DynamoRIO / DynamoRIO/dynamorio
[drmemtrace] Tracer instrumentation incorrectly relies on runtime data
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 629
- Avg merge
- 2d 15h
- Merged PRs (30d)
- 31
Description
In the tracer, `event_inscount_app_instruction()` is responsible to add instrumentation instructions to update `instr_count` during no-trace periods, so that tracing can be enabled once the no-trace threshold is reached.
This function is called before tracing to instrument the binary.
For performance reasons (xref: #4487 #5026), the type of instrumentation used depends on how large the no-trace threshold is.
`event_inscount_app_instruction()` obtains this threshold from `instr_count_threshold()`, which has a return value that depends on the current window we're at during tracing.
In other words, the threshold changes as tracing progressed, but since `event_inscount_app_instruction()` happens before tracing, the chosen threshold is always the first no-trace period.
Contributor guide
Assessment
This issue has not been assessed yet.