{"action":"created","issue":{"url":"https://api.github.com/repos/libvmi/libvmi/issues/621","repository_url":"https://api.github.com/repos/libvmi/libvmi","labels_url":"https://api.github.com/repos/libvmi/libvmi/issues/621/labels{/name}","comments_url":"https://api.github.com/repos/libvmi/libvmi/issues/621/comments","events_url":"https://api.github.com/repos/libvmi/libvmi/issues/621/events","html_url":"https://github.com/libvmi/libvmi/issues/621","id":324176183,"number":621,"title":"vmi_resume_vm fail to resume VM execution under specific circumstances","user":{"login":"Wenzel","id":964610,"avatar_url":"https://avatars2.githubusercontent.com/u/964610?v=4","gravatar_id":"","url":"https://api.github.com/users/Wenzel","html_url":"https://github.com/Wenzel","followers_url":"https://api.github.com/users/Wenzel/followers","following_url":"https://api.github.com/users/Wenzel/following{/other_user}","gists_url":"https://api.github.com/users/Wenzel/gists{/gist_id}","starred_url":"https://api.github.com/users/Wenzel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Wenzel/subscriptions","organizations_url":"https://api.github.com/users/Wenzel/orgs","repos_url":"https://api.github.com/users/Wenzel/repos","events_url":"https://api.github.com/users/Wenzel/events{/privacy}","received_events_url":"https://api.github.com/users/Wenzel/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-05-17T20:35:14Z","updated_at":"2018-05-17T20:56:49Z","closed_at":null,"author_association":"MEMBER","body":"Hi,\r\n\r\nI found an issue in Libvmi where i'm calling `vmi_resume_vm`, the call succeeded, but the VM stay paused.\r\n\r\nWhat is strange is that there are specific conditions for the bug to be triggered:\r\n\r\n- catch a register event\r\n- while in the callback, pause the VM\r\n- interrupt the vmi_listen loop\r\n- **wait 30 seconds** (without this, the next call to `vmi_resume_vm` actually works)\r\n- resume VM\r\n\r\nHere is the implementation in Python (I removed the details)\r\n~~~Python\r\n#!/usr/bin/env python3\r\n\r\ndef callback(vmi, event):\r\n    global interrupted\r\n    pprint(event.to_dict())\r\n    pname = dtb_to_pname(vmi, event.cffi_event.reg_event.value)\r\n    print(\"process name: {}\".format(pname))\r\n    event.data += 1\r\n    if event.data == 10:\r\n        vmi.pause_vm()\r\n        interrupted = True\r\n\r\n\r\ndef main(args):\r\n    if len(args) != 2:\r\n        print('./debug_libvmi.py <vm_name>')\r\n        return 1\r\n\r\n    vm_name = args[1]\r\n\r\n    # register SIGINT\r\n    signal.signal(signal.SIGINT, signal_handler)\r\n\r\n    with Libvmi(vm_name, INIT_DOMAINNAME | INIT_EVENTS) as vmi:\r\n        with pause(vmi):\r\n            data = 0\r\n            reg_event = RegEvent(X86Reg.CR3, RegAccess.W, callback,\r\n                                 data=data)\r\n            vmi.register_event(reg_event)\r\n        # listen\r\n        while not interrupted:\r\n            print(\"Waiting for events\")\r\n            vmi.listen(3000)\r\n        print(\"Stop listening\")\r\n        vmi.clear_event(reg_event)\r\n-->    time.sleep(30)\r\n        vmi.resume_vm()\r\n~~~\r\n\r\nPlease note the `time.sleep(30)`.\r\nWithout this, the VM execution is resumed as expected.\r\n\r\nI originally found this bug while developing my `radare2` plugin, so the problem doesn't come from the Python bindings.\r\n\r\nAny ideas ? :thinking: \r\n"},"comment":{"url":"https://api.github.com/repos/libvmi/libvmi/issues/comments/390008835","html_url":"https://github.com/libvmi/libvmi/issues/621#issuecomment-390008835","issue_url":"https://api.github.com/repos/libvmi/libvmi/issues/621","id":390008835,"user":{"login":"Wenzel","id":964610,"avatar_url":"https://avatars2.githubusercontent.com/u/964610?v=4","gravatar_id":"","url":"https://api.github.com/users/Wenzel","html_url":"https://github.com/Wenzel","followers_url":"https://api.github.com/users/Wenzel/followers","following_url":"https://api.github.com/users/Wenzel/following{/other_user}","gists_url":"https://api.github.com/users/Wenzel/gists{/gist_id}","starred_url":"https://api.github.com/users/Wenzel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Wenzel/subscriptions","organizations_url":"https://api.github.com/users/Wenzel/orgs","repos_url":"https://api.github.com/users/Wenzel/repos","events_url":"https://api.github.com/users/Wenzel/events{/privacy}","received_events_url":"https://api.github.com/users/Wenzel/received_events","type":"User","site_admin":false},"created_at":"2018-05-17T20:56:48Z","updated_at":"2018-05-17T20:56:48Z","author_association":"MEMBER","body":"> Pausing a vm in an event callback is not supported.\r\n\r\nWell, i used that trick in every one of my callback so far... :smile: \r\n\r\nFurthermore, when i asked you about how I should pause my VM when processing an event:\r\nhttps://github.com/libvmi/libvmi/issues/569#issuecomment-361978949\r\n\r\nyou told me:\r\n> What I'm telling you is that currently it is not possible to pause the VM in the callback, so yes, the VM is running when you are leaving the while loop.\r\n\r\n> *correction:\r\n you can pause the VM in the callback but you can't pause and clear the event in the same callback.\r\n\r\nWhich is what i did.\r\nThe VM is paused in the callback, and the event is cleared afterwards.\r\n:man_shrugging: \r\n\r\nBut how do you pause the VM execution on a specific event then (if this is the root cause of the bug) ?\r\n\r\nThanks."}}
{"actor":{"display_login":"Wenzel"}}