frida / frida-gum

Cross-platform instrumentation and introspection library written in C
https://frida.re
Other
734 stars 242 forks source link

gum_process_enumerate_ranges very slow on macOS #693

Open omergreen opened 1 year ago

omergreen commented 1 year ago
#include "frida-gum.h"
#include <sys/mman.h>

int callback(const GumRangeDetails * details, void *user) {
    return 1;
}

int main (int argc, char * argv[]) {
    long size_to_allocate = 1L << 0x2b;
    void *m = mmap(0, size_to_allocate, PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_PRIVATE | MAP_NORESERVE, -1, 0);
    if (!m) {
        perror("mmap");
        return 0;
    }

    gum_process_enumerate_ranges(0, callback, 0);
    return 0;
}

I encountered this with libafl-frida ASAN's shadow map on my mac. On my machine, this code takes about 20 seconds to run. For some reason it seems that the kernel splits the big allocation to many small ones of size 0x8000000, and the majority of the time is spent on the __proc_info calls here https://github.com/frida/frida-gum/blob/main/gum/backend-darwin/gumprocess-darwin.c#L1901.