DynamoRIO / DynamoRIO/dynamorio
AARCHXX: Implement dr_insert_mbr_instrumentation
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 629
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 31
Description
The code below works find on intel x64 but on on arm7/AARCHXX:
```
#include
#include
#include
#include
#include
#include
#include "droption.h"
#include "dr_api.h"
#include "drmgr.h"
#include "drx.h"
#include "drwrap.h"
#include "drx.h"
#include "drutil.h"
#include "drreg.h"
#include
#include
#include
#include
#include
#include
#include
#include
int debug = 1;
static void ind(app_pc instr_addr, app_pc target_addr) {
fprintf(stderr, "INDIRECT from %p to %p\n", instr_addr, target_addr);
}
static dr_emit_flags_t event_app_instruction(void *drcontext, void *tag, instrlist_t * bb, instr_t * inst, bool for_trace, bool translating, void *user_data) {
drmgr_disable_auto_predication(drcontext, bb);
if (instr_is_call_indirect(inst) == true) {
if (debug) {
char buf[64];
instr_disassemble_to_buffer(drcontext, inst, buf, sizeof(buf));
fprintf(stderr, "INFO %p %s ; indirect call\n", instr_get_app_pc(inst), buf);
}
drreg_status_t res = drreg_restore_app_values(drcontext, bb, inst, instr_get_target(inst), NULL);
dr_insert_mbr_instrumentation(drcontext, bb, inst, (app_pc)ind, SPILL_SLOT_1);
} else if (instr_is_mbr(inst) == true && instr_is_return(inst) == false) {
if (debug) {
char buf[64];
instr_disassemble_to_buffer(drcontext, inst, buf, sizeof(buf));
fprintf(stderr, "INFO %p %s ; indirect jump\n", instr_get_app_pc(inst), buf);
}
drreg_status_t res = drreg_restore_app_values(drcontext, bb, inst, instr_get_target(inst), NULL);
dr_insert_mbr_instrumentation(drcontext, bb, inst, (app_pc)ind, SPILL_SLOT_1);
}
return DR_EMIT_DEFAULT;
}
DR_EXPORT void dr_client_main(client_id_t id, int argc, const char *argv[]) {
if (!drmgr_init() || !drx_init() || !drwrap_init())
DR_ASSERT(false);
drmgr_register_bb_instrumentation_event(NULL, event_app_instruction, NULL);
disassemble_set_syntax(DR_DISASM_INTEL);
}
```
on ARM7/AARCH:
```
drrun -c build/libtest.so -- /bin/true
INFO 0xb6ef61d6 tbb byte ptr [pc+r0] ; indirect jump
INFO 0xb6f057d0 tbb byte ptr [pc+r3] ; indirect jump
INFO 0xb6f0592c blx lr, r7 ; indirect call
INFO 0xb6ef66ba bx r3 ; indirect jump
INFO 0xb6ef57f8 ldr pc, dword ptr [r12+0x0820] ; indirect jump
INFO 0xb6ef57d4 bx pc ; indirect jump
INFO 0xb6ef57e0 ldr pc, dword ptr [r12+0x0830] ; indirect jump
INFO 0xb6ef57c4 bx pc ; indirect jump
[...]
```
where the mbr instrumentation function is never called.
on INTEL X64 its what I would except:
```
INFO 0x7ffff7d81792 jmp rax ; indirect jump
INDIRECT from 0x7ffff7d81792 to 0x7ffff7d81902
INFO 0x7ffff7d8162f call r13 ; indirect call
INDIRECT from 0x7ffff7d8162f to 0x7ffff7d6a1e0
INFO 0x7ffff7d6a2ff jmp rax ; indirect jump
INDIRECT from 0x7ffff7d6a2ff to 0x7ffff7d6b368
INFO 0x7ffff7d68a90 jmp qword ptr [0x00007ffff7f8e028] ; indirect jump
INDIRECT from 0x7ffff7d68a90 to 0x7ffff7d81f10
INFO 0x7ffff7d68a80 jmp qword ptr [0x00007ffff7f8e020] ; indirect jump
INDIRECT from 0x7ffff7d68a80 to 0x7ffff7d81f00
INFO 0x7ffff7d68a70 jmp qword ptr [0x00007ffff7f8e018] ; indirect jump
INDIRECT from 0x7ffff7d68a70 to 0x7ffff7d81e00
INFO 0x7ffff7d73b11 call qword ptr [0x00007ffff7f8ef48] ; indirect call
INDIRECT from 0x7ffff7d73b11 to 0x7ffff7d68c90
INFO 0x7ffff7d73b7f jmp qword ptr [0x00007ffff7f8ef50] ; indirect jump
INDIRECT from 0x7ffff7d73b7f to 0x7ffff7d68ca0
INFO 0x7ffff7d83bc9 jmp r10 ; indirect jump
INDIRECT from 0x7ffff7d83bc9 to 0x7ffff7d84a30
```
or did I forget something important which is necessary for ARM?
Contributor guide
Assessment
This issue has not been assessed yet.