3 ms·
> First of all, it is impossible to instrument a random binary on the fly without private symbols. That's not true. You can use DTrace instrumentation on any b
by vardump 10y ago
> First of all, it is impossible to instrument a random binary on the fly without private symbols.
That's not true. You can use DTrace instrumentation on any binaries. It's more effort, of course, to figure out what address is what. You can work backwards from system calls to get some reference point about target process data structures. And of course trace obvious things such as function entry points, particular instructions, etc.
Also other dynamic binary tracing frameworks can do tracing without symbols.
- ksk 10y ago>> It's more effort, of course, to figure out what address is what. Um.. at that point you're pretty much making your own symbols. So I don't know what your point is.
- vardump 10y agoIs it a phonebook when someone finds out and scribbles down phone numbers for a few people?
- ksk 10y agoI don't think you get it. Getting the address of the function call and capturing the entire call stack of a running process is trivial. It has been possible to do this for decades on all platforms where the ABI is known. Knowing what address belongs to which function, knowing the type of the parameters, return values, etc, requires a ton of effort. But I could be wrong. Can you point to any common usecase of dtrace where people use it when no debugging symbols and no providers are present in the user code and everything has to be reverse engineered? I'm not going to bother with inlined functions and the like - which would be unfair for any tool to automatically know about.