From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 26446 invoked by alias); 9 Aug 2019 20:42:23 -0000 Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Received: (qmail 26439 invoked by uid 89); 9 Aug 2019 20:42:23 -0000 Authentication-Results: sourceware.org; auth=none X-Spam-SWARE-Status: No, score=-2.5 required=5.0 tests=AWL,BAYES_00,RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 spammy=HX-Languages-Length:2733, threat, dat, screen X-HELO: smtp-out-so.shaw.ca Received: from smtp-out-so.shaw.ca (HELO smtp-out-so.shaw.ca) (64.59.136.138) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with ESMTP; Fri, 09 Aug 2019 20:42:22 +0000 Received: from [192.168.1.114] ([24.64.172.44]) by shaw.ca with ESMTP id wBiLhZkJnSrVcwBiMhssbg; Fri, 09 Aug 2019 14:42:19 -0600 Reply-To: Brian.Inglis@SystematicSw.ab.ca Subject: Re: tar 1.29 hangs, when run with strace, it exits with "illegal instruction" To: cygwin@cygwin.com References: From: Brian Inglis Openpgp: preference=signencrypt Message-ID: <632325ad-e043-1a1d-23c1-6c24d6456c5f@SystematicSw.ab.ca> Date: Fri, 09 Aug 2019 20:42:00 -0000 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-IsSubscribed: yes X-SW-Source: 2019-08/txt/msg00133.txt.bz2 On 2019-08-09 13:13, Keith Christian wrote: > On Wed, Aug 7, 2019 at 9:33 PM Brian Inglis wrote: >> On 2019-08-07 12:20, Keith Christian wrote: >>> I am able to run "tar ft somefile.tar" successfully on a Linux >>> machine, same tar version (1.29.) >>> >>> This version hangs up the terminal, does not respond to Ctrl-C or >>> Ctrl-Z, and terminates with an illegal instruction to the screen, not >>> reflected in the strace output. >>> >>> File cygwin_tar_1_29_illegal_instruction.txt is attached with strace >>> output, version, and "cygcheck tar" output. >> >> Works just fine for me: >> >> $ tar ft Downloads/nam.dist.tar >> README >> demo/ >> ... >> >> You may have some http://www.cygwin.com/acronyms/#BLODA interfering like an AV. >> The strace shows tar fails in sysfer.dll, which is part of Symantec Endpoint >> Protection CMC Firewall Application and Device Control, badly written from the >> number of complaints about it, and as usual with these control and monitoring >> products, they greatly slow down systems and interfere with work. >> Deinstall SEP or bypass your cygwin directories. > Cygwin is on a corporate machine so disabling anything will not be > easy or allowed. Can you explain "bypass cygwin directories?" > > Cygwin's tar worked recently so must be an "enhancement" in the > security software or some change in tar that is frowned upon. I see > no evidence of Symantec Endpoint software, must be different AV > software. Change the AV settings to ignore the file types or directories that cause issues. SEP includes sysfer.dll, but you may not see much evidence of the product in a centralized corporate control and monitoring environment, designed solely to monitor everything and prevent any threat. The problem is SEP sysfer.dll has a bug which executes an illegal instruction, probably by calling a method via a bad pointer, incorrectly set up or clobbered earlier by the AV, while interfering with tar's operation. The difference may be in what the tar file contains. A lot of Windows products block file types rather than file contents. Untarring, renaming (as ...#.dat), and retarring under Linux (with the old and new names in a manifest or a script to rename back) can often bypass dumb checks. Some of their "advanced", "smart", or "AI" products or features attempt blocks if certain data contents are seen or calls are made as they are considered problematic and characteristic of malware: of course, most are false positives! -- Take care. Thanks, Brian Inglis, Calgary, Alberta, Canada This email may be disturbing to some readers as it contains too much technical detail. Reader discretion is advised. -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple