_lib32 'D:\derek\dr\git\build_x86_dbg_tests\clients\lib32\debug\drcov.dll;0;' -client_lib64 'D:\derek\dr\git\build_x86_dbg_tests\clients\lib32\debug\drcov.dll;0;' -code_api -probe_api -stderr_mask 15 -stack_size
0x00fee46c 0x5fb10b8d
0x00fee49c 0x5fad8884
0x00fee4cc 0x5f9801d5
0x00fee550 0x5fafb2ab
0x00fee5b4 0x5faeba04
0x00fee5f0 0x5faf9ea7
0x00fef24c 0x5f84cdae
0x00fefb08 0x5fab8ea1
0x00fefb70 0x5fab9808
---------------------------
OK
---------------------------
The debugger shows that's a read of -1 at int 0x2e
during DR init:
0:000> .exr @@(pExcptRec)
ExceptionAddress: 5fac9752 (dynamorio!dynamorio_syscall_int2e+0x00000008)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: ffffffff
Attempt to read from address ffffffff
0:000> .cxr @@(cxt)
eax=00000023 ebx=7682f4b0 ecx=0000004c edx=010fe52c esi=00000000 edi=010fff44
eip=5fac9752 esp=010fe524 ebp=010fe56c iopl=0 nv up ei pl nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010202
dynamorio!dynamorio_syscall_int2e+0x8:
5fac9752 cd2e int 2Eh
0:000> kn
*** Stack trace for last set context - .thread/.cxr resets it
# ChildEBP RetAddr
00 010fe56c 5fb208ad dynamorio!dynamorio_syscall_int2e+0x8 [D:\derek\dr\git\build_x86_dbg_tests\core\CMakeFiles\dynamorio.dir\arch\x86\x86.asm.obj.s @ 2354]
01 010fe59c 5fae8574 dynamorio!query_virtual_memory+0x1d [d:\derek\dr\git\src\core\win32\ntdll.c @ 2181]
02 010fe5cc 5f9900d5 dynamorio!get_allocation_base+0x14 [d:\derek\dr\git\src\core\win32\os.c @ 5485]
03 010fe650 5fb0afab dynamorio!alloc_landing_pad+0x25 [d:\derek\dr\git\src\core\heap.c @ 5686]
04 010fe6b4 5fafb6f4 dynamorio!intercept_syscall_wrapper+0x17b [d:\derek\dr\git\src\core\win32\callback.c @ 2634]
05 010fe6f0 5fb09ba7 dynamorio!init_syscall_trampolines+0x114 [d:\derek\dr\git\src\core\win32\syscall.c @ 891]
06 010ff34c 5f85cd5e dynamorio!callback_interception_init_finish+0x1d7 [d:\derek\dr\git\src\core\win32\callback.c @ 7805]
07 010ffc08 5fac8bb1 dynamorio!dynamorio_app_init+0x61e [d:\derek\dr\git\src\core\dynamo.c @ 692]
08 010ffc70 5fac9518 dynamorio!auto_setup+0x21 [d:\derek\dr\git\src\core\arch\x86_code.c @ 169]
09 00000000 00000000 dynamorio!dynamo_auto_start+0x8 [D:\derek\dr\git\build_x86_dbg_tests\core\CMakeFiles\dynamorio.dir\arch\x86\x86.asm.obj.s
At first I thought that 1909 dropped support for int 0x2e
: but DR uses it and works in other builds, including 8.0.0-1 and HEAD.
For the DrM case I did investigate the page for pc:
dynamorio!dynamorio_syscall_int2e+0x8:
6d938a42 cd2e int 2Eh
0:000> !vprot eip
BaseAddress: 6d938000
AllocationBase: 6d6c0000
AllocationProtect: 00000080 PAGE_EXECUTE_WRITECOPY
RegionSize: 0009f000
State: 00001000 MEM_COMMIT
Protect: 00000020 PAGE_EXECUTE_READ
Type: 01000000 MEM_IMAGE
I made an app that does an int 2e for NtYieldExecution and it also gets a segfault there:
#include <stdio.h>
int main() {
fprintf(stderr, "about to asm\n");
__asm {
mov eax,46h
lea edx,[esp]
int 2eh
};
fprintf(stderr, "just did asm\n");
return 0;
}
0:000> g
(3460.1300): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
*** WARNING: Unable to verify checksum for int2e.exe
eax=00000046 ebx=00456000 ecx=00270a0d edx=006ffdfc esi=002c1c8c edi=00915e50
eip=00266573 esp=006ffdfc ebp=006ffdfc iopl=0 nv up ei pl nz na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010206
int2e!main+0x23:
00266573 cd2e int 2Eh
0:000> .exr -1
ExceptionAddress: 00266573 (int2e!main+0x00000023)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: ffffffff
Attempt to read from address ffffffff
Hmm so how does it work with some DR builds?