Dynamic System Call Instrumentation via Trampoline Redirects
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for instrumenting source processes that call target processes are limited, as they often require modifying target library processes or using kernel facilities like ptrace, which are not feasible for already-running processes or provide incomplete instrumentation, especially when symbol tables are unavailable.
Innovation Solution
The method involves accessing a loaded but paused source process executable, disassembling it to identify system calls, and building a trampoline with check flag instructions to redirect execution flow, allowing for instrumentation of system calls by overwriting them with jump-to-trampoline instructions, enabling flexible and efficient instrumentation without relying on dynamic linking or symbol tables.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If kernel facilities like ptrace are used to instrument source processes, then instrumentation capability is provided, but the method is not feasible for already-running processes and provides incomplete instrumentation
Solution Approach 1:
The patent instruments source processes by modifying their executable code before execution or at startup, rather than attempting to attach to already-running processes. This preliminary action allows the instrumentation code to be embedded in the process image itself, ensuring reliable instrumentation without the limitations of kernel facilities like ptrace that cannot modify running processes.
Solution Approach 2:
The patent creates a copy of the source process executable and instruments this copy, then executes the instrumented version. This copying approach allows instrumentation to be applied reliably to the process code without interfering with already-running processes, while still providing complete instrumentation capability.
2Reliability
If target library processes are modified for instrumentation, then system call instrumentation is achieved, but the approach is complex and not feasible for all scenarios
Solution Approach 1:
The patent extracts the instrumentation logic from target library processes and embeds it directly in the source process executable. By taking out the instrumentation code from external libraries and incorporating it into the source process itself, the approach simplifies the overall system architecture and eliminates the need to modify target libraries, while still achieving complete system call instrumentation.
Solution Approach 2:
The patent introduces an intermediary instrumentation layer within the source process that mediates between the system calls and the target processes. This intermediary approach provides reliable system call instrumentation without requiring modification of target libraries, simplifying the instrumentation approach while maintaining comprehensive monitoring capability.
3Loss of information
If symbol tables are unavailable, then process investigation is limited, but the patent enables instrumentation without symbol tables
Solution Approach 1:
The patent enables the instrumentation system to investigate source processes without relying on external symbol tables by making the system self-sufficient. The instrumentation code embedded in the source process can directly interpret and analyze its own executable code, allowing complete investigation capability without loss of information due to unavailable symbol tables.
Data Source
AI summary
In one embodiment, a method includes accessing a loaded but paused source process executable and disassembling the source process executable to identify a system call to be instrumented and an adjacent relocatable instruction. Instrumenting the system call includes building a trampoline for the system call that includes a check flag instruction at or near an entry point to the trampoline and two areas of the trampoline that are selectively executed according to results of the check flag instruction. Building a first area of the trampoline includes providing instructions to execute a relocated copy of the adjacent relocatable instruction and return flow to an address immediately following the adjacent relocatable instruction. Building a second area of the trampoline includes providing instructions to invoke at least one handler associated with executing a relocated copy of the system call and return flow to an address immediately following the system call.