Re: Invalid lock sequence

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

From: Ivan Brugiolo [MSFT] (ivanbrug_at_online.microsoft.com)
Date: 02/25/04


Date: Wed, 25 Feb 2004 10:23:39 -0800

If you are going after a reuse-after-delete,
you can try to use Full-PageHeap,
that will decommitt the block of memory,
so that any reuse-attempt will cause an AV.

if you ar also using one of cdb/ntsd/windbg as the debugger,
you can use
0:001>!heap -p -a <address_of_the_AV>
to get a stack trace of the code-path that free-ed the block of memory.

-- 
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of any included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
"Andrew" <anonymous@discussions.microsoft.com> wrote in message
news:D46D93CC-5E2E-47E9-B7CB-8DB8AD46B427@microsoft.com...
> The code in question does use vtables, so it's possible that's what's
happening.  The call stack generally looked good, although there were a
couple things that didn't quite match.  I assumed this was due to the
release build optimizations, but execution of arbitrary memory seems likely
considering the results I'm getting.  I will investigate further.
>
> Thanks!
>
>      ----- Ivan Brugiolo [MSFT] wrote: -----
>
>      Are you sure you are not executing code out of arbitrary memory ?
>      Sometimes it happens when you perform a reuse-after-delete of an
object with
>      a vtable.
>      The vtable is reused-memory, and it will point to arbitrary code.
>      Other cause would be a stack corruption that will make you execute
arbitrary
>      code as well.
>      Single bit error in the memory page could be a cause as well.
>
>      -- 
>      This posting is provided "AS IS" with no warranties, and confers no
rights.
>      Use of any included script samples are subject to the terms specified
at
>      http://www.microsoft.com/info/cpyright.htm
>
>
>      "Andrew" <anonymous@discussions.microsoft.com> wrote in message
>      news:3CDCE1FC-FB6C-4E60-A7B9-C74D60C6754F@microsoft.com...
>      > I just encountered a bug in a release build of my code.  According
to the
>      exception, "An attempt was made to execute an invalid lock sequence."
The
>      line of code that execution breaks on is:
>      >> lock fstp   dword ptr [esp]
>      >> According to Intel's instruction set reference, such an operation
will
>      generate an undefined opcode exception, because the FSTP instruction
is not
>      in the list of instructions that LOCK can be prefixed to.  So either
the
>      compiler is generating invalid code, the assembly output is wrong,
the Intel
>      documentation is incomplete, or I don't understand how the LOCK
instruction
>      can be used.
>      >> Can anyone confirm whether or not this is a valid instruction?  If
this is
>      not a valid instruction, is anyone aware of this being a known issue
with
>      the VC 7.1 compiler?
>      >> Thanks,
>      > Andrew
>
>
>


Relevant Pages

  • Re: how to parse an executable in C and find out if there is any return(RET in assembly) or not
    ... then figuring out whether there is a machine return instruction ... for trillions of different possible input programs. ... instruction in the new execution, eventually leading to the 83 RETURN...) ... place a fixed pre-determined limit on the amount of memory available to ...
    (comp.lang.c)
  • Re: C and Low-level Storage
    ... stored in addressable memory. ... can only be read for execution. ... CPU has a an instruction fetch unit that reads the instruction data ... The closest examples I can thing of are some analog computers. ...
    (comp.lang.cobol)
  • Re: Scaling noise
    ... >> The point of hyperthreading is that more virtual CPUs on same memory ... > Its a way of exposing asynchronicity keeping the old instruction set. ... Modern processors have three execution cores, ...
    (Linux-Kernel)
  • Re: 8086 simulator in ruby
    ... At first I'm interested in implementing basic instruction ... execution and memory access, no interrupts. ... A CPU bascically operates on memory and has several registers, ... The instruction manual basically describes the interface. ...
    (comp.lang.ruby)
  • Re: [Lit.] Buffer overruns
    ... > floating point support or a memory expansion option. ... had virtual memory support grafted on. ... > where the modified instruction was fetched from. ... vis-a-vis the official coporate strategic operating system TSS/360. ...
    (sci.crypt)