Skip to content

ScriptHandler : Accesing fields of struct make the programm crash / random value returned by fields  #189

@saurL

Description

@saurL

Hello.

After some days of searching i don't find any solution so i wanted to share my issue here.

First of all this post will be a paste of : https://users.rust-lang.org/t/accesing-fields-of-struct-make-the-programm-crash-random-value-returned-by-fields-frida-scripthandler/122304/1 you could find more informations or the answer if it is found there.

I created a struct implementing ScriptHandler , this struct has a mpsc::Sender to send message but as soon as i try to acces it my program crash. here is a small exemple:

#[derive(Clone)]
struct MyHandler {
    event_sender: Arc<Mutex<mpsc::Sender<String>>>,
    test: String, // I added this string just to try
}

impl MyHandler {
    pub fn new(event_sender: mpsc::Sender<String>) -> Self {
	// I checked event_sender here and it is correct
	Self {
            event_sender: Arc::new(Mutex::new(event_sender)),
            test: "random thing".to_string(),
        };
    }
}

impl ScriptHandler for MyHandler {
    fn on_message(&mut self, message: &Message) {
        println!("In on_message");
        println!("{}", self.test); :: // here the code sometime show me Nothing , sometimes a smiley most of the time nothing
        println!("trying to acces event");
        match Arc::strong_count(&self.event_sender) {
            count if count > 0 => println!("event_sender strong count: {}", count),
            _ => println!("event_sender Arc seems invalid or dropped"),
        } // 
        println!("{:?}", self.event_sender); // program stop here without any message most of the time
    }
}

Which is a more weird is that sometimes my program would print me things like event_sender strong count: 1624879470736 wich is to high. It wouldn't make sense and I dont see anywhere in my code a loops in wich I clone it. another time i had :
println!("{:?}", self.event_sender); => Mutex { data: <locked>, poisoned: true, .. }
So no count and a poisoned mutex. The only time it showed me this it crashed later when i have a self.event_sender.clone()
And some other time i had : event_sender Arc seems invalid or dropped.

I tried to compile it with adressSanitazier and here is the stacktrace:

===============================================================
==9648==ERROR: AddressSanitizer: access-violation on unknown address 0x000000000080 (pc 0x7ff7472dd932 bp 0x000f5ebfcda0 sp 0x000f5ebfcc60 T23)
==9648==The signal is caused by a READ memory access.
==9648==Hint: address points to the zero page.
    #0 0x7ff7472dd931 in core::sync::atomic::atomic_load::h7f6f027565fec644 C:\Users\sauro\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib\rustlib\src\rust\library\core\src\sync\atomic.rs:3342
    #1 0x7ff7472e1396 in core::sync::atomic::AtomicPtr$LT$T$GT$::load::he145f6cfda9e7a18 C:\Users\sauro\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib\rustlib\src\rust\library\core\src\sync\atomic.rs:1443
    #2 0x7ff7472f4d57 in _$LT$tokio..sync..mpsc..list..Tx$LT$T$GT$$u20$as$u20$core..fmt..Debug$GT$::fmt::h1bff782287e48063 C:\Users\sauro\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\sync\mpsc\list.rs:235
    #3 0x7ff748ded8e9 in core::fmt::builders::impl$3::field::closure$0 /rustc/a224f3807e58afc9353510f1d556c607d367545d/library\core\src\fmt\builders.rs:133   
    #4 0x7ff748ded8e9 in core::fmt::builders::impl$3::field_with::closure$0 /rustc/a224f3807e58afc9353510f1d556c607d367545d/library\core\src\fmt\builders.rs:162
    #5 0x7ff748ded8e9 in core::result::Result::and_then /rustc/a224f3807e58afc9353510f1d556c607d367545d/library\core\src\result.rs:1348
    #6 0x7ff748ded8e9 in core::fmt::builders::DebugStruct::field_with /rustc/a224f3807e58afc9353510f1d556c607d367545d/library\core\src\fmt\builders.rs:145    
    #7 0x7ff748ded8e9 in core::fmt::builders::DebugStruct::field::hf1af51f6db972582 /rustc/a224f3807e58afc9353510f1d556c607d367545d/library\core\src\fmt\builders.rs:133
    #8 0x7ff7472ef41d in _$LT$tokio..sync..mpsc..chan..Chan$LT$T$C$S$GT$$u20$as$u20$core..fmt..Debug$GT$::fmt::he178a9e98cbce97d C:\Users\sauro\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\sync\mpsc\chan.rs:82
    #9 0x7ff746554431 in _$LT$alloc..sync..Arc$LT$T$C$A$GT$$u20$as$u20$core..fmt..Debug$GT$::fmt::h5a131f2c65f7061c C:\Users\sauro\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib\rustlib\src\rust\library\alloc\src\sync.rs:3430
    #10 0x7ff748ded8e9 in core::fmt::builders::impl$3::field::closure$0 /rustc/a224f3807e58afc9353510f1d556c607d367545d/library\core\src\fmt\builders.rs:133  
    #11 0x7ff748ded8e9 in core::fmt::builders::impl$3::field_with::closure$0 /rustc/a224f3807e58afc9353510f1d556c607d367545d/library\core\src\fmt\builders.rs:162
    #12 0x7ff748ded8e9 in core::result::Result::and_then /rustc/a224f3807e58afc9353510f1d556c607d367545d/library\core\src\result.rs:1348
    #13 0x7ff748ded8e9 in core::fmt::builders::DebugStruct::field_with /rustc/a224f3807e58afc9353510f1d556c607d367545d/library\core\src\fmt\builders.rs:145   
    #14 0x7ff748ded8e9 in core::fmt::builders::DebugStruct::field::hf1af51f6db972582 /rustc/a224f3807e58afc9353510f1d556c607d367545d/library\core\src\fmt\builders.rs:133
    #15 0x7ff7472ef275 in _$LT$tokio..sync..mpsc..chan..Tx$LT$T$C$S$GT$$u20$as$u20$core..fmt..Debug$GT$::fmt::h86c79c6139ce5b70 C:\Users\sauro\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\sync\mpsc\chan.rs:25
    #16 0x7ff748ded8e9 in core::fmt::builders::impl$3::field::closure$0 /rustc/a224f3807e58afc9353510f1d556c607d367545d/library\core\src\fmt\builders.rs:133  
    #17 0x7ff748ded8e9 in core::fmt::builders::impl$3::field_with::closure$0 /rustc/a224f3807e58afc9353510f1d556c607d367545d/library\core\src\fmt\builders.rs:162
    #18 0x7ff748ded8e9 in core::result::Result::and_then /rustc/a224f3807e58afc9353510f1d556c607d367545d/library\core\src\result.rs:1348
    #19 0x7ff748ded8e9 in core::fmt::builders::DebugStruct::field_with /rustc/a224f3807e58afc9353510f1d556c607d367545d/library\core\src\fmt\builders.rs:145   
    #20 0x7ff748ded8e9 in core::fmt::builders::DebugStruct::field::hf1af51f6db972582 /rustc/a224f3807e58afc9353510f1d556c607d367545d/library\core\src\fmt\builders.rs:133
    #21 0x7ff746543085 in _$LT$tokio..sync..mpsc..bounded..Sender$LT$T$GT$$u20$as$u20$core..fmt..Debug$GT$::fmt::h06ccab65a8786a86 C:\Users\sauro\.cargo\registry\src\index.crates.io-6f17d22bba15001f\tokio-1.42.0\src\sync\mpsc\bounded.rs:1601
    #22 0x7ff74655449e in _$LT$alloc..sync..Arc$LT$T$C$A$GT$$u20$as$u20$core..fmt..Debug$GT$::fmt::h7fc95d99524b03d0 C:\Users\sauro\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib\rustlib\src\rust\library\alloc\src\sync.rs:3430
    #23 0x7ff748def6a9 in core::fmt::rt::Argument::fmt /rustc/a224f3807e58afc9353510f1d556c607d367545d/library\core\src\fmt\rt.rs:177
    #24 0x7ff748def6a9 in core::fmt::write::hd09721bccbef5a36 /rustc/a224f3807e58afc9353510f1d556c607d367545d/library\core\src\fmt\mod.rs:1437
    #25 0x7ff748dc4c4a in std::io::Write::write_fmt /rustc/a224f3807e58afc9353510f1d556c607d367545d/library\std\src\io\mod.rs:1887
    #26 0x7ff748dc4c4a in _$LT$$RF$std..io..stdio..Stdout$u20$as$u20$std..io..Write$GT$::write_fmt::haad2e52e4f8128a3 /rustc/a224f3807e58afc9353510f1d556c607d367545d/library\std\src\io\stdio.rs:792
    #27 0x7ff748dc58f0 in std::io::stdio::impl$15::write_fmt /rustc/a224f3807e58afc9353510f1d556c607d367545d/library\std\src\io\stdio.rs:766
    #28 0x7ff748dc58f0 in std::io::stdio::print_to /rustc/a224f3807e58afc9353510f1d556c607d367545d/library\std\src\io\stdio.rs:1122
    #29 0x7ff748dc58f0 in std::io::stdio::_print::h394176707872073f /rustc/a224f3807e58afc9353510f1d556c607d367545d/library\std\src\io\stdio.rs:1233
    #30 0x7ff74654565a in _$LT$app_lib..hook..MyHandler$u20$as$u20$frida..script..ScriptHandler$GT$::on_message::h10d300c7dc05c530 C:\Programmation\Projets\src-tauri\src\hook.rs:45
    #31 0x7ff7465d7c44 in frida::script::call_on_message::h3a3c1a0eab7c75c8 C:\Users\sauro\.cargo\registry\src\index.crates.io-6f17d22bba15001f\frida-0.15.1\src\script.rs:121
    #32 0x7ff748e66ae1 in g_closure_invoke D:\a\frida\frida\deps\src\glib\gobject\gclosure.c:836
    #33 0x7ff748dfa611 in signal_emit_unlocked_R D:\a\frida\frida\deps\src\glib\gobject\gsignal.c:3800
    #34 0x7ff748df8a59 in g_signal_emit_valist D:\a\frida\frida\deps\src\glib\gobject\gsignal.c:3553
    #35 0x7ff748df8373 in g_signal_emit D:\a\frida\frida\deps\src\glib\gobject\gsignal.c:3610
    #36 0x7ff748e2ceef in frida_session_real_post_messages_co D:\a\frida\frida\build\frida.c:47029
    #37 0x7ff748e42784 in frida_agent_message_sink_post_messages D:\a\frida\frida\build\session.c:14126
    #38 0x7ff748e33d9a in _dbus_frida_agent_message_sink_post_messages D:\a\frida\frida\build\session.c:14356
    #39 0x7ff748e7b078 in call_in_idle_cb D:\a\frida\frida\deps\src\glib\gio\gdbusconnection.c:4998
    #40 0x7ff748e71b2e in g_idle_dispatch D:\a\frida\frida\deps\src\glib\glib\gmain.c:6462
    #41 0x7ff748e731a4 in g_main_dispatch D:\a\frida\frida\deps\src\glib\glib\gmain.c:3557
    #42 0x7ff748e7238f in g_main_context_dispatch D:\a\frida\frida\deps\src\glib\glib\gmain.c:4281
    #43 0x7ff748e726b6 in g_main_context_iterate D:\a\frida\frida\deps\src\glib\glib\gmain.c:4357
    #44 0x7ff748e7339e in g_main_loop_run D:\a\frida\frida\deps\src\glib\glib\gmain.c:4557
    #45 0x7ff748dff013 in run_main_loop D:\a\frida\frida\subprojects\frida-core\src\frida-glue.c:159
    #46 0x7ff748e7189c in g_thread_proxy D:\a\frida\frida\deps\src\glib\glib\gthread.c:1055
    #47 0x7ff748e5e48a in g_thread_win32_proxy D:\a\frida\frida\deps\src\glib\glib\gthread-win32.c:494
    #48 0x7ffe0c089332  (C:\Windows\System32\ucrtbase.dll+0x180029332)
    #49 0x7ffd0a9ade2d in asan_thread_start D:\a\_work\1\s\src\vctools\asan\llvm\compiler-rt\lib\asan\asan_win.cpp:170
    #50 0x7ffe0e03259c  (C:\Windows\System32\KERNEL32.DLL+0x18001259c)
    #51 0x7ffe0ed6af37  (C:\Windows\SYSTEM32\ntdll.dll+0x18005af37)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: access-violation C:\Users\sauro\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib\rustlib\src\rust\library\core\src\sync\atomic.rs:3342 in core::sync::atomic::atomic_load::h7f6f027565fec644
Thread T23 created by T0 here:
    #0 0x7ffd0a9ae237 in CreateThread D:\a\_work\1\s\src\vctools\asan\llvm\compiler-rt\lib\asan\asan_win.cpp:223
    #1 0x7ffe0c0883ad  (C:\Windows\System32\ucrtbase.dll+0x1800283ad)
    #2 0x7ff748e5e016 in g_system_thread_new D:\a\frida\frida\deps\src\glib\glib\gthread-win32.c:539
    #3 0x7ff748e716c6 in g_thread_new_internal D:\a\frida\frida\deps\src\glib\glib\gthread.c:1162
    #4 0x7ff748e71667 in g_thread_new D:\a\frida\frida\deps\src\glib\glib\gthread.c:1112
    #5 0x7ff748dfeef8 in frida_init_with_runtime D:\a\frida\frida\subprojects\frida-core\src\frida-glue.c:47
    #6 0x7ff747b61b18 in frida::Frida::obtain::h1c8de11d8b6a5b03 C:\Users\sauro\.cargo\registry\src\index.crates.io-6f17d22bba15001f\frida-0.15.1\src\lib.rs:51
    #7 0x7ff746547068 in app_lib::hook::hook::new::h56853ddd2bba7a67 C:\Programmation\Projets\src-tauri\src\hook.rs:136
    #8 0x7ff746304d45 in app_lib::bot::Bot::new::h1454caf71fd5fbb8 C:\Programmation\Projets\src-tauri\src\bot.rs:21
    #9 0x7ff746301d91 in app_lib::run::hb45281bcd6215cd9 C:\Programmation\Projets\src-tauri\src\lib.rs:15
    #10 0x7ff746301048 in app_lib::main C:\Programmation\Projets\src-tauri\src\main.rs:5
    #11 0x7ff74630129a in core::ops::function::FnOnce::call_once::hdf3489fdcfff43ad C:\Users\sauro\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib\rustlib\src\rust\library\core\src\ops\function.rs:250
    #12 0x7ff74630100d in std::sys::backtrace::__rust_begin_short_backtrace::hccf684203473f78a C:\Users\sauro\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib\rustlib\src\rust\library\std\src\sys\backtrace.rs:152
    #13 0x7ff746301563 in std::rt::lang_start::_$u7b$$u7b$closure$u7d$$u7d$::h519e6d06634b26f5 C:\Users\sauro\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib\rustlib\src\rust\library\std\src\rt.rs:195
    #14 0x7ff748dbfadb in core::ops::function::impls::impl$2::call_once /rustc/a224f3807e58afc9353510f1d556c607d367545d/library\core\src\ops\function.rs:284  
    #15 0x7ff748dbfadb in std::panicking::try::do_call /rustc/a224f3807e58afc9353510f1d556c607d367545d/library\std\src\panicking.rs:573
    #16 0x7ff748dbfadb in std::panicking::try /rustc/a224f3807e58afc9353510f1d556c607d367545d/library\std\src\panicking.rs:536
    #17 0x7ff748dbfadb in std::panic::catch_unwind /rustc/a224f3807e58afc9353510f1d556c607d367545d/library\std\src\panic.rs:358
    #18 0x7ff748dbfadb in std::rt::lang_start_internal::closure$1 /rustc/a224f3807e58afc9353510f1d556c607d367545d/library\std\src\rt.rs:174
    #19 0x7ff748dbfadb in std::panicking::try::do_call /rustc/a224f3807e58afc9353510f1d556c607d367545d/library\std\src\panicking.rs:573
    #20 0x7ff748dbfadb in std::panicking::try /rustc/a224f3807e58afc9353510f1d556c607d367545d/library\std\src\panicking.rs:536
    #21 0x7ff748dbfadb in std::panic::catch_unwind /rustc/a224f3807e58afc9353510f1d556c607d367545d/library\std\src\panic.rs:358
    #22 0x7ff748dbfadb in std::rt::lang_start_internal::h9709fc44ae8f04d9 /rustc/a224f3807e58afc9353510f1d556c607d367545d/library\std\src\rt.rs:174
    #23 0x7ff7463013e9 in std::rt::lang_start::h1f1d1d8c1fd35049 C:\Users\sauro\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib\rustlib\src\rust\library\std\src\rt.rs:194
    #24 0x7ff746301068 in main (C:\Programmation\Projets\src-tauri\target\x86_64-pc-windows-msvc\debug\app.exe+0x140001068)
    #25 0x7ff7493d33bf in invoke_main D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:78
    #26 0x7ff7493d33bf in __scrt_common_main_seh D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288
    #27 0x7ffe0e03259c  (C:\Windows\System32\KERNEL32.DLL+0x18001259c)
    #28 0x7ffe0ed6af37  (C:\Windows\SYSTEM32\ntdll.dll+0x18005af37)

==9648==ABORTING

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions