Re: Crash reporter starting stack trace
Re: Crash reporter starting stack trace
- Subject: Re: Crash reporter starting stack trace
- From: Terry Lambert <email@hidden>
- Date: Tue, 06 Oct 2009 11:42:20 -0700
On Oct 6, 2009, at 10:25 AM, Arnab Ganguly <email@hidden> wrote:
Hi All,
Some inputs required. When an application crashes, what is the
starting stack address Crashreporter gets as?
Whatever is in the %esp/%rbp within the thread state struucture for
each thread at the time the mach crash exception is thrown.
We developed a similar crash app but when we compare the stack trace
with the Crashreporter's there is a mismatch with initial stack
addresses but after some traces it matches. Specially the traces
very much internal to the system dynamic libraries doesn't
match.Addresses related to Application it matches.
Any inputs or pointers would be great help.
I told you this before...
That's because libraries are loaded at different locations on
different machines and you still are not taking this into account with
your crash report architecture, where you send the data back to your
server for symbolication. Unless you save off specific task address
space mapping locations for each, as part of the information you send
back to your server, then your server will have different base
addresses for the libraries and frameworks and therefore be unable to
decode them properly.
PS: It works for your main app only because you have not enabled ASLR
for your app; if it is a network client or server, your app is likely
vulnerable to buffer overflow and other attacks based on the fixed
location of your code. Such an attack would work cookie-cutter fashion
everywhere your software is deployed. By varying the address where
it's loaded, you make it so an attack that works against one machine
won't (statistically speaking) work against others. Admittedly,
varying the location where system libraries are loaded is only
protection if your app doesn't always load a vtable pointing at
framework entry points into the same location on every machine, so
that the same call sites exist everywhere (it kind of defeats the
purpose if you do that in fact).
-- Terry
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Darwin-dev mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden