Pages: [1] 2   Go Down

Author Topic: guard32.dll and GDB problems (CFP 3.0.25.378)  (Read 48139 times)

Offline svadimr

  • Newbie
  • *
  • Posts: 7
guard32.dll and GDB problems (CFP 3.0.25.378)
« on: July 19, 2008, 05:32:05 AM »
Hello all,
I noticed a problem related to guard32.dll and GDB. This is the same problem as:

https://forums.comodo.com/empty-t20386.0.html

and

https://forums.comodo.com/empty-t21329.0.html

Summery of the problem is:
Program received signal SIGSEGV, Segmentation fault.
In ?? () (C:\WINDOWS\system32\guard32.dll)

Is there any formal solution for this problem besides disabling guard32.dll or disabling DEFENSE+?

Hope for your answer.
« Last Edit: July 19, 2008, 06:16:14 AM by 3xist »
Logged

3xist

  • Guest
Re: guard32.dll and GDB problems
« Reply #1 on: July 19, 2008, 05:38:18 AM »
Quote from: svadimr on July 19, 2008, 05:32:05 AM
Hello all,
I noticed a problem related to guard32.dll and GDB. This is the same problem as:

https://forums.comodo.com/empty-t20386.0.html

and

https://forums.comodo.com/empty-t21329.0.html

Summery of the problem is:
Program received signal SIGSEGV, Segmentation fault.
In ?? () (C:\WINDOWS\system32\guard32.dll)

Is there any formal solution for this problem besides disabling guard32.dll or disabling DEFENSE+?

Hope for your answer.

Hey svadimr & Welcome to the Forums!

Is anything related to these files blocked here?

Defense+\Advanced\Computer Security Policy.

If so (Blocked or Allowed), Remove them from the list. Switch Defense+ to Training Mode (It will learn the applicaton), Then if it DOES succeed, Swtich D+ back to Safe Mode.

 
Logged

Offline svadimr

  • Newbie
  • *
  • Posts: 7
Re: guard32.dll and GDB problems
« Reply #2 on: July 19, 2008, 06:04:12 AM »
Thank you for the fast answer.

I did exactly what you said and the problem is still exists. The interesting thing is if the DEFENSE+ disabled the problem still exists. If I rename guard32.dll or disable DEFENSE+ permanently then everything working.

What is the effect of disabling "guard32.dl" from autoruns?
Logged

3xist

  • Guest
Re: guard32.dll and GDB problems
« Reply #3 on: July 19, 2008, 06:07:47 AM »
Quote from: svadimr on July 19, 2008, 06:04:12 AM
Thank you for the fast answer.

I did exactly what you said and the problem is still exists. The interesting thing is if the DEFENSE+ disabled the problem still exists. If I rename guard32.dll or disable DEFENSE+ permanently then everything working.

What is the effect of disabling "guard32.dl" from autoruns?

Gurard32.dll is related to CFP 3.

So your saying it blocks it self?
Logged

Offline svadimr

  • Newbie
  • *
  • Posts: 7
Re: guard32.dll and GDB problems
« Reply #4 on: July 19, 2008, 06:12:11 AM »
The full error message of the GDB is:
Program received signal SIGSEGV, Segmentation fault.
0x18f589a1 in ?? () from /cygdrive/c/WINDOWS/system32/guard32.dll

The same error happens in others different places related to GDB.

I don't sure what is exactly the reason for that.

How I can check if it blocks itself?
Logged

3xist

  • Guest
Re: guard32.dll and GDB problems
« Reply #5 on: July 19, 2008, 06:15:13 AM »
Quote from: svadimr on July 19, 2008, 06:12:11 AM
The full error message of the GDB is:
Program received signal SIGSEGV, Segmentation fault.
0x18f589a1 in ?? () from /cygdrive/c/WINDOWS/system32/guard32.dll

The same error happens in others different places related to GDB.

I don't sure what is exactly the reason for that.

How I can check if it blocks itself?

Well the thing is I don't know the effects of guard32.dll... It's very strange. Can you please make this a bug report? I'll actually move this thread to bug reports...

Done! :)

Developers check Bug Reports regularly. So I am *hoping* a Comodo Staff Member responses to you.
« Last Edit: July 19, 2008, 06:17:04 AM by 3xist »
Logged

Offline gibran

  • Average User
  • Comodo's Hero
  • *****
  • Posts: 5056
  • A bad workman always blames his tools
Re: guard32.dll and GDB problems
« Reply #6 on: July 19, 2008, 09:57:33 AM »
Quote from: svadimr on July 19, 2008, 06:12:11 AM
The full error message of the GDB is:
Program received signal SIGSEGV, Segmentation fault.
0x18f589a1 in ?? () from /cygdrive/c/WINDOWS/system32/guard32.dll

The same error happens in others different places related to GDB.

I don't sure what is exactly the reason for that.

How I can check if it blocks itself?

I guess  guard32.dll is injected in all processes as part of CFP design.
Maybe guard32.dll trigger such errors because the debugger access it.

Can you disable windows DEP to check if there are any changes?
Logged
"In the beginning the Universe was created. This has made a lot of people very angry and has been widely regarded as a bad move."- Douglas Adams

Offline svadimr

  • Newbie
  • *
  • Posts: 7
Re: guard32.dll and GDB problems (CFP 3.0.25.378)
« Reply #7 on: July 19, 2008, 12:12:36 PM »
How do I disable windows DEP?
Logged

Offline gibran

  • Average User
  • Comodo's Hero
  • *****
  • Posts: 5056
  • A bad workman always blames his tools
Re: guard32.dll and GDB problems (CFP 3.0.25.378)
« Reply #8 on: July 19, 2008, 12:29:32 PM »
Logged
"In the beginning the Universe was created. This has made a lot of people very angry and has been widely regarded as a bad move."- Douglas Adams

Offline svadimr

  • Newbie
  • *
  • Posts: 7
Re: guard32.dll and GDB problems (CFP 3.0.25.378)
« Reply #9 on: July 19, 2008, 05:33:00 PM »
I took the test and with DEP and without DEP the situation is the same. The only thing that matters is in AutoRuns guard32.dll is checked or not. Without guard32.dll everything works just fine.
Logged

Offline gibran

  • Average User
  • Comodo's Hero
  • *****
  • Posts: 5056
  • A bad workman always blames his tools
Re: guard32.dll and GDB problems (CFP 3.0.25.378)
« Reply #10 on: July 19, 2008, 06:25:20 PM »
Quote from: svadimr on July 19, 2008, 05:33:00 PM
I took the test and with DEP and without DEP the situation is the same. The only thing that matters is in AutoRuns guard32.dll is checked or not. Without guard32.dll everything works just fine.

Thanls for taking the test. It appears there is no way round.
I'm concerned that guard32.dll is an essential CFP component.
Please run some leaktest to evaluate your security when guard32.dll is disabled.

BTW for reference please post an URL to download the toolchain that includes GDB as it could be useful when developer are going to address this bug.
Logged
"In the beginning the Universe was created. This has made a lot of people very angry and has been widely regarded as a bad move."- Douglas Adams

Offline svadimr

  • Newbie
  • *
  • Posts: 7
Re: guard32.dll and GDB problems (CFP 3.0.25.378)
« Reply #11 on: July 20, 2008, 01:39:31 AM »
Oh well,
Do you have a good suggestion for easy and secure way to perform a leak test? I'll publish my results on this thread.

I'll publish soon the full chain of events that cause this BUG, but it is the same as in
https://forums.comodo.com/empty-t20386.0.html
and
https://forums.comodo.com/empty-t21329.0.html

Thanks a lot for your help.
Logged

Offline gibran

  • Average User
  • Comodo's Hero
  • *****
  • Posts: 5056
  • A bad workman always blames his tools
Re: guard32.dll and GDB problems (CFP 3.0.25.378)
« Reply #12 on: July 20, 2008, 02:03:28 AM »
Quote from: svadimr on July 20, 2008, 01:39:31 AM
Oh well,
Do you have a good suggestion for easy and secure way to perform a leak test? I'll publish my results on this thread.
As I don't know how guard32 work I cannot suggest a specific test. There are many leaktests at http://www.testmypcsecurity.com/securitytests/all_tests.html you can choose few tests in the first group with Firewall Leak and HIPS in Type of Test column

Quote from: svadimr on July 20, 2008, 01:39:31 AM
I'll publish soon the full chain of events that cause this BUG, but it is the same as in
https://forums.comodo.com/empty-t20386.0.html
and
https://forums.comodo.com/empty-t21329.0.html
No please post only a site to downoad the version of GDB you are using
Logged
"In the beginning the Universe was created. This has made a lot of people very angry and has been widely regarded as a bad move."- Douglas Adams

Offline pepalogik

  • Newbie
  • *
  • Posts: 7
Re: guard32.dll and GDB problems (CFP 3.0.25.378)
« Reply #13 on: July 20, 2008, 08:38:02 AM »
I can confirm the bug. I use MinGW with GCC 4.2.1:
http://sourceforge.net/project/showfiles.php?group_id=2435
But it happens for some projects only. Actually, in my case, it happens since I checked the checkbox "This target provides the project's main executable" in Code::Blocks (http://www.codeblocks.org/). It seems impossible to uncheck it and I can't find where this setting is stored. Does anyone know something about this?
« Last Edit: July 20, 2008, 08:40:12 AM by pepalogik »
Logged

Offline mickmur

  • Newbie
  • *
  • Posts: 1
Re: guard32.dll and GDB problems (CFP 3.0.25.378)
« Reply #14 on: August 09, 2008, 12:06:20 AM »
Hey guys,

I could be way off here but through using the autoruns software as suggested earlier in this thread I have disabled the guard32.dll and everything seems to be working fine as regards using dbg.. thing is that the guard32.dll appears (in autoruns.exe) to belong to AVG's shield.

This doesn't bother me as I only use avg for on demand scanning.
As I said, I could be waaaay off!

Micheal
Logged
Pages: [1] 2   Go Up
 

Free Endpoint Protection
Seo4Smf 2.0 © SmfMod.Com Smf Destek