syzyasan needs updating to support VS 2017 generated binaries #53
Comments
I'm still experiencing issues with the PE parser on Syzygy Instrumenter 0.8.32.0 (
I've attempted retargeting to older SDK versions but without success. |
It is the C runtime which determines the size of the IMAGE_LOAD_CONFIG_DIRECTORY object. Chrome used to override this by declaring an object of the right size and type, but it no longer does (I removed that a few months ago). You could use Chrome's hack of defining _load_config_used to specify a custom IMAGE_LOAD_CONFIG_DIRECTORY object. See crrev.com/c/1575870 for the change that removed it. I did a verbose build of a test project and searched the output for _load_config_used and confirmed that this variable comes from the CRT: 1> Searching C:\Program Files (x86)\Microsoft Visual Studio\2019\Professional\VC\Tools\MSVC\14.23.28105\lib\x64\MSVCRTD.lib: |
Great, thank you! Adding the custom |
Back again with another issue related to this structure. I ran into the same issue attempting to instrument a DLL. But after adding the custom
The structure looks like this:
Any insight on this would be much appreciated. |
Thanks for editing the output - 1,100 lines was a bit much. Ultimately syzygy will need to support the new load config structures. I'm not sure what has gone wrong in this case - it sounds like your override of the symbol didn't work, or ??? I'm not sure anybody else is working on this but updating the load-config parser to handle the new fields seems like the right direction to go in. |
I would strongly suspect we're incorrectly parsing the load config directory. It changes with different compiler/linker version numbers, as can be seen with the parsing code here: syzygy/syzygy/pe/pe_file_parser.cc Line 1151 in 8164b24
As Bruce points it, it should be updated to handle the new fields that have been added. |
IIRC there's also some legacy there, as there was a version of the linker
or toolchain that emitted the wrong length for the load config symbol, so
the parsing code needed to accommodate.
…On Tue, Oct 22, 2019 at 2:13 PM Chris Hamilton ***@***.***> wrote:
I would strongly suspect we're incorrectly parsing the load config
directory. It changes with different compiler/linker version numbers, as
can be seen with the parsing code here:
https://github.com/google/syzygy/blob/8164b24ebde9c5649c9a09e88a7fc0b0fcbd1bc5/syzygy/pe/pe_file_parser.cc#L1151
As Bruce points it, it should be updated to handle the new fields that
have been added.
—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub
<#53?email_source=notifications&email_token=AALDKF4C5U7YWT7YBR5WYELQP47EXA5CNFSM4DFDNI72YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEB6WACA#issuecomment-545087496>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/AALDKFZZNZWF5MC2IJQLUFLQP47EXANCNFSM4DFDNI7Q>
.
|
Details are in crbug.com/705133
The text was updated successfully, but these errors were encountered: