Databases
StackOverflow2013
Postsdbo
POHow to do Binary instrumentation of syscall brk ? (x86-64 Linux) (maybe valgrind?)
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POHow to do Binary instrumentation of syscall brk ? (x86-64 Linux) (maybe valgrind?)
    primarykey
    data
    text
    <p>I'd like to instrument <a href="http://www.kernel.org/doc/man-pages/online/pages/man2/brk.2.html" rel="nofollow"><code>syscall brk</code></a> (and other calls but this in first order, it's most important to me) in <em>given binary</em> (preferably on actual syscall/sysenter level (x86-64 and x86) of making <a href="http://lxr.linux.no/#linux+v3.4.3/include/linux/syscalls.h#L455" rel="nofollow"><code>sys_brk</code></a> call).</p> <p>Main goal:</p> <ul> <li>A part of sandbox which gives <em>fixed amount</em> of memory to jailed process</li> <li>So, I'd like to get rid of <a href="http://www.kernel.org/doc/man-pages/online/pages/man2/brk.2.html" rel="nofollow"><code>brk</code></a> system calls (and most preferably others in next order) and simulate memory allocations under <em>fixed limit</em>. <em>Fixed limit</em> is memory space, available to program. (You can think about it like making a kind of sandbox with fixed amount of available memory)</li> </ul> <p>How to implement (one of) some example possible solutions (or yours solution):</p> <ul> <li>just changing instructions to <a href="http://en.wikipedia.org/wiki/NOP" rel="nofollow"><code>NOP</code></a></li> <li>As <code>brk</code> returns 0 on success, simulate it's successes with setting operations that sets memory (register) state , as <a href="http://www.kernel.org/doc/man-pages/online/pages/man2/brk.2.html" rel="nofollow"><code>brk</code></a> would be called with success.</li> <li>More complex... instrument with code (or function call) which simulates success memory allocations under fixed limit.</li> <li>Most flexible (maybe overkill in my case) to change this syscall into function call and add provided function to binary.</li> </ul> <p><em>Given binary</em> is code that can be malicious in one of two (most preferably both :) ) forms:</p> <ul> <li>shared library - here I can setup environment before function call (for example do brk call in controlled way)</li> <li>program binary - in this case we need to give program <em>fixed amount</em> of memory (by caller, or on begining of program "one syscall"), cause it can not allocate. Example of calling such program should be included in answer.</li> </ul> <p>As problem is highly connected with many other aspects, I tried do my best in separating it as question, but please give me advice if I should specify something more or less.</p> <p>Answers with implementation, links to resources (books, tutorials) are welcome.</p> <p>(I am most interested in <strong>Linux</strong>, and solution that is <em>reliable</em>, so that people preparing binaries, even in assembler, would not have to worry about execution of their code)</p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PTQuestion
    1. USGrzegorz Wierzowiecki
    1. USGrzegorz Wierzowiecki
    plurals
    1. PL
      singulars
      1. LTLinked
    2. PL
      singulars
      1. LTLinked
    1. PL
      singulars
      1. LTLinked
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POHow to do Binary instrumentation of syscall brk ? (x86-64 Linux) (maybe valgrind?)
      1. USGrzegorz Wierzowiecki
      1. VTFavorite
    1. This table or related slice is empty.
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload