wapiflapi / villoc Goto Github PK

The pintool is broken. I shouldn't have merged it.

This isn't easy to get right because pintools isn't the right tool for the job. ltrace or LD_PRELOAD should be used to debug dynamic calls. If someone wants to fix this OK. Here are the issues:

• There is no guarantee a called function will return using pintools because said function can jump into another one that isn't instrumented. For the pintool to be considered "working" it should handle this case and not be implementation dependent. This is a major issue. For example, on linux, calloc jumps into malloc at some point.
• The pintool doesn't detect abnormal termination of the program. Abort or Segfault, etc. In general it should tell villoc that a function didn't return. Villoc will know what to do and mark corresponding blocks as failures. This is important.
• The output isn't the same as ltrace's, (there is a missing space after the ',' in argument lists). This could also be fixed on villoc's side by changing the regex. Minor issue.

Right now the easiest way of using villoc is with ltrace as documented in the README. This works fine in some cases but fails spectacularly when libc it's doing its own internal allocations, and especially if those are later freed from the target. (eg free(strdup()).

Right now the best (only?) idea I have is shipping a gdb script that sets some breakpoints and outputs something compatible with villoc's input.

If anyone has a better idea I'd be happy to talk about it!

When using filters in ltrace, functions are prefixed with the calling library.
For example, if you run:
ltrace -e free+malloc gcc
You will get lines that are prefixed with gcc-> which villoc ignores:

...
gcc->malloc(6)                            = 0x1f6fd80
gcc->malloc(32)                           = 0x1f71a30
...

When using setarch x86_64 -R ltrace -o trace ./target; villoc.py trace out.html, the output is reversed. For exmple, the first malloc is at the bottom, and I have to read from bottom to top.