googleprojectzero / googleprojectzero/TinyInst

How to generate coverage.txt normally when instrumenting a continuously running background process

Open
#90 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C++
Stars
1.4k
Forks
140
PR merge metrics
No merged PRs in 30d

Description

Hello. Thank you for your excellent work. I am attempting to run the Attach mode on x86 or arm64 Linux to instrument some .so files under a specific process. I used the following command:

./litecov -coverage_file coverage.txt -trace_basic_blocks -trace_debug_events -trace_module_entries -instrument_module libtest.so -pid <pid>

During execution, the following messages were generated:

TRACE: Entered module libtest.so at address 0x7139afe99119, offset 1119
Debugger: Breakpoint at 0x7139afe8a009
TRACE: Executing basic block, original at 0x7139afe99119, instrumented at 0x7139afe8a009
Debugger: Breakpoint at 0x7139afe8a046
TRACE: Executing basic block, original at 0x7139afe99050, instrumented at 0x7139afe8a046
Debugger: Breakpoint at 0x7139afe8a077
TRACE: Executing basic block, original at 0x7139afe99144, instrumented at 0x7139afe8a077...

The target process is an infinite-loop process (simulating a situation where the instrumented target process runs continuously). However, the coverage.txt does not generate as expected.
But following command in Run mode can work, ./main will spawn the process used in the command line above.

./litecov -coverage_file coverage.txt -trace_basic_blocks -trace_debug_events -trace_module_entries -instrument_module libtest.so -- ./main

The generated message is as following and coverage.txt generates normally:

...
Debugger: Breakpoint at 0x7af2e03df21c
TRACE: Executing basic block, original at 0x7af2e03ee148, instrumented at 0x7af2e03df21c
Debugger: Thread 97781 exit
Process finished normally
Found 12 new offsets in libtest.so

Could you please advise how can I ensure that coverage message is correctly written to coverage.txt when instrumenting specific .so files in a process that runs continuously in the background?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with TinyInst's Attach mode and the -coverage_file handling, then compare its lifecycle with Run mode using the two commands in the issue. Check how coverage data is finalized when the target is an infinite-loop background process; done means coverage.txt is written correctly without requiring the target process to exit.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, linux
Domain
devtools, testing-qa
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.