Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CRASH injecting x64 in WOW64 #4990

Open
N0fix opened this issue Jul 1, 2021 · 2 comments
Open

CRASH injecting x64 in WOW64 #4990

N0fix opened this issue Jul 1, 2021 · 2 comments
Labels
Bug-DRCrash OpSys-Windows OpSys-x64 OpSys-x86

Comments

@N0fix
Copy link
Contributor

N0fix commented Jul 1, 2021 •
edited
Loading

Opening this issue to keep track of the bug associated with the PR.
Describe the bug

No support is made currently for x64 DLL injection in WOW64 processes. More information here

Example
There is no support for mixed code x86/x64 except using inject_x64 which isn't supported yet.

0x100000 mov eax, 0 // 32bits WoW64 application's code
0x100005 call 0x33:0x1000a0 
0x10000a ret
...
0x1000a0 sub rsp, 0x60 // x64 code

DynamoRIO core have mixed x86/x64 support in x64 builds, thus we need to inject x64 client DLL to handle this kind of situation, using inject_x64.
DynamoRIO crashes upon trying to inject x64 client dll inside WoW64 with the following command line :

bin64\drrun.exe -reachable_heap -inject_x64 -c .\clientdll.dll -- bin64\create_process.exe .\helloworld32.exe

Tweaking -early_inject parameters does not help to resolve this issue.

Versions
DynamoRIO version cronbuild-8.0.18803. (latest version at the time I am writing this issue)

Additional context

Made a PR#4989 to add some support.

All information are in the PR.

Note that this type of injection still isn't fully supported yet, and that some dynamoRIO exports might crash when used in 64client DLL injected in WoW64 processes. This is the case with dr_insert_mbr_instrumentation and dr_insert_call_instrumentation functions which inserts a x64 wrapper that cannot be decoded by a x86 running process.
@N0fix N0fix mentioned this issue Jul 1, 2021
Merged
@derekbruening
Copy link
Contributor

#49 is the original issue covering 64-bit DR in a WOW64 process.

derekbruening pushed a commit that referenced this issue Jul 13, 2021
@N0fix
i#4990: Fix support for inject_x64 inside WOW64 processes (#4989)
89841a1 
Fixes issues around the -inject_x64 prototype option added by PR #4653 for #803 to enable injecting a 64-bit DR into a WOW64 (32-bit) child ("mixed mode").

Xref discussion at https://groups.google.com/g/dynamorio-users/c/rhEpslerwf8

Adds a new option -vmheap_size_wow64 since the default x64 size will not fit in a WOW64 process.
Saves eax register that holds routine address for RtlUserThreadStart before mode switch, and restores it on mode switch.
Fixes far jmp to switch to x64 mode on injection.
Fixes env variable argument propagation.

Example command line that works :

  $ bin64\drrun.exe -inject_x64 -c .\clientdll.dll -- bin64\create_process.exe .\helloworld32.exe

We still need to add proper support on drrun64 to inject natively without having to use create_process.exe.

Issue: #49, #4990
@N0fix N0fix closed this as completed Jul 13, 2021
sapostolakis pushed a commit that referenced this issue Jul 14, 2021
@N0fix @sapostolakis
i#4990: Fix support for inject_x64 inside WOW64 processes (#4989)
8f85344 
Fixes issues around the -inject_x64 prototype option added by PR #4653 for #803 to enable injecting a 64-bit DR into a WOW64 (32-bit) child ("mixed mode").

Xref discussion at https://groups.google.com/g/dynamorio-users/c/rhEpslerwf8

Adds a new option -vmheap_size_wow64 since the default x64 size will not fit in a WOW64 process.
Saves eax register that holds routine address for RtlUserThreadStart before mode switch, and restores it on mode switch.
Fixes far jmp to switch to x64 mode on injection.
Fixes env variable argument propagation.

Example command line that works :

  $ bin64\drrun.exe -inject_x64 -c .\clientdll.dll -- bin64\create_process.exe .\helloworld32.exe

We still need to add proper support on drrun64 to inject natively without having to use create_process.exe.

Issue: #49, #4990
@N0fix
Copy link
Contributor Author

N0fix commented Aug 2, 2021

PR #4989 submitted to solve this issue is not working on latest builds. See this.

@N0fix N0fix reopened this Aug 2, 2021
N0fix added a commit to N0fix/dynamorio that referenced this issue Aug 2, 2021
@N0fix
i#4990: Cross injection x64 to x86 failing (DynamoRIO#803)
33c9185 
Fixes a small trouble cause by PR DynamoRIO#4710 making syscall fails upon when running WoW64 process injected by x64 parent.
Also add a check for inject_x64 option cross-injection based on win32.xarch test.

Fixes: DynamoRIO#4990
N0fix added a commit to N0fix/dynamorio that referenced this issue Aug 3, 2021
@N0fix
i#4990: Cross injection x64 to x86 failing (DynamoRIO#803)
ffa309e 
Fixes a small trouble cause by PR 4710 making syscall fails upon when running WoW64 process injected by x64 parent.
Also add a check for inject_x64 option cross-injection based on win32.xarch test.

Fixes: DynamoRIO#4990
N0fix added a commit to N0fix/dynamorio that referenced this issue Aug 3, 2021
@N0fix
i#4990: Cross injection x64 to x86 failing (DynamoRIO#803)
dea7a0b 
Fixes a small trouble cause by PR DynamoRIO#4710 making syscall fails upon when running WoW64 process injected by x64 parent.
Also add a check for inject_x64 option cross-injection based on win32.xarch test.

Fixes: DynamoRIO#4990
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Bug-DRCrash OpSys-Windows OpSys-x64 OpSys-x86
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@abhinav92003 @derekbruening @N0fix