DR fails after Windows 10 update

[fmunozs]

I was able to use dynamorio/drrun before installing Windows 10 updates, now when I start any application under it I get an error, this message appeared once:

Application C:\tools\covtest.exe (524). DynamoRIO internal crash at PC 0x61951fb8. Please report this at http://dynamorio.org/issues/. Program aborted.
0x80000004 0x00000000 0x61951fb8 0x61951fb8 0x00000000 0x00000000
Base: 0x618a0000
Registers: eax=0x00000000 ebx=0x001cdfb4 ecx=0xffffffff edx=0x17561578
esi=0x5e601c78 edi=0x1759b480 esp=0x175febec ebp=0x001ce004
eflags=0x0000
version 6.0.0, build 6
-no_dynamic_options -code_api -probe_api -stack_size 56K -max_elide_jmp 0 -max_elide_call 0 -no_inline_ignored_syscalls -native_exec_default_list '' -no_native_exec_managed_code -no_indcall2direct -no_aslr_dr -pad_jmps_mark_no_trace
0x001ce004 0x00000000
0x0001007f 0x00000000

And when trying it inside Windbg I got this exception:

1:004> g
ModLoad: 618a0000 619fa000 C:\tools\DynamoRIO\lib32\release\dynamorio.dll
(2fa8.24e8): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=00000000 ebx=00000000 ecx=00000000 edx=00000000 esi=00000000 edi=000cfcf4
eip=61940a87 esp=000cf958 ebp=00000000 iopl=0 nv up ei pl nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000202
dynamorio!dynamorio_syscall_wow64_noedx+0x1f:
61940a87 8b0c24 mov ecx,dword ptr [esp] ss:002b:000cf958=619593d8
1:004> g
(2fa8.24e8): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=c000007c ebx=00000000 ecx=00000000 edx=00000000 esi=00000000 edi=000cfcf4
eip=61940a87 esp=000cf8f0 ebp=00000000 iopl=0 nv up ei pl nz ac pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000216
dynamorio!dynamorio_syscall_wow64_noedx+0x1f:
61940a87 8b0c24 mov ecx,dword ptr [esp] ss:002b:000cf8f0=619593d8
1:004> k
ChildEBP RetAddr
00000000 00000000 dynamorio!dynamorio_syscall_wow64_noedx+0x1f [D:\derek\dr\build_package\build_release-32\core\CMakeFiles\dynamorio.dir\arch\x86\x86.asm.obj.s @ 2373]

I'm currently running Windows 10, 64 bits version 10.0.10586

[jonbutler88]

I believe I'm hitting the same error. Running in debug mode hits the assert below, which seems to match up with the stack from the previous report.

https://github.com/DynamoRIO/dynamorio/blob/master/core/win32/ntdll.c#L588

[un-fmunozs]

Thanks for confirming my problem, I wasn't able to figure out which update broke it and since I got no response for a while I resorted to setting a Windows 7 machine.

[derekbruening]

This is an already-known problem hit with Dr. Memory: DynamoRIO/drmemory#1826
This issue can serve as the DR counterpart.

The ridiculous TH2 syscall update without changing any version numbers caused what we thought was forward-compatible syscall code in DR to not kick in. Grrr.

[derekbruening]

The versioning changes where the major, minor, and service pack numbers are unlikely to ever change from 10.0 sp0 despite major updates mean that we need to change our entire approach to detecting new versions. The currently debug-only code that verifies syscall numbers from wrappers will need to be enabled and we'll have to use syscall numbers as versions -- though we'll have to pick carefully as changes in the ordering (no longer purely alphabetical) do result in identical numbers for some syscalls across major updates. Of course this is subject to failure from hooks until early injection is fully supported for clients (xref #234), so we still want someone to update the number table after each change.

[derekbruening]

Xref #1854

[derekbruening]

DR support is now in place in efe3c3d

[derekbruening]

Since it wasn't actually recorded here, this is the assert debug build DR gave on TH2 (seen on Dr. Memory first), pasted from my notes from Jan 2016:

% bin/drmemory.exe -debug -dr_debug -batch -- ../free.exe
<Application C:\derek\free.exe (4840).  Internal Error: DynamoRIO debug check failure: d:\drmemory_package\dynamorio\core\win32\ntdll.c:628 (byte *) get_proc_address(ntdllh, syscall_names[i]) != NULL && (*((int *)(((byte *) get_proc_address(ntdllh, syscall_names[i])) + SYSNUM_OFFS)) == syscalls[i] || ALLOW_HOOKER((byte *) get
version 5.0.16710, custom build