ramosian-glider / sanitizer-issues

test
0 stars 0 forks source link

We need to use library interposition instead of mach_override on Mac OS. #64

Closed ramosian-glider closed 9 years ago

ramosian-glider commented 9 years ago

Originally reported on Google Code with ID 64

The interposition hack is described in Amit Singh's "Mac OS X Internals" and works as
follows.

$ cat t.c 
#include <stdio.h>
#include <string.h>
const char kStr[] = "Hello world!";
int main() {
  char *dup = strdup(kStr);
  printf("dup: %s\n", dup);
  printf("strlen(dup): %d\n", strlen(dup));
  return 0;
}
$ gcc t.c -o t
...
$ ./t
dup: Hello world!
strlen(dup): 12

$ cat v.cc 
#include <unistd.h>
#include <string.h>

size_t my_strlen(const char *_) {
  return 4;
}

struct interpose_substitution {
  const void* replacement;
  const void* original;
};

#define INTERPOSE_FUNCTION(function) \
    { reinterpret_cast<const void*>(my_##function), \
      reinterpret_cast<const void*>(function) }

__attribute__((used))
const interpose_substitution substitutions[]
    __attribute__((section("__DATA, __interpose"))) = {
  INTERPOSE_FUNCTION(strlen),
};

$ g++ v.cc -dynamiclib -o v.dylib

$ DYLD_INSERT_LIBRARIES=`pwd`/v.dylib ./t
dup: Hell
strlen(dup): 4

Reported by ramosian.glider on 2012-04-13 15:16:56

ramosian-glider commented 9 years ago
Related discussion at Chromium (which uses both): http://code.google.com/p/chromium/issues/detail?id=99879

Pros and cons.

mach_override:
+ already works
+ same approach will allow to handle syscalls
- may need to extend manually for new functions
- makes code pages unshareable

__interpose:
+ easy to add new functions
- this is LD_PRELOAD essentially (need to check if we can do it in the binary)
- could be problematic to factor the wrappers into a separate .dylib (otherwise the
whole runtime will be preloaded)

Reported by ramosian.glider on 2012-04-13 15:37:40

ramosian-glider commented 9 years ago
Status update: currently (LLVM r166922) we build and install the dynamic version of
ASan runtime on OS X, although the -faddress-sanitizer flag still links the program
with the static one. The dynamic runtime allows us to run Chrome tests and Chrome itself
on OS X 10.6--10.8. It's also possible to run some Chrome tests on the iOS simulator,
but it's unclear yet whether this approach works with real iOS devices.

Reported by ramosian.glider on 2012-10-29 11:41:00

ramosian-glider commented 9 years ago

Reported by ramosian.glider on 2012-10-29 11:50:20

ramosian-glider commented 9 years ago

Reported by glider@chromium.org on 2013-01-17 12:42:40

ramosian-glider commented 9 years ago
http://llvm-reviews.chandlerc.com/D216 and http://llvm-reviews.chandlerc.com/D223 are
the two changelists to enable the new dynamic runtime.

Reported by ramosian.glider on 2013-01-18 16:57:49

ramosian-glider commented 9 years ago
The dynamic runtime is now the default one. ASan doesn't use mach_override anymore.

Reported by ramosian.glider on 2013-02-07 16:00:52

ramosian-glider commented 9 years ago
Adding Project:AddressSanitizer as part of GitHub migration.

Reported by ramosian.glider on 2015-07-30 09:12:59