starting tests
#if !defined(PROGRAM_SHEPHERDING) || (defined(PROGRAM_SHEPHERDING) && !defined(security)) || (defined(PROGRAM_SHEPHERDING) && defined(security) && defined(internal_detach_mask___0x1)) || (defined(PROGRAM_SHEPHERDING) && defined(thin_client)) || (defined(PROGRAM_SHEPHERDING) && defined(client)) || (defined(PROGRAM_SHEPHERDING) && defined(low))
2
3
0
3
43981
4660
2
3
0
3
43981
4660
2
3
# if defined(PROGRAM_SHEPHERDING) && defined(security) && defined(internal_detach_mask___0x1) && !defined(low) && !defined(client) && !defined(thin_client)
   SEC_VIO_STOP
# endif
0
3
43981
4660
2
3
0
3
43981
4660
#else
# if defined(executable_heap)
2
3
0
3
43981
4660
// FIXME: case 3947
2
3
0
3
43981
4660
# else
#  if defined(no_executable_if_flush) || defined(X)
#   if !defined(detect_mode)
     SEC_VIO_AUTO_STOP
     STOP
#   else
     SEC_VIO_CONT
#   endif
#  endif
#  if defined(no_executable_if_flush) || defined(X)
2
3
    SEC_VIO_CONT
0
    SEC_VIO_CONT
3
    SEC_VIO_CONT
43981
4660
    SEC_VIO_CONT
2
3
    SEC_VIO_CONT
0
    SEC_VIO_CONT
3
    SEC_VIO_CONT
43981
4660
#  else
// default options ''
2
3
0
3
43981
4660
// case 3947 only if looking at data sections
# if defined(PROGRAM_SHEPHERDING) && defined(security) && !defined(E) && defined(rct_section_type___0xe0)
# if !defined(detect_mode)
// OPTION_REPORT=8 is on by default unless overriden
#  if !defined(rct_ind_call___3)
     SEC_VIO_AUTO_STOP
#  endif
// FIXME: case 2144 - we should be testing for rct_ind_call(9) to ignore OPTION_BLOCK=2
#  if !defined(internal_detach_mask)
    STOP
#  endif
# else
   SEC_VIO_CONT
# endif
# endif
2
// FIXME: case 3947
# if defined(PROGRAM_SHEPHERDING) && defined(security) && !defined(E) && defined(rct_section_type___0xe0) && defined(detect_mode)
   SEC_VIO_CONT
# endif
3
# if defined(PROGRAM_SHEPHERDING) && defined(security) && !defined(E) && defined(rct_section_type___0xe0) && defined(detect_mode)
   SEC_VIO_CONT
# endif
0
# if defined(PROGRAM_SHEPHERDING) && defined(security) && !defined(E) && defined(rct_section_type___0xe0) && defined(detect_mode)
   SEC_VIO_CONT
# endif
3
# if defined(PROGRAM_SHEPHERDING) && defined(security) && !defined(E) && defined(rct_section_type___0xe0) && defined(detect_mode)
   SEC_VIO_CONT
# endif
43981
# if defined(PROGRAM_SHEPHERDING) && defined(security) && !defined(E) && defined(rct_section_type___0xe0) && defined(detect_mode)
   SEC_VIO_CONT
# endif
4660
#  endif
# endif
# if defined(executable_stack)
2
3
0
3
43981
4660
2
3
0
3
43981
4660
# else
#  if defined(no_executable_if_flush) || defined(X)
#   if !defined(detect_mode)
     SEC_VIO_AUTO_STOP
     STOP
#   else
     SEC_VIO_CONT
#   endif
#  endif
#  if defined(no_executable_if_flush) || defined(X)
2
// no violation here since same code as the 2 output and still on exec list
3
    SEC_VIO_CONT
0
    SEC_VIO_CONT
3
    SEC_VIO_CONT
    SEC_VIO_CONT
43981
    SEC_VIO_CONT
4660
    SEC_VIO_CONT
2
// no violation here since same code as the 2 output and still on exec list
3
    SEC_VIO_CONT
0
    SEC_VIO_CONT
3
// no violation on entry into selfmod since it's on previous page than the
// inc/dec code, just one violation for after selfmod itself
    SEC_VIO_CONT
43981
// first violation is unknown code b/c the continue above only added
// the second page of the selfmod code, now we're executing first page
// (doesn't happen w/ first stack buf b/c it's all on same page)
    SEC_VIO_CONT
    SEC_VIO_CONT
4660
#  else
2
3
#   if !defined(detect_mode)
     SEC_VIO_AUTO_STOP
     STOP
#   else
     SEC_VIO_CONT
#   endif
0
3
    SEC_VIO_CONT
    SEC_VIO_CONT
43981
// no violation here b/c selfmod entry is on exec list from the prev continue
// after the selfmod write, the exec area is removed since on stack, but
// it's put back on for rest of selfmod code post-write, since it's on
// future list (was not removed since future not triggered earlier, since
// selfmod entry was on exec list, as state above)
4660
2
3
    SEC_VIO_CONT
0
3
// no violation on entry into selfmod since it's on previous page than the
// inc/dec code, just one violation for after selfmod itself
    SEC_VIO_CONT
43981
    SEC_VIO_CONT
4660
#  endif
# endif
#endif
about to exit
//
//
//  ===========================================================================
//  To better understand the behavior of the two stack tests, here is a
//  collection of output from the test w/ verbose printing enabled and
//  from the logfiles:
//
//  ===========================================================================
//  buf_stack (aligned):
//
//  starting tests
//  wrote code 0x0012fee4-0x0012feef
//  flushed 0x0012fee4-0x0012feef (0xb bytes)
//  >> syscall: NtFlushInstructionCache 0x0012fee4 size=0xb
//  || new FUTURE executable vm area: 0x0012fee4-0x0012feef WNtFlushInstructionCache
//  executing code 0x0012fee4-0x0012feef
//  >> WARNING: pc = 0x0012fee4 is future executable, allowing
//  >> future exec region is on stack, removing from future list now
//  || removing FUTURE executable vm area: 0x0012fee4-0x0012feef
//  || new executable vm area: 0x0012fee4-0x0012feef WFSD unexpected vm area
//  2
//  executing code 0x0012fee4-0x0012feef
//  3
//  wrote code 0x0012fee4-0x0012ff78
//  executing code 0x0012fee4-0x0012ff78
//  >> WARNING: code on stack 0x0012fee4-0x0012feef @tag 0x0012fee4 written to
//  || removing executable vm area: 0x0012fee4-0x0012feef
//  <Execution policy violation occurred!
//  Contact your vendor for a security vulnerability fix.
//  Program continuing!>
//  >> WARNING: violating basic block target @0x0012fee4: 55 8b ec 8b 45 8 83 e8 1 5d c3 55
//  || new executable vm area: 0x0012f000-0x00130000 W-SD unexpected vm area
//  0
//  wrote code 0x0012fee4-0x0012feef
//  flushed 0x0012fee4-0x0012ff80 (0x9c bytes)
//  >> syscall: NtFlushInstructionCache 0x0012fee4 size=0x9c
//  || new FUTURE executable vm area: 0x0012fee4-0x0012ff80 WNtFlushInstructionCache
//  executing code 0x0012fee4-0x0012feef
//  >> WARNING: code on stack 0x0012f000-0x00130000 @tag 0x0012fee4 written to
//  || removing executable vm area: 0x0012f000-0x00130000
//  >> WARNING: pc = 0x0012fee4 is future executable, allowing
//  >> future exec region is on stack, removing from future list now
//  || removing FUTURE executable vm area: 0x0012fee4-0x0012ff80
//  || new executable vm area: 0x0012fee4-0x0012ff80 WFSD unexpected vm area
//  3
//  wrote code 0x0012fee4-0x0012ff15
//  executing self-mod code 0x0012fee4-0x0012ff15
//  >> WARNING: code on stack 0x0012fee4-0x0012ff80 @tag 0x0012fee4 written to
//  || removing executable vm area: 0x0012fee4-0x0012ff80
//  <Execution policy violation occurred!
//  Contact your vendor for a security vulnerability fix.
//  Program continuing!>
//  >> WARNING: violating basic block target @0x0012fee4: 55 8b ec 51 53 56 57 8b 4d 8 e8 0
//  || new executable vm area: 0x0012f000-0x00130000 W-SD unexpected vm area
//  >> WARNING: code on stack 0x0012f000-0x00130000 @tag 0x0012fef3 written to
//  || removing executable vm area: 0x0012f000-0x00130000
//  <Execution policy violation occurred!
//  Contact your vendor for a security vulnerability fix.
//  Program continuing!>
//  >> WARNING: violating basic block target @0x0012fef7: b8 cd ab 0 0 b9 0 0 0 0 48 41
//  || new executable vm area: 0x0012f000-0x00130000 W-SD unexpected vm area
//  43981
//  flushed 0x0012fee4-0x0012ff15 (0x31 bytes)
//  >> syscall: NtFlushInstructionCache 0x0012fee4 size=0x31
//  || new FUTURE executable vm area: 0x0012fee4-0x0012ff15 WNtFlushInstructionCache
//  executing self-mod code 0x0012fee4-0x0012ff15
//  >> WARNING: code on stack 0x0012f000-0x00130000 @tag 0x0012fef3 written to
//  || removing executable vm area: 0x0012f000-0x00130000
//  >> WARNING: pc = 0x0012fef7 is future executable, allowing
//  >> future exec region is on stack, removing from future list now
//  || removing FUTURE executable vm area: 0x0012fee4-0x0012ff15
//  || new executable vm area: 0x0012fee4-0x0012ff15 WFSD unexpected vm area
//  4660
//  about to exit
//
//  ===========================================================================
//  buf_stack2 (cross page):
//
//  starting tests
//  wrote code 0x0012dffe-0x0012e009
//  flushed 0x0012dffe-0x0012e009 (0xb bytes)
//  >> syscall: NtFlushInstructionCache 0x0012dffe size=0xb
//  || new FUTURE executable vm area: 0x0012dffe-0x0012e009 WNtFlushInstructionCache
//  executing code 0x0012dffe-0x0012e009
//  >> WARNING: pc = 0x0012dffe is future executable, allowing
//  >> future exec region is on stack, removing from future list now
//  || removing FUTURE executable vm area: 0x0012dffe-0x0012e009
//  || new executable vm area: 0x0012dffe-0x0012e009 WFSD unexpected vm area
//  2
//  executing code 0x0012dffe-0x0012e009
//  3
//  wrote code 0x0012dffe-0x0012e092
//  executing code 0x0012dffe-0x0012e092
//  >> WARNING: code on stack 0x0012dffe-0x0012e009 @tag 0x0012dffe written to
//  || removing executable vm area: 0x0012dffe-0x0012e009
//  <Execution policy violation occurred!
//  Contact your vendor for a security vulnerability fix.
//  Program continuing!>
//  >> WARNING: violating basic block target @0x0012dffe: 55 8b ec 8b 45 8 83 e8 1 5d c3 55
//  || new executable vm area: 0x0012d000-0x00130000 W-SD unexpected vm area
//  0
//  wrote code 0x0012dffe-0x0012e009
//  flushed 0x0012cee4-0x0012fee4 (0x3000 bytes)
//  >> syscall: NtFlushInstructionCache 0x0012cee4 size=0x3000
//  || new FUTURE executable vm area: 0x0012cee4-0x0012fee4 WNtFlushInstructionCache
//  executing code 0x0012dffe-0x0012e009
//  >> WARNING: code on stack 0x0012d000-0x00130000 @tag 0x0012dffe written to
//  || removing executable vm area: 0x0012d000-0x00130000
//  >> WARNING: pc = 0x0012dffe is future executable, allowing
//  >> future exec region is on stack, removing from future list now
//  || removing FUTURE executable vm area: 0x0012cee4-0x0012fee4
//  || new executable vm area: 0x0012cee4-0x0012fee4 WFSD unexpected vm area
//  3
//  wrote code 0x0012dff0-0x0012e021
//  executing self-mod code 0x0012dff0-0x0012e021
//  >>   exec of selfmod has no msgs since it's not same bb, so don't notice code has
//  >>   changed like do if it has same start addr, and it's still within same future
//  >>   region that was added to exec list
//  >> WARNING: code on stack 0x0012cee4-0x0012fee4 @tag 0x0012dfff written to
//  >>   this is the actual selfmod write!
//  || removing executable vm area: 0x0012cee4-0x0012fee4
//  <Execution policy violation occurred!
//  Contact your vendor for a security vulnerability fix.
//  Program continuing!>
//  >> WARNING: violating basic block target @0x0012e003: b8 cd ab 0 0 b9 0 0 0 0 48 41
//  >>   error executing rest of selfmod code
//  || new executable vm area: 0x0012e000-0x00130000 W-SD unexpected vm area
//  43981
//  flushed 0x0012dff0-0x0012e021 (0x31 bytes)
//  >> syscall: NtFlushInstructionCache 0x0012dff0 size=0x31
//  || new FUTURE executable vm area: 0x0012dff0-0x0012e021 WNtFlushInstructionCache
//  executing self-mod code 0x0012dff0-0x0012e021
//  >>    we have unknown code here b/c the after-violation continue only added
//  >>    the second page of the selfmod code, since the selfmod part itself is
//  >>    on second page, and now we're back executing from first page
//  >> WARNING: pc = 0x0012dff0 is future executable, allowing
//  >> future exec region is on stack, removing from future list now
//  || removing FUTURE executable vm area: 0x0012dff0-0x0012e021
//  || new executable vm area: 0x0012dff0-0x00130000 W-SD unexpected vm area
//  >> WARNING: code on stack 0x0012dff0-0x00130000 @tag 0x0012dfff written to
//  >>   this is the actual selfmod write!
//  || removing executable vm area: 0x0012dff0-0x00130000
//  <Execution policy violation occurred!
//  Contact your vendor for a security vulnerability fix.
//  Program continuing!>
//  >> WARNING: violating basic block target @0x0012e003: b8 34 12 0 0 b9 0 0 0 0 48 41
//  || new executable vm area: 0x0012e000-0x00130000 W-SD unexpected vm area
//  4660
//  about to exit
//
//  ===========================================================================