6 ms·

> Cosmopolitan Libc allows you to log every function call over the program’s execution – just pass --ftrace at the end of your program, like this: > ./hex16.co

> Cosmopolitan Libc allows you to log every function call over the program’s execution – just pass --ftrace at the end of your program, like this: > ./hex16.com ./missing.txt --ftrace That seems like magic. It seems you have to build with a special flag that tells GCC to put a nop at the start of each function. Then, before main runs, Cosmopolitan sees the --ftrace on the command line, and modifies the code in memory to replace those nops with calls to something that does the logging. See https://justine.lol/ftrace/ https://justine.lol/ftrace/.

actionfromafar 4y ago
So much innovation in a tiny libc.
tines 4y ago
You don't in principle have to put any nop's at the start of each function for this kind of function "hooking" to work. The Microsoft Detours library does the same thing with no special compilation needed.
- abainbridge 4y ago
  From https://www.microsoft.com/en-us/research/project/detours/ https://www.microsoft.com/en-us/research/project/detours/ "Detours is a library for instrumenting arbitrary Win32 functions Windows-compatible processors. Detours intercepts Win32 functions by re-writing the in-memory code for target functions." Doesn't that just re-write the DLL import table? ie it only allows interception of a Win32 API calls, not interception of my function A calling my function B?
  - wheybags 4y ago
    No, it inserts a jump instruction at the start of the function, and just overrides whatever is there already. To allow you to call the "original" function, it does some analysis to figure out what it's stomping on, and creates another little bootstrap function that executes that one destroyed instruction, then jumps to the second instruction of the original function. Basically: black magic
    - gilnaa 4y ago
      Isn't this why Windows have MOV EDI, EDI at the start of a function? https://devblogs.microsoft.com/oldnewthing/20110921-00/?p=9583 https://devblogs.microsoft.com/oldnewthing/20110921-00/?p=95...
      - abainbridge 4y ago
        No. It sounds like Detours works even when the function hasn't got MOV EDI, EDI at the start.
    - abainbridge 4y ago
      Oh yeah, sophisticated: https://github.com/microsoft/Detours/wiki/OverviewInterception https://github.com/microsoft/Detours/wiki/OverviewIntercepti...
- deleted 4y ago
  [deleted]
wyldfire 4y ago
> It seems you have to build with a special flag that tells GCC to put a nop at the start of each function. BTW - llvm+clang support a similar feature called "X-ray" [1]. It's intended to allow for patching (and unpatching!) these entry/exit points at runtime, with calls to specific tracing / black box facilities or whatever your favorite logging mechanism might be. And it's not limited to x86_64. [1] https://llvm.org/docs/XRay.html https://llvm.org/docs/XRay.html
Graziano_M 4y ago
I am not sure how it's done with cosmopolitan libc, but on MSVC++, when compiled with a hotpatching, every function had a `mov edi, edi` instruction at the start, so that there were a few useless bytes that could be safely removed. Avoid the need for a trampoline.

actionfromafar 4y ago

So much innovation in a tiny libc.

tines 4y ago

You don't in principle have to put any nop's at the start of each function for this kind of function "hooking" to work. The Microsoft Detours library does the same thing with no special compilation needed.

abainbridge 4y ago
From https://www.microsoft.com/en-us/research/project/detours/ https://www.microsoft.com/en-us/research/project/detours/ "Detours is a library for instrumenting arbitrary Win32 functions Windows-compatible processors. Detours intercepts Win32 functions by re-writing the in-memory code for target functions." Doesn't that just re-write the DLL import table? ie it only allows interception of a Win32 API calls, not interception of my function A calling my function B?
- wheybags 4y ago
  No, it inserts a jump instruction at the start of the function, and just overrides whatever is there already. To allow you to call the "original" function, it does some analysis to figure out what it's stomping on, and creates another little bootstrap function that executes that one destroyed instruction, then jumps to the second instruction of the original function. Basically: black magic
  - gilnaa 4y ago
    Isn't this why Windows have MOV EDI, EDI at the start of a function? https://devblogs.microsoft.com/oldnewthing/20110921-00/?p=9583 https://devblogs.microsoft.com/oldnewthing/20110921-00/?p=95...
    - abainbridge 4y ago
      No. It sounds like Detours works even when the function hasn't got MOV EDI, EDI at the start.
  - abainbridge 4y ago
    Oh yeah, sophisticated: https://github.com/microsoft/Detours/wiki/OverviewInterception https://github.com/microsoft/Detours/wiki/OverviewIntercepti...
deleted 4y ago
[deleted]

wyldfire 4y ago

> It seems you have to build with a special flag that tells GCC to put a nop at the start of each function. BTW - llvm+clang support a similar feature called "X-ray" [1]. It's intended to allow for patching (and unpatching!) these entry/exit points at runtime, with calls to specific tracing / black box facilities or whatever your favorite logging mechanism might be. And it's not limited to x86_64. [1] https://llvm.org/docs/XRay.html https://llvm.org/docs/XRay.html

Graziano_M 4y ago

I am not sure how it's done with cosmopolitan libc, but on MSVC++, when compiled with a hotpatching, every function had a `mov edi, edi` instruction at the start, so that there were a few useless bytes that could be safely removed. Avoid the need for a trampoline.