Messages in this thread | | | Date | Thu, 28 Sep 2006 11:30:32 +0900 | From | Masami Hiramatsu <> | Subject | Re: Does this work? "dcprobes" an x86-hack simple djprobes-equivalent? |
| |
Hi Karim,
Thank you for new idea. I discussed your proposal deeply with my coworkers.
I think your approach has following advantages/disadvantages/problem; <advantages> (a) Able to be inserted into the target address of the branch. (b) So, binary analysis tool becomes simple. <disadvantages> (c) Implementation is much complicated. (d) Highly depend on the x86 arch. (e) Bigger overhead than djprobe. (f) There will be side effect(*) <problem> (g) User applications can modify LDT. (ex. wine)
I think the dcprobe will work, but, unfortunately, it has an vulnerability by the problem (g).
(*) In the following code: --- a=0 do { ... a++; }while (a <= 100) --- In case of inserting dcprobe at the 1st line (a=0), it will replace 2nd (or more) instructions. In this case, the fix up routine (based on int3) will be invoked one hundred times.
Thanks,
-- Masami HIRAMATSU 2nd Research Dept. Hitachi, Ltd., Systems Development Laboratory E-mail: masami.hiramatsu.pt@hitachi.com
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |