I have a function check that is roughly like this:
void check() {
// ...
// Make some execute-only memory readable for subsequent inspection
// using the mprotect system call
mprotect(addr, length, PROT_READ | PROT_EXEC); // #1
// Read the memory and do some integrity checks ...
if (addr[42] == 13) { // #2
// ...
}
}
My program sometimes crashes with a segmentation fault in the line marked with #2, where the memory is read.
When I look at the stack trace, there are two(!) entries of my function check:
check, line #2 (where the memory is read)check, line #1 (the mprotect system call)So according to the stack trace, my function is somehow called from within itself, and that call happens in line #1 where I do the mprotect system call.
How is this possible?
EDIT: As requested, here's the original stack trace:
Crashed: Thread : SIGSEGV 0x000000752eaba9a8
#00 pc 0xddc08 libnative-49.so (isAnyFunctionBeingHooked(_JNIEnv*, unsigned char const**, unsigned long) [NativeLib.cpp:185])
#01 pc 0xddc00 libnative-49.so (isAnyFunctionBeingHooked(_JNIEnv*, unsigned char const**, unsigned long) [NativeLib.cpp:164])
#02 pc 0xd7b54 libnative-49.so (dFAH(_JNIEnv*) [NativeLib.cpp:267])
// Following entries are outside of my code ...
Line 164 is the call to mprotect.
Line 185 is reading the memory previously made readable by mprotect.