Skip to content

Set Default Behavior to Skip Re-Instrumentation of Duplicate Modules#86

Merged
ifratric merged 9 commits intogoogleprojectzero:masterfrom
dillonfranke:master
Dec 17, 2024
Merged

Set Default Behavior to Skip Re-Instrumentation of Duplicate Modules#86
ifratric merged 9 commits intogoogleprojectzero:masterfrom
dillonfranke:master

Conversation

@dillonfranke
Copy link
Contributor

@dillonfranke dillonfranke commented Dec 11, 2024

  • Added a check that prevents subsequent modules of the same name from being re-instrumented. This is useful when instrumenting certain Apple frameworks which, as of MacOS Sequoia, now have the same name.
  • Added a check to the Hook API to throw an error if the hook cannot be resolved. This provides feedback to the hook writer when the hook fails.

@google-cla
Copy link

google-cla bot commented Dec 11, 2024

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

tinyinst.cpp Outdated
if(address) {
resolved_hooks[address] = hook;
} else {
FATAL("Could not resolve function %s in module %s", hook->GetFunctionName().c_str(), hook->GetModuleName().c_str());
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We don't want to FATAL() here because hook's module name could be "*" so it searches for the function in all modules.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah that makes good sense. Do you foresee a better way to alert the user if a hook function is unable to be resolved? Or do you think it's not necessary?

Copy link
Contributor Author

@dillonfranke dillonfranke Dec 13, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I suppose I could just change it to WARN()

README.md Outdated

`-indirect_instrumentation [none|local|global|auto]` which instrumentation to use for indirect jump/calls

`-ignore_duplicates_module [module name]` Ensures only the first loaded instance of `[module name]` is instrumented, ignoring subsequent duplicates. Useful when instrumenting system libraries (e.g., `CoreAudio`) on macOS Sequoia and later, where multiple distinct libraries with the same name may be loaded.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think having a flag for this is not needed; TinyInst will not currently work correctly with duplicate module names, so the current ignore_duplicates behavior should just be the default implementation for all modules. Just issuing a warning on duplicate module and not instrumenting it is completely sufficient.

Later we need to think how to resolve this e.g. if the user wants to instrument the second module with the same name (or multiple modules with the same name). For that, there should probably be an option to specify instrumented_module by full path, but we can figure that out later.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sounds good! I will go ahead and remove the flag and implement ignoring duplicate modules as the default behavior :)

Copy link
Collaborator

@ifratric ifratric left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Awesome! I left one more comment regarding the hook warning, but otherwise looks good!

if(address) {
resolved_hooks[address] = hook;
} else {
WARN("Could not resolve function %s in module %s", hook->GetFunctionName().c_str(), hook->GetModuleName().c_str());
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it only makes sense to issue this warning if hook->GetModuleName() != "*". Could you add this check?

@dillonfranke dillonfranke changed the title Implement -ignore_duplicates_module Set Default Behavior to Skip Re-Instrumentation of Duplicate Modules Dec 16, 2024
added additional check for wildcard module before warning of failed hook resolution
@ifratric
Copy link
Collaborator

Cool, I think we can merge now!

@ifratric ifratric merged commit c0aeb2b into googleprojectzero:master Dec 17, 2024
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants