microsoft/sudo

Sudo tries to leverage the kernel DLLs before loading them

mobilejon opened this issue · 5 comments

mobilejon commented

Sudo for Windows version

1.0.0

Windows build number

10.0.26100.1742

Other Software

N/A

Steps to reproduce

Using Sudo in CMD or w/e.

I found that prior to loading the nll.dll Sudo, is trying to use it as I found in the stack trace:

image
graphic

Expected Behavior

N/A

Actual Behavior

I don't think it's a behavioral issue, but upon debugging and looking at how Sudo works for an upcoming blog I noticed that is probably not the right behavior. The issue goes away once ntdll.dll is loaded

DHowett commented

What tool is that?

AvogatoWizardWhisker commented

What tool is that?

I can't tell what software this is but it's likely a debugging or crash analysis tool.

mobilejon commented

That is procmon

AvogatoWizardWhisker commented

That is procmon

I knew the interface looks so familair.

dmex commented

This is a bug caused by recent security hardening changes to the Process Monitor kernel driver. Try viewing the process start event of any other third party program and they all have the exact same issue.

You'll need to downgrade to an older version or wait for Procmon to include support for virtual handles with SymInitialize.