Skip to content

Commit 350b071

Browse files
GJDuckGJDuck
committed
Clean-up full-coverage mode implementation
- Fix -O3 and -100 compatibility. - Make multiple -100 binaries work together - Add --help documentation - Add manpage documentation
1 parent aeb3b84 commit 350b071

7 files changed

Lines changed: 36 additions & 12 deletions

File tree

‎doc/e9patch.1‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,8 @@ The first phase tracks instruction patching success or failure:
2828
.IP
2929
\fB\[char46]\fR = Instruction was patched successfully
3030
.br
31+
\fBT\fR = Instruction was patched with tactic B0
32+
.br
3133
\fBX\fR = Instruction could not be patched
3234
.PP
3335
The second phase tracks physical memory compression:
@@ -159,6 +161,8 @@ automatically/randomly. The special value "none" leaves the
159161
original base intact.
160162
.br
161163
Default: \fBnone\fR (disabled)
164+
.IP "\fB\-\-tactic\-B0\fR[=\fI\,false\/\fR]" 4
165+
.PD 0
162166
.IP "\fB\-\-tactic\-B1\fR[=\fI\,false\/\fR]" 4
163167
.PD 0
164168
.IP "\fB\-\-tactic\-B2\fR[=\fI\,false\/\fR]" 4
@@ -169,12 +173,14 @@ Default: \fBnone\fR (disabled)
169173
.PD 0
170174
.IP "\fB\-\-tactic\-T3\fR[=\fI\,false\/\fR]" 4
171175
.PD
172-
Enables [disables] the corresponding tactic (B1/B2/T1/T2/T3).
176+
Enables [disables] corresponding tactic (B1/B2/T1/T2/T3).
173177
.br
174-
Default: \fBtrue\fR (enabled)
175-
.IP
178+
Default: \fBtrue\fR (enabled) for B1/B2/T1/T2/T3
179+
\fBfalse\fR (disabled) for B0
180+
.TP
176181
\fB\-\-tactic\-backward\-T3\fR[=\fI\,false\/\fR]
177-
Enable [disables] backward jumps for tactic T3.
182+
Enables [disables] backward jumps for tactic T3.
183+
.br
178184
Default: \fBtrue\fR (enabled)
179185
.TP
180186
\fB\-\-trap\fR=\fI\,ADDR\/\fR
@@ -185,11 +191,13 @@ the trampoline using GDB.
185191
\fB\-\-trap\-all\fR[=\fI\,false\/\fR]
186192
Enable [disable] the insertion of a trap (int3) instruction at
187193
all trampoline entries.
194+
.br
188195
Default: \fBfalse\fR (disabled)
189196
.TP
190197
\fB\-\-trap\-entry\fR[=\fI\,false\/\fR]
191198
Enable [disable] the insertion of a trap (int3) at the program
192199
loader entry\-point.
200+
.br
193201
Default: \fBfalse\fR (disabled)
194202
.TP
195203
\fB\-\-version\fR

‎doc/e9tool.1‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,11 @@ For more information, please refer to the following document:
102102
.IP "" 4
103103
\fI/usr/share/doc/e9tool/e9tool-user-guide.html\fR
104104
.SH OPTIONS
105+
.IP "\fB\-100\fR" 4
106+
Enables "full coverage" mode that attempts to patch 100% of matching
107+
instructions, even at the cost of a significant reduction in performance.
108+
This is useful for applications that prioritize coverage over other
109+
considerations.
105110
.IP "\fB\-\-backend\fR PROG" 4
106111
Use PROG as the backend.
107112
The default is "e9patch".

‎src/e9patch/e9elf.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -522,7 +522,7 @@ size_t emitElf(Binary *B, const MappingSet &mappings, size_t mapping_size)
522522
for (auto i = B->Traps.rbegin(); i != B->Traps.rend(); ++i)
523523
{
524524
const Alloc *A = *i;
525-
struct e9_trap_s trap = {A->I->addr, A->lb};
525+
struct e9_trap_s trap = {A->I->addr, A->lb + A->entry};
526526
memcpy(data + size, &trap, sizeof(trap));
527527
size += sizeof(trap);
528528
config->num_traps++;

‎src/e9patch/e9loader_elf.cpp‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,7 @@ struct ksigaction
4848
sigset_t sa_mask;
4949
};
5050
#define SA_RESTORER 0x04000000
51+
#define E9_BACKDOOR 0xe9e9e9e9
5152

5253
typedef void (*e9handler_t)(int, siginfo_t *, void *);
5354
struct e9scratch_s
@@ -163,7 +164,7 @@ static NO_INLINE struct e9scratch_s *e9scratch(const e9_config_s *config,
163164
if (!alloc)
164165
return (struct e9scratch_s *)scratch;
165166
intptr_t r = e9mmap(scratch, PAGE_SIZE, PROT_READ | PROT_WRITE,
166-
MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
167+
MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED, -1, 0);
167168
r = (r >= 0 && r != (intptr_t)scratch? -EAGAIN: r);
168169
if (r < 0)
169170
e9panic("mmap() scratch failed (errno=%u)", (unsigned)-r);
@@ -250,7 +251,7 @@ void e9handler(int sig, siginfo_t *info, ucontext_t *ctx,
250251
{
251252
(void *)SIG_DFL, SA_NODEFER | SA_RESTORER, NULL, 0
252253
};
253-
e9syscall(SYS_rt_sigaction, SIGILL, &action, NULL, 8, 0xe9e9e9e9);
254+
e9syscall(SYS_rt_sigaction, SIGILL, &action, NULL, 8, E9_BACKDOOR);
254255
trampoline = (uint8_t *)mctx->gregs[REG_RIP];
255256
}
256257
void *xstate = (void *)mctx->fpregs;
@@ -301,7 +302,7 @@ static void e9filter(struct e9scratch_s *scratch)
301302
BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
302303
offsetof(struct seccomp_data, args[4])),
303304
// Backdoor: TODO: think of a better solution
304-
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0xe9e9e9e9, 3, 0),
305+
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, E9_BACKDOOR, 3, 0),
305306
BPF_STMT(BPF_LD | BPF_W | BPF_ABS,
306307
offsetof(struct seccomp_data, args[0])),
307308
BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, SIGILL, 0, 1),
@@ -416,7 +417,8 @@ void *e9init(int argc, char **argv, char **envp, const e9_config_s *config)
416417
(void *)handler, SA_NODEFER | SA_SIGINFO | SA_RESTORER,
417418
NULL, 0x0
418419
};
419-
intptr_t r = e9syscall(SYS_rt_sigaction, SIGILL, &action, &old, 8);
420+
intptr_t r = e9syscall(SYS_rt_sigaction, SIGILL, &action, &old, 8,
421+
E9_BACKDOOR);
420422
if (r < 0)
421423
e9panic("sigaction() failed (errno=%u)", -r);
422424
scratch =

‎src/e9patch/e9patch.cpp‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -357,13 +357,15 @@ static void usage(FILE *stream, const char *progname)
357357
"\t\toriginal base intact.\n"
358358
"\t\tDefault: none (disabled)\n"
359359
"\n"
360+
"\t--tactic-B0[=false]\n"
360361
"\t--tactic-B1[=false]\n"
361362
"\t--tactic-B2[=false]\n"
362363
"\t--tactic-T1[=false]\n"
363364
"\t--tactic-T2[=false]\n"
364365
"\t--tactic-T3[=false]\n"
365-
"\t\tEnables [disables] the corresponding tactic (B1/B2/T1/T2/T3).\n"
366-
"\t\tDefault: true (enabled)\n"
366+
"\t\tEnables [disables] corresponding tactic (B0/B1/B2/T1/T2/T3).\n"
367+
"\t\tDefault: true (enabled) for B1/B2/T1/T2/T3\n"
368+
"\t\t false (disabled) for B0\n"
367369
"\n"
368370
"\t--tactic-backward-T3[=false]\n"
369371
"\t\tEnable [disables] backward jumps for tactic T3.\n"

‎src/e9patch/e9tactics.cpp‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -260,7 +260,8 @@ static Bounds makeBounds(Binary &B, const Trampoline *T, const Instr *I,
260260
switch (B.mode)
261261
{
262262
case MODE_ELF_EXE: case MODE_ELF_DSO:
263-
hi = std::min(hi, option_loader_base);
263+
// The additional page is for the loader scratch space
264+
hi = std::min(hi, option_loader_base - (intptr_t)PAGE_SIZE);
264265
default:
265266
break;
266267
}

‎src/e9tool/e9misc.cpp‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -223,6 +223,12 @@ void usage(FILE *stream, const char *progname)
223223
"OTHER OPTIONS\n"
224224
"=============\n"
225225
"\n"
226+
"\t-100\n"
227+
"\t\tEnables \"full coverage\" mode that attempts to patch 100%%\n"
228+
"\t\tof matching instructions, even at the cost of a (significant)\n"
229+
"\t\treduction in performance. This is useful for applications\n"
230+
"\t\tthat prioritize coverage over other considerations.\n"
231+
"\n"
226232
"\t--backend PROG\n"
227233
"\t\tUse PROG as the backend. The default is \"e9patch\".\n"
228234
"\n"

0 commit comments

Comments
 (0)