Paradyn Project Paradyn / Dyninst Week Madison, Wisconsin May 2-3, 2011 Introduction to the PatchAPI Wenbin Fang, Drew Bernat

Motivation: a confluence of two tools 2 Introduction to the PatchAPI User Mutator DyninstAPI Code Patching find point insert snippet delete snippet Process void foo () { } void bar () { } void baz () { } Snippet Process void foo () { bar() } void bar () { baz() } void baz () { } Instrumenter.so Code Patching Snippet Dyninst (3 rd party instrumentation) Self-propelled instrumentation (1 st party instrumentation) PatchAPI

3 Introduction to the PatchAPI AST Binary Process Stackwalker API Stackwalker API Symtab API Symtab API DataFlow API DataFlow API Instruction API Parse API Parse API Code Gen Code Gen ProcControl API Binary = Existing Component = New Component = Proposed Dyninst and the Components Stackwalker API Stackwalker API ProcControl API Patch API Patch API

4 Introduction to the PatchAPI Binary Code Binary Process Symtab API Symtab API Instruction API Parse API Parse API Binary = Existing Component = New Component Self-propelled and the Components … Patch API Patch API

Outline o Overview o Point + Snippet abstractions o Design o Challenges o Public + Plugin interfaces o Applications of PatchAPI o Dyninst Reintegration o Self-propelled instrumentation 5 Introduction to the PatchAPI

Abstraction in DyninstAPI 6 BPatch_addressSpace* app = BPatch_function* foo = BPatch_snippet* snippet = BPatch_Vector * points = NULL;... points = foo->findPoint(BPatch_entry); BPatchSnippetHandle* handle1 = app->insertSnippet(snippet, points, BPatch_callBefore); points = foo->findPoint(BPatch_exit); BPatchSnippetHandle* handle2 = app->insertSnippet(snippet, points, BPatch_callAfter);... Introduction to the PatchAPI FuncEntry Snippet FuncExit Snippet Basic Block CFG of function foo Point Snippet Function Exit Block Entry Before Function Call Before Instruction Function Entry During Edge Dyninst AST DynC Binary Code User-defined

Refined Interfaces in PatchAPI 7 PatchMgrPtr patchMgr = PatchFunction* foo = SnippetPtr snippet = vector points; FilterFunc myfilter; patchMgr->findPoints(foo, FuncEntry | FuncExit | EdgeDuring | BlockExit, myfilter, back_inserter(points)); patchMgr->batchStart(); for (int i = 0; i < points.size(); i++) points[i]->push_back(snippet); patchMgr->batchFinish(); … Introduction to the PatchAPI Basic Block FuncEntry Snippet FuncExit Snippet EdgeDuring CFG of function foo Snippet BlockExit Snippet Filter-based point query Transactional semantics

Design Challenge 1: Backward Compatibility o PatchAPI has refined interfaces for code patching. o Integrating PatchAPI back to dyninst should keep dyninst interfaces unchanged. 8 Introduction to the PatchAPI Dyninst PatchAPI Code Patching Functionality Code Patching Functionality PatchAPI Compatibility Layer

Design Challenge 2: Flexibility 9 Introduction to the PatchAPI Address Space Snippet CFG Parsing Instrumentation Engine 1 st Party 3 rd Party Binary Rewriter AST DynC User-defined Online Parsing Stored CFG In-line Out-of-line 1 st Party User-defined Stored CFG Out-of-line

Plugin Interface Internal Snippet instance at point Opaque handle Location + Container PatchMgr Point Snippet Instance PatchAPI Public Interface 10 Introduction to the PatchAPI Binary Patching Tools Register plugins + Accept requests Public Interface PatchAPI

Patch Manager o Register plugins o Filter-based point query o Enforce transactional semantics for patching o batchStart / batchFinish o Improve instrumentation performance o Reduce # of IPCs for 3 rd party instrumentation. 11 Introduction to the PatchAPI

Patch Manager (Cont.) o Filter-based point query o Scope o function, block, edge, or instruction o Point type o FuncEntry, BlockExit, BeforeCall, BeforeInsn … o Filter function o User-implemented o Fine grained control o e.g., Function calls with function name MPI_* o e.g., “push” instructions o…o… 12 Introduction to the PatchAPI

Example 13 // Find Points at Function Exits and Block Exits of // those having two outgoing edges class MyFilterFunc { bool operator() (PointPtr pt) { if (pt->type() == FuncExit) return true; PatchBlock* block = If (block->targets().size() == 2) return true; return false; } }; vector output; MyFilterFunc myfilter; PatchFunction* foo = patchMgr->findPoints (foo, BlockExit | FuncExit, myfilter, back_inserter(output)); Introduction to the PatchAPI Basic Block CFG of function foo BlockExit FuncExit BlockExit

Point, Snippet, and Instance o Snippet insertion o Instance iterator o Snippet removal 14 Introduction to the PatchAPI foo () { } Point Snippet Instance Instance push_back(Snippet); Instance push_front(Snippet); instance_iterator begin(); instance_iterator end(); bool remove(Instance);

Address Space Snippet CFG Parsing Instrumentation Engine Plugin Interface Public Interface PatchAPI Plugin Interface 15 Introduction to the PatchAPI Binary Patching Tools Internal PatchAPI In-line, out-of-line Online parsing, reuse stored CFG AST, DynC, user-defined code … 1 st party, 3 rd party, binary rewriter

Address Space o Memory management primitives o malloc / realloc / free o write / read o Example o 3 rd party instrumentation uses ptrace o 1 st party instrumentation uses libc 16 Introduction to the PatchAPI

Snippet 17 Introduction to the PatchAPI DynC if (x == 0) { inf ‘printf("x == 0\n"); } else if (x > 3) { inf ‘printf("x > 3\n"); } else { inf ‘printf("x < 3 but x != 0\n"); } AST Binary Code e ec ec eb 39 b e8 a8 f5 df ff … User-defined: Provided by us:

CFG Parsing 18 Introduction to the PatchAPI User Mutator PatchAPI Process On demand parsing Process Reuse Parse CFG info Stored CFG info User Mutator PatchAPI Reuse CFG info Offlne Parser Patching

Address Space Snippet CFG Parsing Instrumentation Engine Plugin Interface Public Interface Dyninst Reintegration 19 Introduction to the PatchAPI DyninstInternal PatchAPI Dyninst Address Space ParseAPI In-line AST Relocate a group of code, embed snippet Parse CFG during the runtime of instrumentation Will support DynC in the future 3 rd party, binary rewriter

Address Space Snippet CFG Parsing Instrumentation Engine Plugin Interface Public Interface Self-propelled instrumentation 20 Introduction to the PatchAPI Self- propelled Internal PatchAPI libc Stored CFG Hybrid Binary code Out-of-line + In-line Reuse stored CFG information A small set of instructions 1 st party instrumentation

Status 21 Introduction to the PatchAPI Conception Interface Design Dyninst Reintegration Code Refactoring Build Self- propelled instrumentation

Summary o PatchAPI from/back to Dyninst o Point and Snippet o Design of PatchAPI o Public Interface o Filter-based Point Query o Transactional Semantics o Plugin Interface o Customizing Instrumentation o To be released with Dyninst Introduction to the PatchAPI

23 Introduction to the PatchAPI Question?