iovisor / iovisor/bcc

uprobe attached to functions defined in self-compiled binary doesn't fire

Open
#3,215 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
22.7k
Forks
4.1k
Avg merge
10d 4h
Merged PRs (30d)
3

Description

Consider the following program. It goes into `/tmp/bin.c` and the corresponding executable is built with `gcc -o bin bin.c`.

```c
#include

void foo();

int main(int argc, char **argv) {
foo();
}

void foo() {
puts("hello");
}
```

The bcc script `do_main.py` contains the following

```python
#!/usr/bin/python

from __future__ import print_function
import bcc

b = bcc.BPF(text="""
int do_libc_main(void *ctx) {
bpf_trace_printk("libc main\\n");
return 0;
};

int do_binary_main(void *ctx) {
bpf_trace_printk("binary main\\n");
return 0;
};
""")

b.attach_uprobe(name="/usr/lib64/libc.so.6",
sym="__libc_start_main",
fn_name="do_libc_main")
b.attach_uprobe(name="/tmp/bin",
sym="main",
fn_name="do_binary_main")

while True:
print(b.trace_fields())
```

Then I execute `sudo python do_main.py` and run `/tmp/bin` from another terminal. As you can see below, only the probe attached to the library function `__libc_start_main` fires.

```
$ sudo python do_main.py
('bin', 8103, 2, '....', 607583.867852, 'libc main')
```

The issue can be reproduced with `bpftrace`.

```
$ sudo bpftrace -e 'uprobe:/usr/lib64/libc.so.6:__libc_start_main { printf("main called\n"); }' -c /tmp/bin
Attaching 1 probe...
hello
main called

$ sudo bpftrace -e 'uprobe:/tmp/bin:main { printf("main called\n"); }' -c /tmp/bin
Attaching 1 probe...
hello

```

To make things more complicated, the probe attached to certain binaries shipped with the system does fire!

```
$ sudo bpftrace -e 'uprobe:/bin/bash:main { printf("main called\n"); }' -c /bin/bash
Attaching 1 probe...
main called
main called

```

------

System information:

```
$ lsb_release -a
LSB Version: :core-4.1-amd64:core-4.1-noarch
Distributor ID: n/a
Description: NAME="Red Hat Enterprise Linux Server"
Release: n/a
Codename: n/a

$ uname -a
Linux mwfsh 3.10.0-1160.6.1.el7.x86_64 #1 SMP Tue Nov 17 13:59:11 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

$ gcc --version
gcc (GCC) 7.3.1 20180303 (Red Hat 7.3.1-5)
Copyright (C) 2017 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

$ sudo python -c 'import bcc; print(bcc.__version__)'
0.18.0-b1ab8690

$ bpftrace --version
bpftrace v0.11.0-118-gf543-dirty
```

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.