Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Set Default Behavior to Skip Re-Instrumentation of Duplicate Modules #86

Merged
merged 9 commits into from
Dec 17, 2024

Conversation

dillonfranke
Copy link
Contributor

@dillonfranke dillonfranke commented Dec 11, 2024

  • Added a check that prevents subsequent modules of the same name from being re-instrumented. This is useful when instrumenting certain Apple frameworks which, as of MacOS Sequoia, now have the same name.
  • Added a check to the Hook API to throw an error if the hook cannot be resolved. This provides feedback to the hook writer when the hook fails.

Copy link

google-cla bot commented Dec 11, 2024

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

tinyinst.cpp Outdated
@@ -850,6 +851,8 @@ void TinyInst::OnModuleInstrumented(ModuleInfo* module) {
}
if(address) {
resolved_hooks[address] = hook;
} else {
FATAL("Could not resolve function %s in module %s", hook->GetFunctionName().c_str(), hook->GetModuleName().c_str());
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We don't want to FATAL() here because hook's module name could be "*" so it searches for the function in all modules.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah that makes good sense. Do you foresee a better way to alert the user if a hook function is unable to be resolved? Or do you think it's not necessary?

Copy link
Contributor Author

@dillonfranke dillonfranke Dec 13, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I suppose I could just change it to WARN()

README.md Outdated
@@ -188,6 +188,8 @@ In addition to the general-purpose API documented above, TinyInst also implement

`-indirect_instrumentation [none|local|global|auto]` which instrumentation to use for indirect jump/calls

`-ignore_duplicates_module [module name]` Ensures only the first loaded instance of `[module name]` is instrumented, ignoring subsequent duplicates. Useful when instrumenting system libraries (e.g., `CoreAudio`) on macOS Sequoia and later, where multiple distinct libraries with the same name may be loaded.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think having a flag for this is not needed; TinyInst will not currently work correctly with duplicate module names, so the current ignore_duplicates behavior should just be the default implementation for all modules. Just issuing a warning on duplicate module and not instrumenting it is completely sufficient.

Later we need to think how to resolve this e.g. if the user wants to instrument the second module with the same name (or multiple modules with the same name). For that, there should probably be an option to specify instrumented_module by full path, but we can figure that out later.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sounds good! I will go ahead and remove the flag and implement ignoring duplicate modules as the default behavior :)

Copy link
Collaborator

@ifratric ifratric left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Awesome! I left one more comment regarding the hook warning, but otherwise looks good!

@@ -850,6 +850,8 @@ void TinyInst::OnModuleInstrumented(ModuleInfo* module) {
}
if(address) {
resolved_hooks[address] = hook;
} else {
WARN("Could not resolve function %s in module %s", hook->GetFunctionName().c_str(), hook->GetModuleName().c_str());
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it only makes sense to issue this warning if hook->GetModuleName() != "*". Could you add this check?

@dillonfranke dillonfranke changed the title Implement -ignore_duplicates_module Set Default Behavior to Skip Re-Instrumentation of Duplicate Modules Dec 16, 2024
added additional check for wildcard module before warning of failed hook resolution
@ifratric
Copy link
Collaborator

Cool, I think we can merge now!

@ifratric ifratric merged commit c0aeb2b into googleprojectzero:master Dec 17, 2024
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants