X-Recipient: archive-cygwin AT delorie DOT com DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:reply-to:subject:to:references:from:message-id :date:mime-version:in-reply-to:content-type :content-transfer-encoding; q=dns; s=default; b=R1krzkcQANj+1mvI bdXfXsL0S7oSR13zSlt2FehmLWz2GplAdCPuG1b2zWN9EwjWV2n/WFrIKriZKxCE eEsrQ4ELfDhFQcH40SrtC/T7O1Bgyswg2zNiQRSoctJRUfi1A6hbBiR5EwZn9+/u 7wFF4PCxxhBoUKWMBypSH09hKDY= DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:reply-to:subject:to:references:from:message-id :date:mime-version:in-reply-to:content-type :content-transfer-encoding; s=default; bh=lDs6qt/IeIohGoM57rLRvO bZRfU=; b=KkvqPW0XLUvsRuuovZun1bAeHXHTmif7OrV27ZH4guHecKbf37BqnH x4gxFw5Xl7TuX6sB+d3drz2eB9tSGVlivyM3AnvqqZnnUGRfkJ4wsG1qlL0YfimY d9/2r0fxFJVr2JmkDlDBUah79733s2nOQvLlrJiztHX+YzZuoslIE= Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner AT cygwin DOT com Mail-Followup-To: cygwin AT cygwin DOT com Delivered-To: mailing list cygwin AT cygwin DOT com Authentication-Results: sourceware.org; auth=none X-Spam-SWARE-Status: No, score=-2.5 required=5.0 tests=AWL,BAYES_00,RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 spammy=HX-Languages-Length:2733, threat, dat, screen X-HELO: smtp-out-so.shaw.ca Reply-To: Brian DOT Inglis AT SystematicSw DOT ab DOT ca Subject: Re: tar 1.29 hangs, when run with strace, it exits with "illegal instruction" To: cygwin AT cygwin DOT com References: From: Brian Inglis Openpgp: preference=signencrypt Message-ID: <632325ad-e043-1a1d-23c1-6c24d6456c5f@SystematicSw.ab.ca> Date: Fri, 9 Aug 2019 14:42:17 -0600 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-IsSubscribed: yes On 2019-08-09 13:13, Keith Christian wrote: > On Wed, Aug 7, 2019 at 9:33 PM Brian Inglis wrote: >> On 2019-08-07 12:20, Keith Christian wrote: >>> I am able to run "tar ft somefile.tar" successfully on a Linux >>> machine, same tar version (1.29.) >>> >>> This version hangs up the terminal, does not respond to Ctrl-C or >>> Ctrl-Z, and terminates with an illegal instruction to the screen, not >>> reflected in the strace output. >>> >>> File cygwin_tar_1_29_illegal_instruction.txt is attached with strace >>> output, version, and "cygcheck tar" output. >> >> Works just fine for me: >> >> $ tar ft Downloads/nam.dist.tar >> README >> demo/ >> ... >> >> You may have some http://www.cygwin.com/acronyms/#BLODA interfering like an AV. >> The strace shows tar fails in sysfer.dll, which is part of Symantec Endpoint >> Protection CMC Firewall Application and Device Control, badly written from the >> number of complaints about it, and as usual with these control and monitoring >> products, they greatly slow down systems and interfere with work. >> Deinstall SEP or bypass your cygwin directories. > Cygwin is on a corporate machine so disabling anything will not be > easy or allowed. Can you explain "bypass cygwin directories?" > > Cygwin's tar worked recently so must be an "enhancement" in the > security software or some change in tar that is frowned upon. I see > no evidence of Symantec Endpoint software, must be different AV > software. Change the AV settings to ignore the file types or directories that cause issues. SEP includes sysfer.dll, but you may not see much evidence of the product in a centralized corporate control and monitoring environment, designed solely to monitor everything and prevent any threat. The problem is SEP sysfer.dll has a bug which executes an illegal instruction, probably by calling a method via a bad pointer, incorrectly set up or clobbered earlier by the AV, while interfering with tar's operation. The difference may be in what the tar file contains. A lot of Windows products block file types rather than file contents. Untarring, renaming (as ...#.dat), and retarring under Linux (with the old and new names in a manifest or a script to rename back) can often bypass dumb checks. Some of their "advanced", "smart", or "AI" products or features attempt blocks if certain data contents are seen or calls are made as they are considered problematic and characteristic of malware: of course, most are false positives! -- Take care. Thanks, Brian Inglis, Calgary, Alberta, Canada This email may be disturbing to some readers as it contains too much technical detail. Reader discretion is advised. -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple