Creating an issue to keep track of log files. Conversation started here: <a href="

APPCRASH in HelloWorld C# Console Application about winafl HOT 2 OPEN

googleprojectzero commented on July 24, 2024

APPCRASH in HelloWorld C# Console Application

from winafl.

Comments (2)

florax-k commented on July 24, 2024

log.0.1976.html.txt

from winafl.

derekbruening commented on July 24, 2024

Unfortunately it's not a straightforward decoder issue such as avx512 or something. The win32 start address of the thread is bogus. However, there is something strange here: this is the main thread (it's log.0.*), and default injection on Windows is much later than this. What injection was used here? Is this a child process where the parent was under DR control?

interp: start_pc = 0x00007ffd90b213cd
  0x00007ffd90b213cd  48 8b cf             mov    %rdi -> %rcx
  0x00007ffd90b213d0  ff d3                call   %rbx %rsp -> %rsp 0xfffffff8(%rsp)[8byte]
end_pc = 0x00007ffd90b213d2

Fragment 8, tag 0x00007ffd90b213cd, flags 0x1000030, shared, size 33:
        [KERNEL32.dll~BaseThreadInitThunk+0x1d,~TermsrvOpenRegEntry-0x43]
Entry into F8(0x00007ffd90b213cd).0x0000000b2b8a1158 (shared)
        
Exit from sourceless ibl: bb call*      []
 (target 0x0000000bab820000 not in cache)
fragment_add_ibl_target tag 0x0000000bab820000, branch 1, F0 

...

interp: start_pc = 0x0000000bab820000
stack vs 0x0000000bab820000: official 0x0000000bab860000..0x0000000babc60000, esp 0x0000000babc5f788
new shared vm area: 0x0000000bab820000-0x0000000bab821000 ---- unexpected vm area HelloWorld.exe
  0x0000000bab820000  4d 5a                pop    %rsp (%rsp)[8byte] -> %r10 %rsp
  0x0000000bab820002  90                   nop
  0x0000000bab820003  00 03                add    %al (%rbx)[1byte] -> (%rbx)[1byte]
  0x0000000bab820005  00 00                add    %al (%rax)[1byte] -> (%rax)[1byte]
  0x0000000bab820007  00 04 00             add    %al (%rax,%rax)[1byte] -> (%rax,%rax)[1byte]
  0x0000000bab82000a  00 00                add    %al (%rax)[1byte] -> (%rax)[1byte]
SYSLOG_WARNING: Invalid opcode encountered
Invalid opcode @0x0000000bab82000c: 0xff0027
decode: invalid instr at 0x0000000bab82000c
  0x0000000bab82000c  ff ff...??           <INVALID>

from winafl.

Recommend Projects