panda-re / panda

Platform for Architecture-Neutral Dynamic Analysis
https://panda.re
Other
2.47k stars 474 forks source link

Callstack instr affected by panda_precise_pc & TB chaining #1443

Closed AndrewFasano closed 6 months ago

AndrewFasano commented 6 months ago

If TB chaining is enabled, callstack_instr finds > 2x calls with a linux-based system that runs a very simple bash-based init script. If panda_precise_pc is enabled, callstack_isntr finds 5% more calls.

Some of this is probably related to performance (maybe a slower guest runs more background timer-based things?). But I'm pretty sure at least some events are getting dropped without disabling tb chaining.

I don't think this is supposed to happen. If so, it should be documented.