{"action":"closed","issue":{"url":"https://api.github.com/repos/DynamoRIO/dynamorio/issues/1879","repository_url":"https://api.github.com/repos/DynamoRIO/dynamorio","labels_url":"https://api.github.com/repos/DynamoRIO/dynamorio/issues/1879/labels{/name}","comments_url":"https://api.github.com/repos/DynamoRIO/dynamorio/issues/1879/comments","events_url":"https://api.github.com/repos/DynamoRIO/dynamorio/issues/1879/events","html_url":"https://github.com/DynamoRIO/dynamorio/issues/1879","id":135612147,"number":1879,"title":"Crash disassembling instruction fninit","user":{"login":"0ca","id":5008707,"avatar_url":"https://avatars.githubusercontent.com/u/5008707?v=3","gravatar_id":"","url":"https://api.github.com/users/0ca","html_url":"https://github.com/0ca","followers_url":"https://api.github.com/users/0ca/followers","following_url":"https://api.github.com/users/0ca/following{/other_user}","gists_url":"https://api.github.com/users/0ca/gists{/gist_id}","starred_url":"https://api.github.com/users/0ca/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/0ca/subscriptions","organizations_url":"https://api.github.com/users/0ca/orgs","repos_url":"https://api.github.com/users/0ca/repos","events_url":"https://api.github.com/users/0ca/events{/privacy}","received_events_url":"https://api.github.com/users/0ca/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-02-23T02:40:41Z","updated_at":"2016-03-05T19:53:16Z","closed_at":"2016-03-05T19:53:16Z","body":"Hi, \r\nI compiled the last version of Dynamo Rio in Windows 7 32 bits.\r\n\r\nI was trying a client that counts the instructions and prints all the executed instructions to the console. \r\n\r\nThe code is based in the [inscount.c](https://github.com/DynamoRIO/dynamorio/blob/master/api/samples/inscount.c):\r\n```C\r\n/* ******************************************************************************\r\n* Copyright (c) 2014 Google, Inc.  All rights reserved.\r\n* Copyright (c) 2011 Massachusetts Institute of Technology  All rights reserved.\r\n* Copyright (c) 2008 VMware, Inc.  All rights reserved.\r\n* ******************************************************************************/\r\n\r\n/*\r\n* Redistribution and use in source and binary forms, with or without\r\n* modification, are permitted provided that the following conditions are met:\r\n*\r\n* * Redistributions of source code must retain the above copyright notice,\r\n*   this list of conditions and the following disclaimer.\r\n*\r\n* * Redistributions in binary form must reproduce the above copyright notice,\r\n*   this list of conditions and the following disclaimer in the documentation\r\n*   and/or other materials provided with the distribution.\r\n*\r\n* * Neither the name of VMware, Inc. nor the names of its contributors may be\r\n*   used to endorse or promote products derived from this software without\r\n*   specific prior written permission.\r\n*\r\n* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\"\r\n* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\r\n* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE\r\n* ARE DISCLAIMED. IN NO EVENT SHALL VMWARE, INC. OR CONTRIBUTORS BE LIABLE\r\n* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\r\n* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\r\n* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\r\n* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT\r\n* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY\r\n* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH\r\n* DAMAGE.\r\n*/\r\n\r\n/* Code Manipulation API Sample:\r\n* inscount.c\r\n*\r\n* Reports the dynamic count of the total number of instructions executed.\r\n* Illustrates how to perform performant clean calls.\r\n* Demonstrates effect of clean call optimization and auto-inlining with\r\n* different -opt_cleancall values.\r\n*/\r\n\r\n#include \"dr_api.h\"\r\n#include \"drmgr.h\"\r\n\r\n#ifdef WINDOWS\r\n# define DISPLAY_STRING(msg) dr_messagebox(msg)\r\n#else\r\n# define DISPLAY_STRING(msg) dr_printf(\"%s\\n\", msg);\r\n#endif\r\n\r\n#define NULL_TERMINATE(buf) buf[(sizeof(buf)/sizeof(buf[0])) - 1] = '\\0'\r\n\r\n\r\n/* we only have a global count */\r\nstatic uint64 global_count;\r\n/* A simple clean call that will be automatically inlined because it has only\r\n* one argument and contains no calls to other functions.\r\n*/\r\nstatic void inscount(uint num_instrs, app_pc pc) {\r\n\tglobal_count += num_instrs;\r\n\tinstr_t instr;\r\n\tvoid *drcontext = dr_get_current_drcontext();\r\n\tif (decode(drcontext, pc, &instr) != NULL)\r\n\t{\r\n\t\tchar buffer[0x100];\r\n\t\tif (instr_disassemble_to_buffer(drcontext, &instr, buffer, 0x100))\r\n\t\t\tdr_fprintf(STDERR, \"%#X: %s\\n\", pc, buffer);\r\n\t}\r\n}\r\n\r\nstatic void event_exit(void);\r\nstatic dr_emit_flags_t event_bb_analysis(void *drcontext, void *tag,\r\n\tinstrlist_t *bb,\r\n\tbool for_trace, bool translating,\r\n\tvoid **user_data);\r\nstatic dr_emit_flags_t event_app_instruction(void *drcontext, void *tag,\r\n\tinstrlist_t *bb, instr_t *inst,\r\n\tbool for_trace, bool translating,\r\n\tvoid *user_data);\r\n\r\nDR_EXPORT void\r\ndr_client_main(client_id_t id, int argc, const char *argv[])\r\n{\r\n\tdr_set_client_name(\"DynamoRIO Sample Client 'inscount'\",\r\n\t\t\"http://dynamorio.org/issues\");\r\n\tdrmgr_init();\r\n\t/* register events */\r\n\tdr_register_exit_event(event_exit);\r\n\tdrmgr_register_bb_instrumentation_event(event_bb_analysis,\r\n\t\tevent_app_instruction,\r\n\t\tNULL);\r\n\r\n\t/* make it easy to tell, by looking at log file, which client executed */\r\n\tdr_log(NULL, LOG_ALL, 1, \"Client 'inscount' initializing\\n\");\r\n#ifdef SHOW_RESULTS\r\n\t/* also give notification to stderr */\r\n\tif (dr_is_notify_on()) {\r\n# ifdef WINDOWS\r\n\t\t/* ask for best-effort printing to cmd window.  must be called at init. */\r\n\t\tdr_enable_console_printing();\r\n# endif\r\n\t\tdr_fprintf(STDERR, \"Client inscount is running\\n\");\r\n\t}\r\n#endif\r\n}\r\n\r\nstatic void\r\nevent_exit(void)\r\n{\r\n#ifdef SHOW_RESULTS\r\n\tchar msg[512];\r\n\tint len;\r\n\tlen = dr_snprintf(msg, sizeof(msg) / sizeof(msg[0]),\r\n\t\t\"Instrumentation results: %llu instructions executed\\n\",\r\n\t\tglobal_count);\r\n\tDR_ASSERT(len > 0);\r\n\tNULL_TERMINATE(msg);\r\n\tDISPLAY_STRING(msg);\r\n#endif /* SHOW_RESULTS */\r\n\tdrmgr_exit();\r\n}\r\n\r\nstatic dr_emit_flags_t\r\nevent_bb_analysis(void *drcontext, void *tag, instrlist_t *bb,\r\nbool for_trace, bool translating, void **user_data)\r\n{\r\n\tinstr_t *instr;\r\n\tuint num_instrs;\r\n\r\n#ifdef VERBOSE\r\n\tdr_printf(\"in dynamorio_basic_block(tag=\"PFX\")\\n\", tag);\r\n# ifdef VERBOSE_VERBOSE\r\n\tinstrlist_disassemble(drcontext, tag, bb, STDOUT);\r\n# endif\r\n#endif\r\n\r\n\tfor (instr = instrlist_first_app(bb), num_instrs = 0;\r\n\t\tinstr != NULL;\r\n\t\tinstr = instr_get_next_app(instr)) {\r\n\t\tnum_instrs++;\r\n\t}\r\n\t*user_data = (void *)(ptr_uint_t)num_instrs;\r\n\r\n#if defined(VERBOSE) && defined(VERBOSE_VERBOSE)\r\n\tdr_printf(\"Finished counting for dynamorio_basic_block(tag=\"PFX\")\\n\", tag);\r\n\tinstrlist_disassemble(drcontext, tag, bb, STDOUT);\r\n#endif\r\n\treturn DR_EMIT_DEFAULT;\r\n}\r\n\r\nstatic dr_emit_flags_t\r\nevent_app_instruction(void *drcontext, void *tag, instrlist_t *bb, instr_t *instr,\r\nbool for_trace, bool translating, void *user_data)\r\n{\r\n\tuint num_instrs;\r\n\tif (!drmgr_is_first_instr(drcontext, instr))\r\n\t\treturn DR_EMIT_DEFAULT;\r\n\tnum_instrs = (uint)(ptr_uint_t)user_data;\r\n\tdr_insert_clean_call(drcontext, bb, instrlist_first_app(bb),\r\n\t\t(void *)inscount, false /* save fpstate */, 2,\r\n\t\tOPND_CREATE_INT32(num_instrs),\r\n\t\tOPND_CREATE_INTPTR(instr_get_app_pc(instr)));\r\n\treturn DR_EMIT_DEFAULT;\r\n}\r\n```\r\nWithout specifing an assembly syntax `drrun` crashes:\r\n```\r\ndrrun.exe -c ..\\api\\bin\\inscount.dll -- crackme.exe\r\n```\r\n![image](https://cloud.githubusercontent.com/assets/5008707/13239941/f71da6b4-d992-11e5-82fb-9680227bdb24.png)\r\n\r\nBut it is working well with the intel syntax:\r\n```\r\ndrrun.exe -syntax_intel -c ..\\api\\bin\\inscount.dll -- crackme.exe\r\n```\r\n\r\nIt is crashing disassembling the next instruction:\r\n```\r\n.text:00401F90 DB E3                          fninit\r\n```\r\n\r\nI attach here the program I used: \r\n[crackme.zip](https://github.com/DynamoRIO/dynamorio/files/141830/crackme.zip)"}}