search

googleprojectzero / TinyInst

A lightweight dynamic instrumentation library
Apache License 2.0
1.18k stars 119 forks source link

OSX issue with application calling `fork()` #40

Closed jrmadsen closed 3 years ago

jrmadsen commented 3 years ago

Hi, I think you might need to add "applications calling fork" to the restrictions. I've found that if the applications calls fork at any point, the following gets raised:

[-] PROGRAM ABORT : Debugger object could not be found in the map, task port = (3107)
         Location : catch_mach_exception_raise_state_identity(), /Users/jrmadsen/devel/c++/TinyInst/macOS/debugger.cpp:1726

NOTE: line number will be slightly off since I've made some minor modifications.

Out of curiosity, any idea what would need to be done to ignore the forked task port?

ifratric commented 3 years ago

Hi, yes that's right, applications calling fork() are not supported.

The issue you're seeing is because TinyInst registers itself as an exception handler for the target process. When the target fork()s, TinyInst becomes an exception handler for both the parent and the child and TinyInst starts receiving exception for the child process as well as the parent. As TinyInst is not aware of the child process, you get an error as above.

You could simply ignore all exceptions from the child and let that process handle them themselves, but that won't actually solve the problem. This is because, if the parent is instrumented, upon forking, the child is instrumented as well, and TinyInst needs to be able to catch certain types of excpetions for instrumentation to work properly. Therefore, if TinyInst ignores exceptions from the child, the child will simply crash.

tl;dr no easy solution at this point.

jrmadsen commented 3 years ago

Thanks for the info.

Therefore, if TinyInst ignores exceptions from the child, the child will simply crash.

Yeah, definitely figured that out (hence the note about minor modifications).