In fuzzing applications with Pin (the Pintool source code is hosted here, I am sorry for the self-advertisement), I get a very bizarre situation in tracing executed instructions, the following trace:

0x404f94        test edx, edx                    
0x404f96        jnz 0x404fe1                   
0x404fe1        pop ebp                        
0x404f89        rep cmpsb byte ptr [esi], byte ptr [edi]
0x404f8b        pop edi                        
0x404f8c        pop esi                        
0x404f8d        jz 0x404f94                    
0x404f8f        sbb edx, edx

is extracted from the execution of wget. The bizarre observation is that the instruction after 0x404f8f is somehow arbitrary, normaly it should be:

0x404f91        sbb edx, 0xffffffff

but "sometimes" it is:

0x779a015d      add esp, 0x4

which is located in the NtWaitForMultipleObjects. To say "sometimes", I mean that it does not always happen but it happens and that is 100% reproducible.

I still cannot figure out what happened here. First, the observation means that the control-flow of the program has been changed in a unpredictable way. Second, the bizarre instruction located in NtWaitForMultipleObjects, namely it must be in the kernel-space, but here I have observed it in the program (i.e. in the user-space).

I know that this question is quite specific but feel free to request me more information. I really appreciate any help.

  • 1
    Is the program multi-threaded?
    – Igor Skochinsky
    Mar 5 '14 at 16:25
  • Thanks a lot, Igor. I think that you have actually given the answer. I am going to fix the Pintool with the multi-threaded model in mind and give the result later. Mar 6 '14 at 0:06
  • Thanks again Igor, your suggestion is exactly the problem. The bizarre instruction is not so bizarre, it is in fact the instruction of an other thread. I still do not know why wget on Windows is multi-threaded though, but that is another problem. Would you mind let your suggestion as an answer so that I can accept it? Mar 6 '14 at 13:54

When dealing with multi-threaded program, you may end up getting instructions from different threads. You can for example check the current thread ID to make sure you're getting what you need.

Even if the program itself does not use threads, they may be created by system libraries. One of the most common examples is the TppWaiterpThread. RPC functions also often create threads.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.