panda-re / panda

Platform for Architecture-Neutral Dynamic Analysis
https://panda.re
Other
2.48k stars 479 forks source link

CallstackInstr: switch to SBE/EBE callbacks #1445

Closed AndrewFasano closed 8 months ago

AndrewFasano commented 8 months ago

The old callstack instr logic would miss many calls if tb_chaining was enabled (which is is by default). Since this plugin did not disable tb_chaining, many calls would be missed if a user didn't disable chaining or load another plugin that disabled chaining.

This commit updates the plugin to use start_block_exec and end_block_exec which work even with tb_chaining enabled.

Thanks to @lacraig2 for suggesting this fix.

Hopefully fixes #1443.

One slight concern about this change is how the EBE callback works with interrupts - I know ABE is triggered when a block is interrupted and callbacks are infored of this through the exitCode arg which callstack_instr was checking. If EBE is just not called when this happens, this updated code will be correct. Otherwise, if it's still called on these weird "end" blocks, I'm not sure these changes will be correct.