Hacker News Reader

Comment by abainbridge | Hacker News Reader

> Cosmopolitan Libc allows you to log every function call over the program’s execution – just pass --ftrace at the end of your program, like this:

> ./hex16.com ./missing.txt --ftrace

That seems like magic. It seems you have to build with a special flag that tells GCC to put a nop at the start of each function. Then, before main runs, Cosmopolitan sees the --ftrace on the command line, and modifies the code in memory to replace those nops with calls to something that does the logging. See https://justine.lol/ftrace/.

View on HN

> It seems you have to build with a special flag that tells GCC to put a nop at the start of each function.

BTW - llvm+clang support a similar feature called "X-ray" [1]. It's intended to allow for patching (and unpatching!) these entry/exit points at runtime, with calls to specific tracing / black box facilities or whatever your favorite logging mechanism might be. And it's not limited to x86_64.

[1] https://llvm.org/docs/XRay.html

I am not sure how it's done with cosmopolitan libc, but on MSVC++, when compiled with a hotpatching, every function had a `mov edi, edi` instruction at the start, so that there were a few useless bytes that could be safely removed. Avoid the need for a trampoline.

You don't in principle have to put any nop's at the start of each function for this kind of function "hooking" to work. The Microsoft Detours library does the same thing with no special compilation needed.

From https://www.microsoft.com/en-us/research/project/detours/

"Detours is a library for instrumenting arbitrary Win32 functions Windows-compatible processors. Detours intercepts Win32 functions by re-writing the in-memory code for target functions."

Doesn't that just re-write the DLL import table? ie it only allows interception of a Win32 API calls, not interception of my function A calling my function B?

No, it inserts a jump instruction at the start of the function, and just overrides whatever is there already. To allow you to call the "original" function, it does some analysis to figure out what it's stomping on, and creates another little bootstrap function that executes that one destroyed instruction, then jumps to the second instruction of the original function.

Basically: black magic

Oh yeah, sophisticated: https://github.com/microsoft/Detours/wiki/OverviewIntercepti...

Isn't this why Windows have MOV EDI, EDI at the start of a function? https://devblogs.microsoft.com/oldnewthing/20110921-00/?p=95...

No. It sounds like Detours works even when the function hasn't got MOV EDI, EDI at the start.

So much innovation in a tiny libc.

Reply on news.ycombinator.com