1

A client came to me with an application that they lost the source code to. This application is crashing seemingly at random, when loading some files. I suspect that the issue is due to a race condition in which a pointer is deleted and then either not set to NULL or not checked for validity.

When stepping through the assembly using OllyDBG, I found that the crash ALWAYS happens at the same location, so this is kind of re-enforcing my theory. This is the assembly line it sometimes crashes on, keyword sometimes.

MOV EDI,DWORD PTR DS:[EAX]

Is it possible to validate a memory address is valid and exists either through native assembly or through C++ that pulls an address through an inline assembly call (or something like this)?

Rick
  • 421
  • 3
  • 15
  • try a memory debugger like valgrind – Goswin von Brederlow May 20 '22 at 21:51
  • 3
    - and what will you do with that information? I mean, the code is expecting to do something afterwards with that `edi` value, no? – 500 - Internal Server Error May 20 '22 at 21:52
  • 1
    Possible duplicate of [Determining Whether Pointer is Valid](https://stackoverflow.com/q/4595675) and/or [How to check if a pointer is valid?](https://stackoverflow.com/a/993335) (assuming you're asking about Windows since you mentioned OllyDBG). Or maybe not since Windows `IsBadReadPointer` / `IsBadWritePointer` were apparently already obsolete in 2009. On Linux you can validate a pointer without triggering a fault via a system call, e.g. see [Finding mapped memory from inside a process](https://stackoverflow.com/q/53022573) for some ideas. – Peter Cordes May 20 '22 at 21:56
  • _A client came to me with an application that they lost the source code to._ How fast can you run? I'm serious, you're on a hiding to nothing here. – Paul Sanders May 20 '22 at 22:23
  • 1
    *A client came to me with an application that they lost the source code to.* The only way to fix that is to write the application again. – Eljay May 21 '22 at 01:14

3 Answers3

6

There is no general standard way in C++ to validate a memory address. Nor is there such assembly instruction that I know of.

On a memory mapped system (such as any modern operating system), you may be able to check whether an address has been mapped for the process using a system specific API. An address being mapped to the process doesn't guarantee that the address is valid from the C++ point of view, but an unmapped address is definitely invalid.

Furthermore, even if could find that an address is valid, that doesn't tell you whether the object you are expecting is in that address or something else.

There are tools for validating memory accesses outside of the C++ language1. There's for example Valgrind and also compiles provide address sanitisers and memory sanitisers. Mostly, these help detect invalid accesses that wouldn't have crashed the program otherwise. But they also often can provide additional information regarding that memory.

1 If you had access to the source.

I suspect that the issue is due to a race condition

Being able to validate a memory address won't solve this problem. What you should do1, is to use a debugger to find out what object is being accessed, find all places where that object is accessed. If any of those places is not holding a mutex that is common to all other places potentially accessing the object at the same time, then there's your bug.

1 If you had access to the source.

lost the source code

If you have a massive budget, then you could try reverse-engineering it and try to figure out what it's doing. I wouldn't hold my breath; it may be best to declare this as a lost cause.

eerorika
  • 232,697
  • 12
  • 197
  • 326
  • [Why is a segmentation fault not recoverable?](https://stackoverflow.com/q/70258418) goes into more detail about why an actual deref of an invalid pointer might just be the result of an earlier bug, not the ultimate problem. – Peter Cordes May 20 '22 at 22:07
2

Everyone provided some great responses. Unfortunately, in this situation, the client wasn't willing to pay to have the software re-developed entirely.

I managed to kind of negate the crash... After identifying exactly where the crash occurred I used used code injection to JMP to a custom C++ function. The C++ function employs a __try __except block. Inside of the Try I placed the problem assembly code, and if the problem code causes a crash, the __except catches it. After that, it was just a matter of analyzing what the problem code was doing and when it started doing something else and then jumping to the start of that "something else" part of the problem function when an exception is caught.

It's not exactly detecting if a memory location is valid or not, but rather it's just skipping code if it causes an exception. Hope this helps someone eventually...

Rick
  • 421
  • 3
  • 15
  • This is obviously incredibly hacky and might leak resources (e.g. not running some destructors), as well as leaving some operations not done. If the invalid pointer was supposed to be pointing to some data structure that needed updating to maintain consistency with some other modification before the fault, that's going to corrupt things. But if not, then it might work, hopefully only leaving some independent work not done, which hopefully you don't ever need. Definitely not safe in general for all future readers, but it might if you're very lucky be usable. – Peter Cordes May 25 '22 at 05:14
  • @PeterCordes without a doubt, definitely a last resort option.... but an option none-the-less. – Rick May 25 '22 at 11:40
0

Yes, validating a pointer's content is possible. However, verifying that the target is the correct one is more difficult.

In order to validate a pointer you'll need:

  1. Table of valid address ranges (addresses that are implemented and their ranges).
    For example, on embedded systems addresses that are decoded may not have memory or devices at all locations.
  2. For OS's that support paging or virtual memory, you'll need to figure out the limits of your program's memory area (as given by the OS). The OS may take portions of your executable and swap them out with code on a hard drive.
  3. For OS's that support virtual memory, you'll have to figure out where in the "virtual" memory that your pointer is allowed to access. Read about memory mapped files.
  4. On some platforms, the address 0x0000 is a valid address. Verify if this is the case on your target platform.

IMHO, pointer content can be validated, but the validation may be very compilicated.

Prefer to use references.

Thomas Matthews
  • 56,849
  • 17
  • 98
  • 154