Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WIP Add Intel PT tracing support #2471

Draft
wants to merge 131 commits into
base: main
Choose a base branch
from

Conversation

Marcondiro
Copy link
Contributor

WIP, any feedback is welcome

@Marcondiro Marcondiro force-pushed the intel_pt branch 2 times, most recently from 615b87b to b4ae309 Compare August 2, 2024 16:28
@rmalmain rmalmain self-requested a review August 2, 2024 17:26
libafl_qemu/build_linux.rs Outdated Show resolved Hide resolved
@addisoncrump
Copy link
Collaborator

I'll rebase on this before making libafl_qemu changes in #2438.

@Marcondiro Marcondiro force-pushed the intel_pt branch 3 times, most recently from 138002d to 121d6ca Compare August 5, 2024 08:40
@domenukk
Copy link
Member

domenukk commented Aug 5, 2024

What's the benefit of the perf-event-open-sys crate thingy over bindgen? Just double checking / asking stupid questions :)

@Marcondiro
Copy link
Contributor Author

Marcondiro commented Aug 5, 2024 via email

@domenukk
Copy link
Member

domenukk commented Aug 5, 2024

Nah sounds good, it's just always good to double-check if new crates are necessary. If it solves issues let's gooo

Copy link
Collaborator

@rmalmain rmalmain left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i propose to start building the Module that would go on top of it once the inte_pt low-level functions look good enough to you.
even if some hooks are missing atm, it may be useful to start building the skeleton to help familiarize with the module system.

libafl_derive/src/lib.rs Outdated Show resolved Hide resolved
libafl_qemu/src/qemu/systemmode/intel_pt.rs Outdated Show resolved Hide resolved
libafl_qemu/src/qemu/systemmode/intel_pt.rs Outdated Show resolved Hide resolved
}

#[inline]
const fn next_page_aligned_addr(address: usize) -> usize {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we should avoid writing this kind of function here i think, we already have libafl_page_from_addr in the qemu repo in C. we should maybe start gathering these utils functions at the same place either in a c (so that it's usable in QEMU as well) or a rs file.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you're linking them together, anyway, right? So you can write it in rust and still use them from C

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you guys know if we lose inlining this way?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

from rust to rust? No. From C to rust, probably not? maybe?

@Marcondiro Marcondiro force-pushed the intel_pt branch 4 times, most recently from e65ba68 to 0a8d8ba Compare August 13, 2024 07:21
@Marcondiro Marcondiro force-pushed the intel_pt branch 7 times, most recently from 30489e9 to 354ad86 Compare August 20, 2024 16:15
@Marcondiro Marcondiro force-pushed the intel_pt branch 2 times, most recently from a2990ad to 8d72014 Compare August 22, 2024 10:27
libafl_qemu/Cargo.toml Outdated Show resolved Hide resolved
libafl_qemu/Cargo.toml Outdated Show resolved Hide resolved
@Marcondiro
Copy link
Contributor Author

Hello @rmalmain @domenukk, if you wish you could start to have a look at the new code in libafl_bolts (interface to intelPT usable in both libafl and libafl_qemu) and at the IntelPT executor hook.
Also the babyfuzzer should be kinda ready.

I'm still working on cleaning the commandExecutor (and the fuzzer built on top of it), it might be removed from this PR depending on the 0.14 cutoff date
thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants