mirror of
https://github.com/DynamoRIO/dynamorio.git
synced 2026-10-12 02:02:04 +00:00
i#2971 rm CI: Cleanup: Remove VPS and VMSAFE modes (#4788)
Removes the old top-level modes VPS and VMSAFE, making VMAP (aka regular code mode client interface) the default and removing references to it as well. Removes conditional docs for the other modes spread throughout our documentation. Removes test suite builds for these modes, including the vps build from our GA CI suite. Updates various references. This breaks the CI due to removed code containing tabs (in comments in CMake_doxyfile.cmake) and trailing spaces (a .fig file). In the PR I temporarily disabled those checks and confirmed all tests were green. Issue: #2971
This commit is contained in:
Derek Bruening
@@ -1,5 +1,5 @@
|
||||
# **********************************************************
|
||||
# Copyright (c) 2020 Google, Inc. All rights reserved.
|
||||
# Copyright (c) 2020-2021 Google, Inc. All rights reserved.
|
||||
# **********************************************************
|
||||
|
||||
# Redistribution and use in source and binary forms, with or without
|
||||
@@ -179,7 +179,7 @@ jobs:
|
||||
from: Github Action CI
|
||||
|
||||
###########################################################################
|
||||
# 32-bit and 64-bit VS2017 release builds plus a vps build:
|
||||
# 32-bit and 64-bit VS2017 release builds:
|
||||
vs2017-builds:
|
||||
runs-on: windows-2016
|
||||
|
||||
|
||||
+14
-35
@@ -307,31 +307,18 @@ endif ()
|
||||
|
||||
option(VMKERNEL "target VMkernel (not officially supported yet)")
|
||||
|
||||
# high-level configurations
|
||||
option(VMAP "client support" ON)
|
||||
option(VPS "security support but no client support")
|
||||
option(VMSAFE "client support including security API")
|
||||
if (VMAP)
|
||||
set(CLIENT_INTERFACE 1)
|
||||
set(APP_EXPORTS 1)
|
||||
endif (VMAP)
|
||||
if (VMSAFE)
|
||||
set(PROGRAM_SHEPHERDING 1)
|
||||
set(CLIENT_INTERFACE 1)
|
||||
set(APP_EXPORTS 1)
|
||||
set(HOT_PATCHING_INTERFACE 1)
|
||||
endif (VMSAFE)
|
||||
if (VPS)
|
||||
set(PROGRAM_SHEPHERDING 1)
|
||||
set(HOT_PATCHING_INTERFACE 1)
|
||||
set(PROCESS_CONTROL 1)
|
||||
if (WIN32)
|
||||
set(GBOP 1)
|
||||
endif (WIN32)
|
||||
endif (VPS)
|
||||
# We no longer support building without a client interface: it is always enabled.
|
||||
# TODO i#2971: Remove the CLIENT_INTERFACE option and define.
|
||||
set(CLIENT_INTERFACE 1)
|
||||
set(APP_EXPORTS 1)
|
||||
|
||||
# temporary: once build+support issues fixed, remove and add HOT_PATCHING_INTERFACE
|
||||
# to VMAP by default
|
||||
# TODO: Consider removing these no-longer-maintained options:
|
||||
# - VMKERNEL
|
||||
# - PROGRAM_SHEPHERDING
|
||||
# - PROCESS_CONTROL
|
||||
# - GBOP
|
||||
|
||||
# TODO: Revive HOT_PATCHING_INTERFACE and combine with PROBE.
|
||||
option(PROBE "enable not-yet-supported Probe API")
|
||||
mark_as_advanced(PROBE)
|
||||
if (PROBE)
|
||||
@@ -420,10 +407,10 @@ endif (VMKERNEL)
|
||||
|
||||
# we do not support most users choosing these
|
||||
mark_as_advanced(
|
||||
PROGRAM_SHEPHERDING
|
||||
PROCESS_CONTROL
|
||||
GBOP
|
||||
VMKERNEL
|
||||
VMAP
|
||||
VMSAFE
|
||||
VPS
|
||||
KSTATS
|
||||
CALLPROF
|
||||
PROFILE
|
||||
@@ -1533,14 +1520,6 @@ else ()
|
||||
option(BUILD_DOCS "build documentation" ON)
|
||||
endif ()
|
||||
|
||||
if (VMSAFE)
|
||||
# I did not preserve VMSAFE docs building: to reactivate it, need to
|
||||
# add the missing transformations mentioned in api/docs/CMakeLists.txt
|
||||
# and fix genapi.pl on lib/dr_config.h to handle the outer ifdef WINDOWS
|
||||
# (ends up keeping 1st endif in 1st enum).
|
||||
set(BUILD_DOCS OFF)
|
||||
endif (VMSAFE)
|
||||
|
||||
if (NOT CLIENT_INTERFACE)
|
||||
set(BUILD_SAMPLES OFF)
|
||||
set(BUILD_EXT OFF)
|
||||
|
||||
+1
-1
@@ -86,7 +86,7 @@ GENERATE_TODOLIST = YES
|
||||
GENERATE_TESTLIST = YES
|
||||
GENERATE_BUGLIST = YES
|
||||
GENERATE_DEPRECATEDLIST= YES
|
||||
# choices: linux, VMsafe
|
||||
# We support \if linux but we discourage it.
|
||||
ENABLED_SECTIONS =
|
||||
MAX_INITIALIZER_LINES = 30
|
||||
SHOW_USED_FILES = YES
|
||||
|
||||
@@ -157,20 +157,6 @@ if (embeddable)
|
||||
string(REGEX REPLACE "(SEARCHENGINE[ \t]*= )YES" "\\1 NO" string "${string}")
|
||||
endif ()
|
||||
|
||||
# We no longer support VMSAFE.
|
||||
# Here's what we used to do:
|
||||
# ifdef VMSAFE
|
||||
# $(SED) -i 's/\(PROJECT_NAME[ \t]*=\).*/\1 "VMsafe In-Process API"/' $@
|
||||
# $(SED) -i 's/\(ENABLED_SECTIONS[ \t]*=\)/\1 vmsafe/' $@
|
||||
# $(SED) -i 's/DynamoRIO=DynamoRIO/DynamoRIO=${VMSAFE_NAME}/' $@
|
||||
# $(SED) -i 's/client=client/client=${VMSAFE_CLIENT}/' $@
|
||||
# $(SED) -i 's/clients=clients/clients=${VMSAFE_CLIENT}s/' $@
|
||||
# $(SED) -i 's/Client=Client/Client=${VMSAFE_CLIENT}/' $@
|
||||
# $(SED) -i 's/Clients=Clients/Clients=${VMSAFE_CLIENT}s/' $@
|
||||
# else
|
||||
# $(SED) -i 's/\(ENABLED_SECTIONS[ \t]*=\)/\1 linux/' $@
|
||||
# endif
|
||||
|
||||
file(WRITE ${outfile} "${string}")
|
||||
|
||||
# Now update to latest doxygen. Suppress warnings since they're misleading:
|
||||
|
||||
+12
-25
@@ -42,28 +42,18 @@ executes. Modifications are not limited to trampoline insertion and can
|
||||
include arbitrary changes. We divide the API description into the
|
||||
following sections:
|
||||
|
||||
\ifnot vmsafe
|
||||
- \ref sec_IR
|
||||
- \ref sec_events_bt
|
||||
- \ref sec_decode
|
||||
- \ref sec_isa
|
||||
- \ref sec_IR_utils
|
||||
- \ref sec_reg_stolen
|
||||
- \ref sec_translation
|
||||
- \ref sec_predication
|
||||
- \ref sec_ldrex
|
||||
- \ref sec_rseq
|
||||
- \ref sec_pcache
|
||||
- \ref bt_examples
|
||||
\else
|
||||
- \ref sec_IR
|
||||
- \ref sec_events_bt
|
||||
- \ref sec_decode
|
||||
- \ref sec_isa
|
||||
- \ref sec_IR_utils
|
||||
- \ref sec_translation
|
||||
- \ref bt_examples
|
||||
\endif
|
||||
- \ref sec_IR
|
||||
- \ref sec_events_bt
|
||||
- \ref sec_decode
|
||||
- \ref sec_isa
|
||||
- \ref sec_IR_utils
|
||||
- \ref sec_reg_stolen
|
||||
- \ref sec_translation
|
||||
- \ref sec_predication
|
||||
- \ref sec_ldrex
|
||||
- \ref sec_rseq
|
||||
- \ref sec_pcache
|
||||
- \ref bt_examples
|
||||
|
||||
***************************************************************************
|
||||
\htmlonly
|
||||
@@ -1360,7 +1350,6 @@ op_disable_rseq "disable_rseq" runtime option may be used to return ENOSYS,
|
||||
which can provide a workaround for applications which have fallback code
|
||||
for kernels where rseq is not supported.
|
||||
|
||||
\ifnot vmsafe
|
||||
***************************************************************************
|
||||
\htmlonly
|
||||
<table width=100% bgcolor="#000000" cellspacing=0 cellpadding=2 border=0>
|
||||
@@ -1431,8 +1420,6 @@ TLS check ensures that TLS scratch slots are identical. DynamoRIO also
|
||||
ensures that any runtime options that affect persistent code (such as
|
||||
whether traces are enabled) are identical.
|
||||
|
||||
\endif
|
||||
|
||||
***************************************************************************
|
||||
****************************************************************************
|
||||
****************************************************************************
|
||||
|
||||
+2
-64
@@ -155,43 +155,6 @@ to compile the client with optimizations, \p -O2 for gcc or \p /O2 for cl.
|
||||
|
||||
***************************************************************************
|
||||
\page page_deploy How to Run
|
||||
\if vmsafe
|
||||
A DynamoRIO application consists of a guest agent and one or more clients. Each of
|
||||
these must be linked against the necessary DynamoRIO dynamic libraries, which
|
||||
are provided as part of the SDK. These DynamoRIO dynamic libraries must be
|
||||
installed when the DynamoRIO application is installed on a guest OS.
|
||||
|
||||
Any DynamoRIO application wanting to get control of a process must
|
||||
first register a client (which is a self-contained executable
|
||||
library) for that process. Otherwise DynamoRIO will not be
|
||||
initialized for that process. This is done by the guest agent, which
|
||||
can either be a service or a standalone executable. The guest agent
|
||||
should use dr_register_process() and dr_register_client() to register
|
||||
a process name for which control is desired, which clients to use for
|
||||
each process, and which mode to run the clients in (more on this
|
||||
below). DynamoRIO will be initialized in the specified mode for
|
||||
registered processes started subsequently. DynamoRIO will then load
|
||||
the corresponding clients into such processes and call each client's
|
||||
initialization routine, dr_client_main(). There are three modes of operation
|
||||
for DynamoRIO which map to the three API's provided by DynamoRIO
|
||||
(see below). Depending upon the mode chosen the usage model will
|
||||
change.
|
||||
|
||||
In addition to registering the processes for which control is desired, the
|
||||
guest agent can also unregister them as needed using dr_unregister_process().
|
||||
The guest agent can also send update messages to processes currently
|
||||
initialized with DynamoRIO and a client using dr_nudge_process().
|
||||
For example, this can be used by the guest agent when it has obtained new
|
||||
information (data, libraries, etc.), from a management server or over the
|
||||
internet from a security vendor, to let clients know about them.
|
||||
|
||||
Process registration, unregistration, and nudging require administrative
|
||||
privileges. On Windows Vista or higher, if UAC is enabled, process registration must be
|
||||
performed by an elevated (runas admin) process. When using the -syswide_on
|
||||
parameter, be sure that the cmd shell being used was started with elevated
|
||||
permissions.
|
||||
|
||||
\else
|
||||
|
||||
Once the DynamoRIO distribution contents are unpacked (see \ref
|
||||
sec_package), configuration and execution of applications under DynamoRIO
|
||||
@@ -203,11 +166,9 @@ drconfiglib.dll and \c drinjectlib.dll with header files \c dr_config.h and
|
||||
drinject, and the libraries are \c libdrconfiglib.a and \c
|
||||
libdrinjectlib.a.
|
||||
|
||||
\ifnot vmsafe
|
||||
When using DynamoRIO as a third-party disassembly library (see \ref
|
||||
page_standalone), no deployment is needed, as DynamoRIO does not control a
|
||||
target application when used as a regular library.
|
||||
\endif
|
||||
|
||||
\section win_deploy Windows Deployment
|
||||
|
||||
@@ -249,28 +210,16 @@ only.
|
||||
As an example, assume you have unpacked the DynamoRIO distribution and
|
||||
your current directory is its base directory. Run \c notepad.exe with the
|
||||
bbsize sample client using the following configure-and-run command:
|
||||
\if vmsafe
|
||||
\code
|
||||
bin32/drrun.exe -mode code -c samples/bin32/bbsize.dll -- notepad
|
||||
\endcode
|
||||
\else
|
||||
\code
|
||||
bin32/drrun.exe -c samples/bin32/bbsize.dll -- notepad
|
||||
\endcode
|
||||
\endif
|
||||
|
||||
To use system-wide injection, allowing for an application to be run
|
||||
under DynamoRIO regardless of how it is invoked, configure the application
|
||||
first (-syswide_on requires administrative privileges):
|
||||
\if vmsafe
|
||||
\code
|
||||
bin32/drconfig.exe -reg notepad.exe -syswide_on -mode code -c samples/bin32/bbsize.dll
|
||||
\endcode
|
||||
\else
|
||||
\code
|
||||
bin32/drconfig.exe -reg notepad.exe -syswide_on -c samples/bin32/bbsize.dll
|
||||
\endcode
|
||||
\endif
|
||||
|
||||
The next time \c notepad.exe is started by the current user, it will run under
|
||||
DynamoRIO with the bbsize client.
|
||||
@@ -463,8 +412,6 @@ disable SELinux via <tt>setenforce 0</tt>. We have attempted to get
|
||||
everything to work without this step, but we are not able to test on all
|
||||
versions or configurations of Android.
|
||||
|
||||
\endif
|
||||
|
||||
\section client_ops Passing Options to Clients
|
||||
|
||||
All of the earlier examples did not need to pass any arguments to the client.
|
||||
@@ -743,8 +690,7 @@ are specified via \c drconfig, \c drrun, or dr_register_process(). See
|
||||
however, larger stack sizes use significantly more memory when targeting
|
||||
applications with hundreds of threads. The parameter can take a 'K'
|
||||
suffix, and must be a multiple of the page size (4K, 16K, or 64K depending on
|
||||
the system). This stack is used \if vmsafe for probe callbacks and by
|
||||
the Code Manipulation API \else by the \endif routines dr_insert_clean_call(),
|
||||
the system). This stack is used by the routines dr_insert_clean_call(),
|
||||
dr_swap_to_clean_stack(), dr_prepare_for_call(),
|
||||
dr_insert_call_instrumentation(), dr_insert_mbr_instrumentation(),
|
||||
dr_insert_cbr_instrumentation(), and dr_insert_ubr_instrumentation().
|
||||
@@ -759,10 +705,6 @@ are specified via \c drconfig, \c drrun, or dr_register_process(). See
|
||||
be used to change the size. The parameter can take a 'K' suffix, and
|
||||
must be a multiple of the page size (4K, 16K, or 64K depending on the
|
||||
system).
|
||||
\if vmsafe
|
||||
Options available only in Code Manipulation mode and Memory Firewall mode
|
||||
(see \ref dr_modes):
|
||||
\endif
|
||||
- \b -thread_private: \anchor op_thread_priv
|
||||
By default, DynamoRIO's code caches are shared across threads. This
|
||||
option requests code caches that are private to each thread. For
|
||||
@@ -909,7 +851,6 @@ they want to shrink memory usage
|
||||
-syntax_att, and -syntax_arm. The style can also be set using
|
||||
disassemble_set_syntax().
|
||||
|
||||
\ifnot vmsafe
|
||||
- \b -tracedump_text and \b -tracedump_binary:
|
||||
These options cause DynamoRIO to output all traces that were created
|
||||
to the log file \e traces-shared.0.TID.html, where \e
|
||||
@@ -930,7 +871,6 @@ they want to shrink memory usage
|
||||
tags of each trace to the trace log file. When combined with either of
|
||||
-tracedump_text or -tracedump_binary, adds a full disassembly of the
|
||||
constituent basic blocks to the selected dump.
|
||||
\endif
|
||||
|
||||
\if profiling
|
||||
FIXME PR 225255: profiling options
|
||||
@@ -946,7 +886,7 @@ Options controlling notifications from DynamoRIO:
|
||||
- WARNING = 0x2
|
||||
- ERROR = 0x4
|
||||
- CRITICAL = 0x8
|
||||
.
|
||||
|
||||
dr_messagebox() is not affected by -msgbox_mask. For the
|
||||
provided Windows debug build -msgbox_mask defaults to 0xC.
|
||||
On Linux the default is 0, as this feature reads from standard input and
|
||||
@@ -979,7 +919,6 @@ Options controlling notifications from DynamoRIO:
|
||||
debug builds, -stderr_mask defaults to 0xF; for the Linux release
|
||||
builds, its default is 0xE. The default on Windows is 0.
|
||||
|
||||
\ifnot vmsafe
|
||||
Options aiding in debugging:
|
||||
|
||||
- \b -no_hide: \anchor op_no_hide
|
||||
@@ -991,7 +930,6 @@ Options aiding in debugging:
|
||||
DynamoRIO, the client library, and all of its dependences, so this
|
||||
option should no longer be necessary (see \ref page_debugging).
|
||||
This option is for Windows only.
|
||||
\endif
|
||||
|
||||
Options available only in the debug build of DynamoRIO:
|
||||
|
||||
|
||||
@@ -1,493 +0,0 @@
|
||||
%!PS-Adobe-3.0 EPSF-3.0
|
||||
%%Title: /home/bruening/dr/git/src/api/docs/viper.fig
|
||||
%%Creator: fig2dev Version 3.2.7b
|
||||
%%CreationDate: 2020-01-27 17:31:58
|
||||
%%BoundingBox: 0 0 435 273
|
||||
%%Magnification: 1.0000
|
||||
%%EndComments
|
||||
%%BeginProlog
|
||||
/MyAppDict 100 dict dup begin def
|
||||
/$F2psDict 200 dict def
|
||||
$F2psDict begin
|
||||
$F2psDict /mtrx matrix put
|
||||
/col-1 {0 setgray} bind def
|
||||
/col0 {0.000 0.000 0.000 srgb} bind def
|
||||
/col7 {1.000 1.000 1.000 srgb} bind def
|
||||
/col8 {0.000 0.000 0.560 srgb} bind def
|
||||
/col32 {0.969 0.796 0.400 srgb} bind def
|
||||
/col33 {0.600 0.369 0.235 srgb} bind def
|
||||
/col34 {0.435 0.188 0.059 srgb} bind def
|
||||
/col35 {0.588 0.588 0.588 srgb} bind def
|
||||
/col36 {0.800 0.800 0.694 srgb} bind def
|
||||
/col37 {0.200 0.400 1.000 srgb} bind def
|
||||
|
||||
end
|
||||
|
||||
% vertical sawtooth lines
|
||||
<<
|
||||
/PatternType 1
|
||||
/PaintType 2
|
||||
/TilingType 1
|
||||
/BBox [0 0 24 24]
|
||||
/XStep 24
|
||||
/YStep 24
|
||||
/PaintProc
|
||||
{
|
||||
pop
|
||||
.8 slw 0 slj n
|
||||
5 -1 m 2 2 l 3 {4 4 rl -4 4 rl} repeat
|
||||
13 -1 m 10 2 l 3 {4 4 rl -4 4 rl} repeat
|
||||
21 -1 m 18 2 l 3 {4 4 rl -4 4 rl} repeat
|
||||
s
|
||||
} bind
|
||||
>>
|
||||
matrix
|
||||
makepattern
|
||||
/P22 exch def
|
||||
|
||||
/cp {closepath} bind def
|
||||
/ef {eofill} bind def
|
||||
/gr {grestore} bind def
|
||||
/gs {gsave} bind def
|
||||
/sa {save} bind def
|
||||
/rs {restore} bind def
|
||||
/l {lineto} bind def
|
||||
/rl {rlineto} bind def
|
||||
/m {moveto} bind def
|
||||
/rm {rmoveto} bind def
|
||||
/n {newpath} bind def
|
||||
/s {stroke} bind def
|
||||
/sh {show} bind def
|
||||
/slc {setlinecap} bind def
|
||||
/slj {setlinejoin} bind def
|
||||
/slw {setlinewidth} bind def
|
||||
/srgb {setrgbcolor} bind def
|
||||
/rot {rotate} bind def
|
||||
/sc {scale} bind def
|
||||
/sd {setdash} bind def
|
||||
/ff {findfont} bind def
|
||||
/sf {setfont} bind def
|
||||
/scf {scalefont} bind def
|
||||
/sw {stringwidth} bind def
|
||||
/tr {translate} bind def
|
||||
/tnt {dup dup currentrgbcolor
|
||||
4 -2 roll dup 1 exch sub 3 -1 roll mul add
|
||||
4 -2 roll dup 1 exch sub 3 -1 roll mul add
|
||||
4 -2 roll dup 1 exch sub 3 -1 roll mul add srgb}
|
||||
bind def
|
||||
/shd {dup dup currentrgbcolor 4 -2 roll mul 4 -2 roll mul
|
||||
4 -2 roll mul srgb} bind def
|
||||
/reencdict 12 dict def /ReEncode { reencdict begin
|
||||
/newcodesandnames exch def /newfontname exch def /basefontname exch def
|
||||
/basefontdict basefontname findfont def /newfont basefontdict maxlength dict def
|
||||
basefontdict { exch dup /FID ne { dup /Encoding eq
|
||||
{ exch dup length array copy newfont 3 1 roll put }
|
||||
{ exch newfont 3 1 roll put } ifelse } { pop pop } ifelse } forall
|
||||
newfont /FontName newfontname put newcodesandnames aload pop
|
||||
128 1 255 { newfont /Encoding get exch /.notdef put } for
|
||||
newcodesandnames length 2 idiv { newfont /Encoding get 3 1 roll put } repeat
|
||||
newfontname newfont definefont pop end } def
|
||||
/isovec [
|
||||
8#055 /minus 8#200 /grave 8#201 /acute 8#202 /circumflex 8#203 /tilde
|
||||
8#204 /macron 8#205 /breve 8#206 /dotaccent 8#207 /dieresis
|
||||
8#210 /ring 8#211 /cedilla 8#212 /hungarumlaut 8#213 /ogonek 8#214 /caron
|
||||
8#220 /dotlessi 8#230 /oe 8#231 /OE
|
||||
8#240 /space 8#241 /exclamdown 8#242 /cent 8#243 /sterling
|
||||
8#244 /currency 8#245 /yen 8#246 /brokenbar 8#247 /section 8#250 /dieresis
|
||||
8#251 /copyright 8#252 /ordfeminine 8#253 /guillemotleft 8#254 /logicalnot
|
||||
8#255 /hyphen 8#256 /registered 8#257 /macron 8#260 /degree 8#261 /plusminus
|
||||
8#262 /twosuperior 8#263 /threesuperior 8#264 /acute 8#265 /mu 8#266 /paragraph
|
||||
8#267 /periodcentered 8#270 /cedilla 8#271 /onesuperior 8#272 /ordmasculine
|
||||
8#273 /guillemotright 8#274 /onequarter 8#275 /onehalf
|
||||
8#276 /threequarters 8#277 /questiondown 8#300 /Agrave 8#301 /Aacute
|
||||
8#302 /Acircumflex 8#303 /Atilde 8#304 /Adieresis 8#305 /Aring
|
||||
8#306 /AE 8#307 /Ccedilla 8#310 /Egrave 8#311 /Eacute
|
||||
8#312 /Ecircumflex 8#313 /Edieresis 8#314 /Igrave 8#315 /Iacute
|
||||
8#316 /Icircumflex 8#317 /Idieresis 8#320 /Eth 8#321 /Ntilde 8#322 /Ograve
|
||||
8#323 /Oacute 8#324 /Ocircumflex 8#325 /Otilde 8#326 /Odieresis 8#327 /multiply
|
||||
8#330 /Oslash 8#331 /Ugrave 8#332 /Uacute 8#333 /Ucircumflex
|
||||
8#334 /Udieresis 8#335 /Yacute 8#336 /Thorn 8#337 /germandbls 8#340 /agrave
|
||||
8#341 /aacute 8#342 /acircumflex 8#343 /atilde 8#344 /adieresis 8#345 /aring
|
||||
8#346 /ae 8#347 /ccedilla 8#350 /egrave 8#351 /eacute
|
||||
8#352 /ecircumflex 8#353 /edieresis 8#354 /igrave 8#355 /iacute
|
||||
8#356 /icircumflex 8#357 /idieresis 8#360 /eth 8#361 /ntilde 8#362 /ograve
|
||||
8#363 /oacute 8#364 /ocircumflex 8#365 /otilde 8#366 /odieresis 8#367 /divide
|
||||
8#370 /oslash 8#371 /ugrave 8#372 /uacute 8#373 /ucircumflex
|
||||
8#374 /udieresis 8#375 /yacute 8#376 /thorn 8#377 /ydieresis] def
|
||||
/Helvetica-Bold /Helvetica-Bold-iso isovec ReEncode
|
||||
/$F2psBegin {$F2psDict begin /$F2psEnteredState save def} def
|
||||
/$F2psEnd {$F2psEnteredState restore end} def
|
||||
|
||||
/pageheader {
|
||||
sa
|
||||
n 0 273 m 0 0 l 435 0 l 435 273 l cp clip
|
||||
-71.3 306.7 tr
|
||||
1 -1 sc
|
||||
$F2psBegin
|
||||
10 setmiterlimit
|
||||
0 slj 0 slc
|
||||
0.06000 0.06000 sc
|
||||
} bind def
|
||||
/pagefooter {
|
||||
$F2psEnd
|
||||
restore
|
||||
} bind def
|
||||
%%EndProlog
|
||||
pageheader
|
||||
%
|
||||
% Fig objects follow
|
||||
%
|
||||
%
|
||||
% here starts figure with depth 52
|
||||
% Polyline
|
||||
0 slj
|
||||
0 slc
|
||||
15.000 slw
|
||||
[135] 0 sd
|
||||
n 4155 600 m 4050 600 4050 2595 105 arcto 4 {pop} repeat
|
||||
4050 2700 8295 2700 105 arcto 4 {pop} repeat
|
||||
8400 2700 8400 705 105 arcto 4 {pop} repeat
|
||||
8400 600 4155 600 105 arcto 4 {pop} repeat
|
||||
cp gs col7 1.00 shd ef gr gs col0 s gr [] 0 sd
|
||||
% Polyline
|
||||
7.500 slw
|
||||
n 5805 750 m 5700 750 5700 2445 105 arcto 4 {pop} repeat
|
||||
5700 2550 6795 2550 105 arcto 4 {pop} repeat
|
||||
6900 2550 6900 855 105 arcto 4 {pop} repeat
|
||||
6900 750 5805 750 105 arcto 4 {pop} repeat
|
||||
cp
|
||||
% Fill with pattern background color
|
||||
gs /DeviceRGB setcolorspace 0.80 0.80 0.69 setcolor fill gr
|
||||
|
||||
% Fill with pattern pen color
|
||||
gs /DeviceRGB setcolorspace 0.80 0.80 0.69 P22 setpattern fill gr
|
||||
|
||||
gs col36 s gr % Polyline
|
||||
n 7155 750 m 7050 750 7050 2445 105 arcto 4 {pop} repeat
|
||||
7050 2550 8145 2550 105 arcto 4 {pop} repeat
|
||||
8250 2550 8250 855 105 arcto 4 {pop} repeat
|
||||
8250 750 7155 750 105 arcto 4 {pop} repeat
|
||||
cp
|
||||
% Fill with pattern background color
|
||||
gs /DeviceRGB setcolorspace 0.80 0.80 0.69 setcolor fill gr
|
||||
|
||||
% Fill with pattern pen color
|
||||
gs /DeviceRGB setcolorspace 0.80 0.80 0.69 P22 setpattern fill gr
|
||||
|
||||
gs col36 s gr % Polyline
|
||||
n 4155 2700 m 4050 2700 4050 3195 105 arcto 4 {pop} repeat
|
||||
4050 3300 8295 3300 105 arcto 4 {pop} repeat
|
||||
8400 3300 8400 2805 105 arcto 4 {pop} repeat
|
||||
8400 2700 4155 2700 105 arcto 4 {pop} repeat
|
||||
cp
|
||||
% Fill with pattern background color
|
||||
gs /DeviceRGB setcolorspace 0.44 0.19 0.06 setcolor fill gr
|
||||
|
||||
% Fill with pattern pen color
|
||||
gs /DeviceRGB setcolorspace 0.44 0.19 0.06 P22 setpattern fill gr
|
||||
|
||||
gs col34 s gr % Polyline
|
||||
n 1305 3900 m 1200 3900 1200 4395 105 arcto 4 {pop} repeat
|
||||
1200 4500 3495 4500 105 arcto 4 {pop} repeat
|
||||
3600 4500 3600 4005 105 arcto 4 {pop} repeat
|
||||
3600 3900 1305 3900 105 arcto 4 {pop} repeat
|
||||
cp
|
||||
% Fill with pattern background color
|
||||
gs /DeviceRGB setcolorspace 0.60 0.37 0.24 setcolor fill gr
|
||||
|
||||
% Fill with pattern pen color
|
||||
gs /DeviceRGB setcolorspace 0.60 0.37 0.24 P22 setpattern fill gr
|
||||
|
||||
gs col33 s gr % Polyline
|
||||
n 4155 3300 m 4050 3300 4050 4395 105 arcto 4 {pop} repeat
|
||||
4050 4500 8295 4500 105 arcto 4 {pop} repeat
|
||||
8400 4500 8400 3405 105 arcto 4 {pop} repeat
|
||||
8400 3300 4155 3300 105 arcto 4 {pop} repeat
|
||||
cp
|
||||
% Fill with pattern background color
|
||||
gs /DeviceRGB setcolorspace 0.60 0.37 0.24 setcolor fill gr
|
||||
|
||||
% Fill with pattern pen color
|
||||
gs /DeviceRGB setcolorspace 0.60 0.37 0.24 P22 setpattern fill gr
|
||||
|
||||
gs col33 s gr % Polyline
|
||||
n 1305 2250 m 1200 2250 1200 3795 105 arcto 4 {pop} repeat
|
||||
1200 3900 3495 3900 105 arcto 4 {pop} repeat
|
||||
3600 3900 3600 2355 105 arcto 4 {pop} repeat
|
||||
3600 2250 1305 2250 105 arcto 4 {pop} repeat
|
||||
cp
|
||||
% Fill with pattern background color
|
||||
gs /DeviceRGB setcolorspace 0.44 0.19 0.06 setcolor fill gr
|
||||
|
||||
% Fill with pattern pen color
|
||||
gs /DeviceRGB setcolorspace 0.44 0.19 0.06 P22 setpattern fill gr
|
||||
|
||||
gs col34 s gr % Polyline
|
||||
n 1305 600 m 1200 600 1200 2145 105 arcto 4 {pop} repeat
|
||||
1200 2250 3495 2250 105 arcto 4 {pop} repeat
|
||||
3600 2250 3600 705 105 arcto 4 {pop} repeat
|
||||
3600 600 1305 600 105 arcto 4 {pop} repeat
|
||||
cp
|
||||
% Fill with pattern background color
|
||||
gs /DeviceRGB setcolorspace 0.80 0.80 0.69 setcolor fill gr
|
||||
|
||||
% Fill with pattern pen color
|
||||
gs /DeviceRGB setcolorspace 0.80 0.80 0.69 P22 setpattern fill gr
|
||||
|
||||
gs col36 s gr % Polyline
|
||||
n 1890 1050 m 1725 1050 1725 1785 165 arcto 4 {pop} repeat
|
||||
1725 1950 2910 1950 165 arcto 4 {pop} repeat
|
||||
3075 1950 3075 1215 165 arcto 4 {pop} repeat
|
||||
3075 1050 1890 1050 165 arcto 4 {pop} repeat
|
||||
cp
|
||||
% Fill with pattern background color
|
||||
gs /DeviceRGB setcolorspace 0.20 0.40 1.00 setcolor fill gr
|
||||
|
||||
% Fill with pattern pen color
|
||||
gs /DeviceRGB setcolorspace 0.20 0.40 1.00 P22 setpattern fill gr
|
||||
|
||||
gs col37 s gr % Polyline
|
||||
n 1890 2700 m 1725 2700 1725 3435 165 arcto 4 {pop} repeat
|
||||
1725 3600 2910 3600 165 arcto 4 {pop} repeat
|
||||
3075 3600 3075 2865 165 arcto 4 {pop} repeat
|
||||
3075 2700 1890 2700 165 arcto 4 {pop} repeat
|
||||
cp
|
||||
% Fill with pattern background color
|
||||
gs /DeviceRGB setcolorspace 0.59 0.59 0.59 setcolor fill gr
|
||||
|
||||
% Fill with pattern pen color
|
||||
gs /DeviceRGB setcolorspace 0.59 0.59 0.59 P22 setpattern fill gr
|
||||
|
||||
gs col35 s gr % Polyline
|
||||
n 4365 1200 m 4200 1200 4200 1785 165 arcto 4 {pop} repeat
|
||||
4200 1950 5385 1950 165 arcto 4 {pop} repeat
|
||||
5550 1950 5550 1365 165 arcto 4 {pop} repeat
|
||||
5550 1200 4365 1200 165 arcto 4 {pop} repeat
|
||||
cp
|
||||
% Fill with pattern background color
|
||||
gs /DeviceRGB setcolorspace 0.20 0.40 1.00 setcolor fill gr
|
||||
|
||||
% Fill with pattern pen color
|
||||
gs /DeviceRGB setcolorspace 0.20 0.40 1.00 P22 setpattern fill gr
|
||||
|
||||
gs col37 s gr % Polyline
|
||||
n 4365 2100 m 4200 2100 4200 2685 165 arcto 4 {pop} repeat
|
||||
4200 2850 5385 2850 165 arcto 4 {pop} repeat
|
||||
5550 2850 5550 2265 165 arcto 4 {pop} repeat
|
||||
5550 2100 4365 2100 165 arcto 4 {pop} repeat
|
||||
cp
|
||||
% Fill with pattern background color
|
||||
gs /DeviceRGB setcolorspace 0.20 0.40 1.00 setcolor fill gr
|
||||
|
||||
% Fill with pattern pen color
|
||||
gs /DeviceRGB setcolorspace 0.20 0.40 1.00 P22 setpattern fill gr
|
||||
|
||||
gs col37 s gr % Polyline
|
||||
75.000 slw
|
||||
gs clippath
|
||||
6341 1841 m 6260 1841 l 6225 1714 l 6375 1714 l cp
|
||||
6260 1310 m 6341 1310 l 6375 1436 l 6225 1436 l cp
|
||||
eoclip
|
||||
n 6300 1350 m
|
||||
6300 1800 l gs col8 s gr gr
|
||||
% arrowhead
|
||||
15.000 slw
|
||||
n 6375 1436 m 6300 1361 l 6225 1436 l 6375 1436 l cp gs col8 1.00 shd ef gr col8 s
|
||||
% arrowhead
|
||||
n 6225 1714 m 6300 1789 l 6375 1714 l 6225 1714 l cp gs col8 1.00 shd ef gr col8 s
|
||||
% Polyline
|
||||
7.500 slw
|
||||
n 5955 1800 m 5850 1800 5850 2295 105 arcto 4 {pop} repeat
|
||||
5850 2400 6645 2400 105 arcto 4 {pop} repeat
|
||||
6750 2400 6750 1905 105 arcto 4 {pop} repeat
|
||||
6750 1800 5955 1800 105 arcto 4 {pop} repeat
|
||||
cp
|
||||
% Fill with pattern background color
|
||||
gs /DeviceRGB setcolorspace 0.59 0.59 0.59 setcolor fill gr
|
||||
|
||||
% Fill with pattern pen color
|
||||
gs /DeviceRGB setcolorspace 0.59 0.59 0.59 P22 setpattern fill gr
|
||||
|
||||
gs col35 s gr % Polyline
|
||||
n 6030 900 m 5925 900 5925 1245 105 arcto 4 {pop} repeat
|
||||
5925 1350 6570 1350 105 arcto 4 {pop} repeat
|
||||
6675 1350 6675 1005 105 arcto 4 {pop} repeat
|
||||
6675 900 6030 900 105 arcto 4 {pop} repeat
|
||||
cp
|
||||
% Fill with pattern background color
|
||||
gs /DeviceRGB setcolorspace 0.20 0.40 1.00 setcolor fill gr
|
||||
|
||||
% Fill with pattern pen color
|
||||
gs /DeviceRGB setcolorspace 0.20 0.40 1.00 P22 setpattern fill gr
|
||||
|
||||
gs col37 s gr % Polyline
|
||||
75.000 slw
|
||||
gs clippath
|
||||
7691 1841 m 7610 1841 l 7575 1714 l 7725 1714 l cp
|
||||
7610 1310 m 7691 1310 l 7725 1436 l 7575 1436 l cp
|
||||
eoclip
|
||||
n 7650 1350 m
|
||||
7650 1800 l gs col8 s gr gr
|
||||
% arrowhead
|
||||
15.000 slw
|
||||
n 7725 1436 m 7650 1361 l 7575 1436 l 7725 1436 l cp gs col8 1.00 shd ef gr col8 s
|
||||
% arrowhead
|
||||
n 7575 1714 m 7650 1789 l 7725 1714 l 7575 1714 l cp gs col8 1.00 shd ef gr col8 s
|
||||
% Polyline
|
||||
7.500 slw
|
||||
n 7380 900 m 7275 900 7275 1245 105 arcto 4 {pop} repeat
|
||||
7275 1350 7920 1350 105 arcto 4 {pop} repeat
|
||||
8025 1350 8025 1005 105 arcto 4 {pop} repeat
|
||||
8025 900 7380 900 105 arcto 4 {pop} repeat
|
||||
cp
|
||||
% Fill with pattern background color
|
||||
gs /DeviceRGB setcolorspace 0.20 0.40 1.00 setcolor fill gr
|
||||
|
||||
% Fill with pattern pen color
|
||||
gs /DeviceRGB setcolorspace 0.20 0.40 1.00 P22 setpattern fill gr
|
||||
|
||||
gs col37 s gr % Polyline
|
||||
n 7305 1800 m 7200 1800 7200 2295 105 arcto 4 {pop} repeat
|
||||
7200 2400 7995 2400 105 arcto 4 {pop} repeat
|
||||
8100 2400 8100 1905 105 arcto 4 {pop} repeat
|
||||
8100 1800 7305 1800 105 arcto 4 {pop} repeat
|
||||
cp
|
||||
% Fill with pattern background color
|
||||
gs /DeviceRGB setcolorspace 0.59 0.59 0.59 setcolor fill gr
|
||||
|
||||
% Fill with pattern pen color
|
||||
gs /DeviceRGB setcolorspace 0.59 0.59 0.59 P22 setpattern fill gr
|
||||
|
||||
gs col35 s gr % Polyline
|
||||
n 5640 3450 m 5475 3450 5475 4185 165 arcto 4 {pop} repeat
|
||||
5475 4350 6660 4350 165 arcto 4 {pop} repeat
|
||||
6825 4350 6825 3615 165 arcto 4 {pop} repeat
|
||||
6825 3450 5640 3450 165 arcto 4 {pop} repeat
|
||||
cp
|
||||
% Fill with pattern background color
|
||||
gs /DeviceRGB setcolorspace 0.59 0.59 0.59 setcolor fill gr
|
||||
|
||||
% Fill with pattern pen color
|
||||
gs /DeviceRGB setcolorspace 0.59 0.59 0.59 P22 setpattern fill gr
|
||||
|
||||
gs col35 s gr % Polyline
|
||||
75.000 slw
|
||||
gs clippath
|
||||
5607 3525 m 5550 3582 l 5436 3517 l 5542 3411 l cp
|
||||
4818 2850 m 4875 2793 l 4989 2858 l 4883 2964 l cp
|
||||
eoclip
|
||||
n 4875 2850 m
|
||||
5550 3525 l gs col8 s gr gr
|
||||
% arrowhead
|
||||
15.000 slw
|
||||
n 4989 2858 m 4883 2858 l 4883 2964 l 4989 2858 l cp gs col8 1.00 shd ef gr col8 s
|
||||
% arrowhead
|
||||
n 5436 3517 m 5542 3517 l 5542 3411 l 5436 3517 l cp gs col8 1.00 shd ef gr col8 s
|
||||
% Polyline
|
||||
7.500 slw
|
||||
n 1305 4500 m 1200 4500 1200 4995 105 arcto 4 {pop} repeat
|
||||
1200 5100 8295 5100 105 arcto 4 {pop} repeat
|
||||
8400 5100 8400 4605 105 arcto 4 {pop} repeat
|
||||
8400 4500 1305 4500 105 arcto 4 {pop} repeat
|
||||
cp
|
||||
% Fill with pattern background color
|
||||
gs /DeviceRGB setcolorspace 0.97 0.80 0.40 setcolor fill gr
|
||||
|
||||
% Fill with pattern pen color
|
||||
gs /DeviceRGB setcolorspace 0.97 0.80 0.40 P22 setpattern fill gr
|
||||
|
||||
gs col32 s gr % Polyline
|
||||
105.000 slw
|
||||
gs clippath
|
||||
5545 3864 m 5511 3970 l 5371 3946 l 5415 3803 l cp
|
||||
3005 3186 m 3039 3080 l 3179 3104 l 3135 3247 l cp
|
||||
eoclip
|
||||
n 3075 3150 m
|
||||
5475 3900 l gs col8 s gr gr
|
||||
% arrowhead
|
||||
15.000 slw
|
||||
n 3179 3104 m 3085 3153 l 3135 3247 l 3179 3104 l cp gs col8 1.00 shd ef gr col8 s
|
||||
% arrowhead
|
||||
n 5371 3946 m 5465 3897 l 5415 3803 l 5371 3946 l cp gs col8 1.00 shd ef gr col8 s
|
||||
% Polyline
|
||||
75.000 slw
|
||||
gs clippath
|
||||
2441 2741 m 2360 2741 l 2325 2614 l 2475 2614 l cp
|
||||
2360 1910 m 2441 1910 l 2475 2036 l 2325 2036 l cp
|
||||
eoclip
|
||||
n 2400 1950 m
|
||||
2400 2700 l gs col8 s gr gr
|
||||
% arrowhead
|
||||
15.000 slw
|
||||
n 2475 2036 m 2400 1961 l 2325 2036 l 2475 2036 l cp gs col8 1.00 shd ef gr col8 s
|
||||
% arrowhead
|
||||
n 2325 2614 m 2400 2689 l 2475 2614 l 2325 2614 l cp gs col8 1.00 shd ef gr col8 s
|
||||
/Helvetica-Bold-iso ff 180.00 scf sf
|
||||
4800 975 m
|
||||
gs 1 -1 sc (Processes) dup sw pop 2 div neg 0 rm col0 sh gr
|
||||
/Helvetica-Bold-iso ff 180.00 scf sf
|
||||
1800 2550 m
|
||||
gs 1 -1 sc (Linux) dup sw pop 2 div neg 0 rm col7 sh gr
|
||||
/Helvetica-Bold-iso ff 180.00 scf sf
|
||||
2400 900 m
|
||||
gs 1 -1 sc (Security Monitor) dup sw pop 2 div neg 0 rm col0 sh gr
|
||||
/Helvetica-Bold-iso ff 180.00 scf sf
|
||||
7575 3975 m
|
||||
gs 1 -1 sc (VM) dup sw pop 2 div neg 0 rm col7 sh gr
|
||||
/Helvetica-Bold-iso ff 180.00 scf sf
|
||||
2400 1725 m
|
||||
gs 1 -1 sc (Agent App) dup sw pop 2 div neg 0 rm col7 sh gr
|
||||
/Helvetica-Bold-iso ff 180.00 scf sf
|
||||
2400 1425 m
|
||||
gs 1 -1 sc (Security) dup sw pop 2 div neg 0 rm col7 sh gr
|
||||
/Helvetica-Bold-iso ff 180.00 scf sf
|
||||
2400 3075 m
|
||||
gs 1 -1 sc (VMsafe) dup sw pop 2 div neg 0 rm col7 sh gr
|
||||
/Helvetica-Bold-iso ff 180.00 scf sf
|
||||
2400 3375 m
|
||||
gs 1 -1 sc (Front-End) dup sw pop 2 div neg 0 rm col7 sh gr
|
||||
/Helvetica-Bold-iso ff 180.00 scf sf
|
||||
4875 1800 m
|
||||
gs 1 -1 sc (Agent) dup sw pop 2 div neg 0 rm col7 sh gr
|
||||
/Helvetica-Bold-iso ff 180.00 scf sf
|
||||
4875 1500 m
|
||||
gs 1 -1 sc (Guest) dup sw pop 2 div neg 0 rm col7 sh gr
|
||||
/Helvetica-Bold-iso ff 180.00 scf sf
|
||||
4875 2700 m
|
||||
gs 1 -1 sc (Handler) dup sw pop 2 div neg 0 rm col7 sh gr
|
||||
/Helvetica-Bold-iso ff 180.00 scf sf
|
||||
4875 2400 m
|
||||
gs 1 -1 sc (Internal) dup sw pop 2 div neg 0 rm col7 sh gr
|
||||
/Helvetica-Bold-iso ff 180.00 scf sf
|
||||
6300 2175 m
|
||||
gs 1 -1 sc (VIPER) dup sw pop 2 div neg 0 rm col7 sh gr
|
||||
/Helvetica-Bold-iso ff 180.00 scf sf
|
||||
6300 1200 m
|
||||
gs 1 -1 sc (VIPA) dup sw pop 2 div neg 0 rm col7 sh gr
|
||||
/Helvetica-Bold-iso ff 180.00 scf sf
|
||||
7650 1200 m
|
||||
gs 1 -1 sc (VIPA) dup sw pop 2 div neg 0 rm col7 sh gr
|
||||
/Helvetica-Bold-iso ff 180.00 scf sf
|
||||
7650 2175 m
|
||||
gs 1 -1 sc (VIPER) dup sw pop 2 div neg 0 rm col7 sh gr
|
||||
/Helvetica-Bold-iso ff 180.00 scf sf
|
||||
6150 3825 m
|
||||
gs 1 -1 sc (VMsafe) dup sw pop 2 div neg 0 rm col7 sh gr
|
||||
/Helvetica-Bold-iso ff 180.00 scf sf
|
||||
6150 4125 m
|
||||
gs 1 -1 sc (Back-End) dup sw pop 2 div neg 0 rm col7 sh gr
|
||||
/Helvetica-Bold-iso ff 180.00 scf sf
|
||||
2400 4275 m
|
||||
gs 1 -1 sc (VM) dup sw pop 2 div neg 0 rm col7 sh gr
|
||||
/Helvetica-Bold-iso ff 180.00 scf sf
|
||||
6150 3075 m
|
||||
gs 1 -1 sc (OS) dup sw pop 2 div neg 0 rm col7 sh gr
|
||||
/Helvetica-Bold-iso ff 180.00 scf sf
|
||||
4725 4875 m
|
||||
gs 1 -1 sc (Virtual Infrastructure \(Single ESX Host\)) dup sw pop 2 div neg 0 rm col0 sh gr
|
||||
% here ends figure;
|
||||
pagefooter
|
||||
showpage
|
||||
%%Trailer
|
||||
end
|
||||
%EOF
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 58 KiB |
+1
-93
@@ -38,33 +38,7 @@
|
||||
****************************************************************************
|
||||
****************************************************************************
|
||||
****************************************************************************
|
||||
\if vmsafe
|
||||
\mainpage VMsafe In-Process API
|
||||
\section VMsafe_intro Introduction
|
||||
This document describes a component of the VMsafe model that provides control
|
||||
at a process level and explains how to use it. For the rest of the document
|
||||
this component shall be referred to as the VMsafe In-Process Runtime or VIPER.
|
||||
|
||||
VIPER allows a user specified (via a Guest Agent) in-process agent (referred to
|
||||
as client from now on) to monitor and modify the execution of any given
|
||||
process. VIPER is different from the security agent on the security monitor VM
|
||||
or an in-guest agent as neither of them provides direct control at the
|
||||
process level because they are unaware of processes. VIPER on the other hand
|
||||
is fully aware of process and resides within the address space of each one that
|
||||
is intended to be monitored or controlled. It provides a finer grain of
|
||||
control as it allows the user to decide which processes and what aspects of the
|
||||
processes' execution to monitor and control. Also, a client is an optional
|
||||
component for any VMsafe-based solution. The figure below gives an idea of how
|
||||
VIPER fits in with other VMsafe components. All user- or ISV-provided parts of a
|
||||
VMsafe solution are shown in blue and the VMsafe components in gray.
|
||||
|
||||
\image html viper.png
|
||||
\image rtf viper.png
|
||||
\image latex viper.eps
|
||||
|
||||
\else
|
||||
\page page_user_docs Build Your Own Tool
|
||||
\endif
|
||||
|
||||
DynamoRIO is a <em>runtime code manipulation system</em> that supports
|
||||
code transformations on any part of a program, <em>while it executes</em>.
|
||||
@@ -98,34 +72,23 @@ sections:
|
||||
- \subpage using
|
||||
<br>The top-level interfaces provided to a tool.
|
||||
|
||||
\if vmsafe
|
||||
- \subpage API_security
|
||||
<br>An interface for customizing and applying the award-winning Memory
|
||||
Firewall security software.
|
||||
|
||||
- \subpage API_probe
|
||||
<br>A powerful probe insertion interface that can operate with the code cache
|
||||
or in a lighter-weight but more restrictive mode without code cache.
|
||||
\endif
|
||||
- \subpage API_BT
|
||||
<br>DynamoRIO's full runtime code manipulation interface.
|
||||
|
||||
- \ref page_ext
|
||||
<br>DynamoRIO's API is augmented by a collection of extension libraries.
|
||||
|
||||
\ifnot vmsafe
|
||||
- \subpage page_standalone
|
||||
<br>DynamoRIO can be used as a standalone library for IA-32/AMD64/ARM/AArch64
|
||||
disassembly, decoding, encoding, and general instruction manipulation.
|
||||
A separate static library is provided for this purpose.
|
||||
\endif
|
||||
|
||||
- \subpage overview
|
||||
<br>A description of the implementation of the DynamoRIO system.
|
||||
|
||||
- \subpage release_notes
|
||||
<br>Release notes for this release, including changes since prior
|
||||
releases \ifnot vmsafe and plans for future releases \endif.
|
||||
releases and plans for future releases.
|
||||
|
||||
- \subpage page_license
|
||||
|
||||
@@ -203,7 +166,6 @@ inlined into a trace.
|
||||
Transparency is an important requirement for DynamoRIO and its clients.
|
||||
The subject is fully covered in \subpage transparency.
|
||||
|
||||
\ifnot vmsafe
|
||||
***************************************************************************
|
||||
\section sec_refs References
|
||||
|
||||
@@ -216,9 +178,6 @@ The canonical reference for DynamoRIO is:
|
||||
|
||||
See \ref page_publications for other publications involving DynamoRIO.
|
||||
|
||||
\endif
|
||||
|
||||
|
||||
****************************************************************************
|
||||
****************************************************************************
|
||||
*/
|
||||
@@ -233,15 +192,6 @@ See \ref page_publications for other publications involving DynamoRIO.
|
||||
This section gives an overview of how to use DynamoRIO, divided into the
|
||||
following sub-sections:
|
||||
|
||||
\if vmsafe
|
||||
- \ref dr_api
|
||||
- \ref dr_modes
|
||||
- \ref sec_events
|
||||
- \ref sec_utils
|
||||
- \ref sec_extlibs
|
||||
- \ref sec_comm
|
||||
- \ref sec_annotations
|
||||
\else
|
||||
- \ref sec_events
|
||||
- \ref sec_utils
|
||||
- \ref sec_extlibs
|
||||
@@ -250,9 +200,7 @@ following sub-sections:
|
||||
- \ref sec_annotations
|
||||
- \ref sec_64bit_reach
|
||||
- \ref sec_utf8
|
||||
\endif
|
||||
|
||||
\ifnot vmsafe
|
||||
DynamoRIO exports a rich Application Programming Interface (API) to the
|
||||
user for building a DynamoRIO <em>client</em>. A DynamoRIO client is a
|
||||
library that is coupled with DynamoRIO in order to jointly operate on an
|
||||
@@ -268,41 +216,6 @@ client, are called by DynamoRIO at appropriate times.
|
||||
|
||||
DynamoRIO can alternatively be used as a third-party disassembly library
|
||||
(see \ref page_standalone).
|
||||
\endif
|
||||
|
||||
\if vmsafe
|
||||
***************************************************************************
|
||||
\section dr_api API
|
||||
DynamoRIO's API is divided into the following interfaces:
|
||||
- \ref API_security
|
||||
<br>An interface for customizing and applying the award-winning Memory
|
||||
Firewall security software.
|
||||
- \ref API_probe
|
||||
<br>A powerful probe insertion interface that can operate with the code cache
|
||||
(\ref DR_MODE_CODE_MANIPULATION) or in a lighter-weight but more restrictive
|
||||
mode without the code cache (\ref DR_MODE_PROBE).
|
||||
- \ref API_BT
|
||||
<br>The full runtime code manipulation interface. This includes the Probe
|
||||
API, i.e., probes in the code cache.
|
||||
\endif
|
||||
|
||||
\if vmsafe
|
||||
***************************************************************************
|
||||
\section dr_modes Modes
|
||||
|
||||
The different modes a client can request DynamoRIO to operate in are listed
|
||||
below. These are not to be confused with the different \ref dr_api provided by
|
||||
DynamoRIO. Each mode of DynamoRIO's operation maps to one or more API.
|
||||
|
||||
- The Memory Firewall mode (#DR_MODE_MEMORY_FIREWALL) maps exclusively to the Memory Firewall API.
|
||||
- The Probe mode maps to the Probe API (#DR_MODE_PROBE) without code cache, i.e., a lighter-weight but restrictive mode.
|
||||
- The Code Manipulation mode maps to the Code Manipulation API (#DR_MODE_CODE_MANIPULATION) and the Probe API (#DR_MODE_PROBE) with code cache.
|
||||
.
|
||||
|
||||
Below we describe parts of the system that are common to all modes and
|
||||
interfaces. Each interface adds its own events and utilities, described in
|
||||
the section for that interface.
|
||||
\endif
|
||||
|
||||
***************************************************************************
|
||||
\section sec_events Common Events
|
||||
@@ -392,8 +305,6 @@ communicates with the client (see \ref sec_comm). Third-party libraries
|
||||
can be used if they are linked statically or loaded privately and there is
|
||||
no possibility of global resource conflicts (e.g., a third-party library's
|
||||
memory allocation must be wrapped): see \ref sec_extlibs for more details.
|
||||
\if vmsafe For the Probe API, these restrictions can be relaxed (see \ref
|
||||
sec_trans_probe). \endif
|
||||
|
||||
DynamoRIO's API provides:
|
||||
|
||||
@@ -898,7 +809,6 @@ developers to explicitly mark any variable as defined.
|
||||
/**
|
||||
***************************************************************************
|
||||
***************************************************************************
|
||||
\ifnot vmsafe
|
||||
\page page_standalone Disassembly Library
|
||||
|
||||
DynamoRIO can be used as a standalone library for IA-32/AMD64/ARM/AArch64
|
||||
@@ -998,6 +908,4 @@ with the DynamoRIO library, but omit the linker flags requesting no
|
||||
standard libraries or startup files. DynamoRIO's CMake support does this
|
||||
automatically via the configure_DynamoRIO_standalone() function.
|
||||
|
||||
\endif
|
||||
|
||||
*/
|
||||
|
||||
@@ -1,166 +0,0 @@
|
||||
/* **********************************************************
|
||||
* Copyright (c) 2012 Google, Inc. All rights reserved.
|
||||
* Copyright (c) 2007-2008 VMware, Inc. All rights reserved.
|
||||
* **********************************************************/
|
||||
|
||||
/*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions are met:
|
||||
*
|
||||
* * Redistributions of source code must retain the above copyright notice,
|
||||
* this list of conditions and the following disclaimer.
|
||||
*
|
||||
* * Redistributions in binary form must reproduce the above copyright notice,
|
||||
* this list of conditions and the following disclaimer in the documentation
|
||||
* and/or other materials provided with the distribution.
|
||||
*
|
||||
* * Neither the name of VMware, Inc. nor the names of its contributors may be
|
||||
* used to endorse or promote products derived from this software without
|
||||
* specific prior written permission.
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
|
||||
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
||||
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
||||
* ARE DISCLAIMED. IN NO EVENT SHALL VMWARE, INC. OR CONTRIBUTORS BE LIABLE
|
||||
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
||||
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
|
||||
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
|
||||
* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
||||
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
||||
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
|
||||
* DAMAGE.
|
||||
*/
|
||||
|
||||
/**
|
||||
***************************************************************************
|
||||
***************************************************************************
|
||||
\if vmsafe
|
||||
\page API_security Memory Firewall API
|
||||
|
||||
The Memory Firewall API provides an interface for using and
|
||||
customizing the award-winning Memory Firewall software originally
|
||||
developed by Determina, Inc. Memory Firewall is a security technique
|
||||
that leverages the DynamoRIO runtime code manipulation system
|
||||
to control what code is allowed to execute ("Restricted Code Origins"
|
||||
or RCO) and how said code can be reached ("Restricted Control
|
||||
Transfers" or RCT). The former provides protection against code
|
||||
injection attacks while the latter provides protection against code
|
||||
reuse attacks. Together these types of attacks account for most
|
||||
critical exploits seen in the wild.
|
||||
|
||||
The Memory Firewall API comes with a built in set of policies and
|
||||
exemptions based off of a simplified version of those used in
|
||||
Determina's VPS product. These policies and exemptions are not
|
||||
configurable and should be suitable for most applications. Some
|
||||
applications or modules may use code constructs that violate these
|
||||
policies and in these cases a client can be used to exempt these
|
||||
violations. The client is also given control over the remediation
|
||||
taken when a violation occurs. Most standard windows services
|
||||
(other than winlogon.exe: see \ref limits_winlogon "Limitations") and
|
||||
applications shouldn't receive violations in
|
||||
and of themselves. However, poorly written 3rd party plugins (such as
|
||||
printer drivers in the spoolsv.exe service and plugins to explorer.exe
|
||||
and Internet Explorer) can be a source of violations. Third party
|
||||
software that is injected into all processes (such as certain
|
||||
anti-virus and anti-cheating products) can also be a source of
|
||||
violations.
|
||||
|
||||
***************************************************************************
|
||||
\htmlonly
|
||||
<table width=100% bgcolor="#000000" cellspacing=0 cellpadding=2 border=0>
|
||||
<tr><td><table width=100% bgcolor="#0000C0" cellspacing=0 cellpadding=1 border=0>
|
||||
<tr><td><table width=100% bgcolor="#0000C0" cellspacing=0 cellpadding=1 border=0>
|
||||
<tr><td></td></tr></table></td></tr></table></td></tr></table>
|
||||
\endhtmlonly
|
||||
\section sec_MF_events Events
|
||||
|
||||
The security violation event occurs when a violation of the built in
|
||||
policies is detected. The client registers a callback routine (or
|
||||
hook) to receive notification of this event (see
|
||||
dr_register_security_event()). The hook routine receives seven
|
||||
parameters that describe the violation and give control over the
|
||||
remediation actions taken :
|
||||
|
||||
\code
|
||||
void security_violation(void *drcontext, void *source_tag,
|
||||
app_pc source_pc, app_pc target_pc,
|
||||
dr_security_violation_type_t violation,
|
||||
dr_mcontext_t *mcontext,
|
||||
dr_security_violation_action_t *action);
|
||||
\endcode
|
||||
|
||||
- \c drcontext is a pointer to the input program's binary translation
|
||||
context. It is critical for correct program execution that the
|
||||
input program's context remains intact. Thus, the user is not expected
|
||||
to inspect or modify the context and it is passed as an opaque pointer
|
||||
(i.e., <tt>void *</tt>).
|
||||
|
||||
- \c source_tag is the unique tag of the fragment of code in the
|
||||
code cache that was the source of the violations. Each fragment of
|
||||
code within DynamoRIO's code cache is identified by a unique \e
|
||||
tag which is the application starting address of that block of
|
||||
code.
|
||||
|
||||
- \c source_pc is the address of the source instruction for the violation.
|
||||
|
||||
- \c target_pc is the address of the target instruction for the violation.
|
||||
|
||||
- \c violation is a value from the \c dr_security_violation_type_t enum in
|
||||
dr_events.h that describes the type of violation that occurred
|
||||
including whether the violation is from the RCO or RCT policies.
|
||||
See the enum for a fuller description of the violation types.
|
||||
|
||||
- \c mcontext is the application's context at the time of the
|
||||
violation. This is an IN/OUT parameter to allow the application's
|
||||
state to be changed as part of the remediation.
|
||||
|
||||
- \c action is an IN/OUT parameter that selects the remediation action
|
||||
to take. The remediations are drawn from the \c
|
||||
dr_security_violation_action_t enum in dr_events.h and include such
|
||||
actions as continuing as if no violation occurred, throwing an
|
||||
exception at the target, etc. See the enum for a fuller
|
||||
description of possible remediations.
|
||||
|
||||
***************************************************************************
|
||||
\htmlonly
|
||||
<table width=100% bgcolor="#000000" cellspacing=0 cellpadding=2 border=0>
|
||||
<tr><td><table width=100% bgcolor="#0000C0" cellspacing=0 cellpadding=1 border=0>
|
||||
<tr><td><table width=100% bgcolor="#0000C0" cellspacing=0 cellpadding=1 border=0>
|
||||
<tr><td></td></tr></table></td></tr></table></td></tr></table>
|
||||
\endhtmlonly
|
||||
\section sec_MF_utils Utilities
|
||||
|
||||
The Memory Firewall API also includes the ability to generate a
|
||||
forensics report when a violation is received that includes detailed
|
||||
information about the source and target addresses, as well as general
|
||||
information on the process and machine as a whole. The forensics
|
||||
report is generated in an xml block described by
|
||||
dr_forensics-1.0.dtd.
|
||||
|
||||
\code
|
||||
void dr_write_forensics_report(void *dcontext, (file_t) file,
|
||||
dr_security_violation_type_t violation,
|
||||
dr_security_violation_action_t action,
|
||||
const char *violation_name);
|
||||
\endcode
|
||||
|
||||
|
||||
***************************************************************************
|
||||
\htmlonly
|
||||
<table width=100% bgcolor="#000000" cellspacing=0 cellpadding=2 border=0>
|
||||
<tr><td><table width=100% bgcolor="#0000C0" cellspacing=0 cellpadding=1 border=0>
|
||||
<tr><td><table width=100% bgcolor="#0000C0" cellspacing=0 cellpadding=1 border=0>
|
||||
<tr><td></td></tr></table></td></tr></table></td></tr></table>
|
||||
\endhtmlonly
|
||||
|
||||
\section sec_MF_examples Examples
|
||||
|
||||
An example Memory Firewall client implementation is provided at <a
|
||||
href="../../samples/MF_moduledb.c">../../samples/MF_moduledb.c</a>. See \ref
|
||||
sec_mf_samples for a description.
|
||||
|
||||
\endif
|
||||
****************************************************************************
|
||||
****************************************************************************
|
||||
*/
|
||||
|
||||
+2
-2
@@ -1,5 +1,5 @@
|
||||
/* **********************************************************
|
||||
* Copyright (c) 2012-2015 Google, Inc. All rights reserved.
|
||||
* Copyright (c) 2012-2021 Google, Inc. All rights reserved.
|
||||
* Copyright (c) 2007-2008 VMware, Inc. All rights reserved.
|
||||
* **********************************************************/
|
||||
|
||||
@@ -34,7 +34,7 @@
|
||||
/**
|
||||
***************************************************************************
|
||||
***************************************************************************
|
||||
\if vmsafe
|
||||
\if probe_interface_enabled
|
||||
\page API_probe Probe API
|
||||
|
||||
The Probe API provides an interface that enables a client to insert
|
||||
|
||||
+9
-57
@@ -42,13 +42,9 @@
|
||||
This section is divided into the following subsections:
|
||||
|
||||
- \ref sec_package
|
||||
\ifnot vmsafe
|
||||
- \ref sec_changes
|
||||
\endif
|
||||
- \ref sec_limits
|
||||
\ifnot vmsafe
|
||||
- \ref sec_future
|
||||
\endif
|
||||
|
||||
***************************************************************************
|
||||
\htmlonly
|
||||
@@ -89,18 +85,14 @@ The following are part of the DynamoRIO release distribution:
|
||||
- Header files for the DynamoRIO APIs.
|
||||
- This documentation.
|
||||
- \ref API_samples "Sample clients".
|
||||
\ifnot vmsafe
|
||||
- A graphical statistics viewer \c DRstats.exe that displays internal
|
||||
DynamoRIO statistics as well as custom statistics defined
|
||||
by a client (see \ref sec_drstats) (Windows package only).
|
||||
DynamoRIO exports a large number of statistics in its debug build, and
|
||||
a handful in release builds.
|
||||
\endif
|
||||
\ifnot vmsafe
|
||||
- A binary tracedump reader, which also functions as a sample
|
||||
client using DynamoRIO as a standalone library (see \ref
|
||||
sec_standalone).
|
||||
\endif
|
||||
- A number of end-user tools including a code coverage tool (see \ref
|
||||
page_drcov), a multi-process cache simulator (see \ref page_drcachesim),
|
||||
a last-level cache miss analyzer (see \ref page_drcachesim),
|
||||
@@ -118,7 +110,6 @@ files in the resulting directory tree:
|
||||
find . -name \*.dll -exec chmod ugo+rx {} \; -o -name \*.exe -exec chmod ugo+rx {} \;
|
||||
\endcode
|
||||
|
||||
\ifnot vmsafe
|
||||
***************************************************************************
|
||||
\htmlonly
|
||||
<table width=100% bgcolor="#000000" cellspacing=0 cellpadding=2 border=0>
|
||||
@@ -1360,7 +1351,7 @@ The changes between version 2.0.0 and 1.5.0 are:
|
||||
- configuration does NOT enable systemwide injection by default:
|
||||
use the -syswide_on parameter to drconfig or drrun for that
|
||||
(it requires administrative privileges)
|
||||
.
|
||||
|
||||
\b IMPORTANT: On Linux, if you're using custom injection via
|
||||
raw environment variables rather than using the \p drdeploy script,
|
||||
you must also set DYNAMORIO_RUNUNDER to 1 for injection to work with
|
||||
@@ -1662,8 +1653,6 @@ The major changes between the 0.9.5 and 0.9.4 releases are:
|
||||
- The full API is now documented in html and pdf for easy browsing.
|
||||
- Numerous type and routine name changes.
|
||||
|
||||
\endif
|
||||
|
||||
|
||||
***************************************************************************
|
||||
\htmlonly
|
||||
@@ -1687,34 +1676,6 @@ using system-interacting library routines.
|
||||
See \ref sec_extlibs for further details.
|
||||
- Currently, the communication API provided by DynamoRIO is limited to file
|
||||
I/O and nudges.
|
||||
\if vmsafe
|
||||
- The security agent on the security monitor VM has no direct
|
||||
relationship with DynamoRIO. However, the VMsafe solution provider
|
||||
can architect their own communication channel between the security
|
||||
agent on the security monitor VM and the client by using an agent on
|
||||
the client's VM as an intermediary.
|
||||
\anchor limits_winlogon
|
||||
- There is a known false positive in the anti-piracy DRM code in the
|
||||
Windows Genuine Advantage component of winlogon.exe. This code
|
||||
performs deliberate obfuscation and violations of standard coding
|
||||
behavior.
|
||||
\endif
|
||||
\if vmsafe
|
||||
- The client can run in only one mode at a time, which cannot be changed during the
|
||||
execution of the process. Mode change can be done only on a subsequent
|
||||
application restart.
|
||||
- The client should call only the API corresponding to the mode it was started
|
||||
in. Mixing API from different modes can lead to unspecified results and is
|
||||
not supported.
|
||||
- Probe API allows only one registration of probes, which must occur in
|
||||
dr_init().
|
||||
- Probes can be specified only with library names and offsets from the base
|
||||
of the library in memory (\ref DR_PROBE_ADDR_LIB_OFFS).
|
||||
- When a probe callback finishes execution it can't request DynamoRIO to
|
||||
perform any actions like logging, control flow changes, etc.
|
||||
- Probe locations can't include system call wrappers in ntdll.dll, i.e.,
|
||||
ntdll!Nt* routines can't be probe locations.
|
||||
\endif
|
||||
|
||||
\subsection sec_limit_platforms Platform Limitations
|
||||
- This version of DynamoRIO supports Windows 8, 8.1, and 10.
|
||||
@@ -1800,23 +1761,18 @@ not supported.
|
||||
to enable prioritizing memory usage and the \ref op_speed "-opt_speed option"
|
||||
to prioritize performance at the cost of more complex basic blocks that
|
||||
cross control transfers.
|
||||
- The performance \if vmsafe of Code Manipulation Mode and Memory
|
||||
Firewall Mode \endif when starting up large desktop applications
|
||||
- The performance when starting up large desktop applications
|
||||
may be noticeably worse than native. Upcoming releases will
|
||||
address this issue. \if vmsafe Note that Probe Mode incurs
|
||||
significantly less overhead than the other modes. \endif
|
||||
- The performance \if vmsafe of Code Manipulation Mode \endif when
|
||||
address this issue.
|
||||
- The performance when
|
||||
running Java, .Net, Flash or similar managed execution
|
||||
applications can be noticeably worse then native. This can
|
||||
include applications that load these components as in-process
|
||||
plugins (such as Internet Explorer). Upcoming releases will
|
||||
address this issue. \if vmsafe Probe Mode and Memory Firewall
|
||||
Mode are not affected. \endif
|
||||
- When using \if vmsafe Code Manipulation Mode or Memory Firewall
|
||||
Mode \else DynamoRIO \endif on all or many processes on a system
|
||||
address this issue.
|
||||
- When using DynamoRIO on all or many processes on a system
|
||||
simultaneously, memory usage may become a factor. Upcoming
|
||||
releases will address this issue. \if vmsafe Note that Probe Mode
|
||||
incurs significantly less overhead than the other modes. \endif
|
||||
releases will address this issue.
|
||||
|
||||
\subsection sec_limit_deploy Deployment Limitations
|
||||
|
||||
@@ -1843,8 +1799,7 @@ not supported.
|
||||
user32.dll will not be run under control of DynamoRIO using
|
||||
system-wide injection unless its
|
||||
parent process (typically cmd.exe or explorer.exe, for manually
|
||||
launched applications) is already under DynamoRIO control
|
||||
\if vmsafe (the parent can be in any mode)\endif. Only some small
|
||||
launched applications) is already under DynamoRIO control. Only some small
|
||||
non-graphical applications do not link with user32.dll.
|
||||
- When invoking an application in any way that is not from a parent
|
||||
process under DynamoRIO control, DynamoRIO takes control a little
|
||||
@@ -1866,7 +1821,7 @@ not supported.
|
||||
client will be able to display a messagebox when running in said
|
||||
services (they have no associated visible window station). See
|
||||
dr_messagebox().
|
||||
- On Windows Vista \if vmsafe in Code Manipulation Mode \endif the code from
|
||||
- On Windows Vista the code from
|
||||
certain dlls (found mostly in services) and the code subsequently
|
||||
called from those dlls is run natively and is not visible to the
|
||||
instrumentation APIs. This only applies to dlls that have a .pexe
|
||||
@@ -1896,7 +1851,6 @@ not supported.
|
||||
- On Linux, the private loader will fail to load libpthread.so. Therefore
|
||||
clients and the libraries they use cannot link against libpthread.so.
|
||||
|
||||
\ifnot vmsafe
|
||||
***************************************************************************
|
||||
\htmlonly
|
||||
<table width=100% bgcolor="#000000" cellspacing=0 cellpadding=2 border=0>
|
||||
@@ -1922,6 +1876,4 @@ To discuss current and future features, join the <a
|
||||
href="http://groups.google.com/group/dynamorio-users/">DynamoRIO Users
|
||||
group</a>.
|
||||
|
||||
\endif
|
||||
|
||||
*/
|
||||
|
||||
@@ -156,46 +156,6 @@ the drwrap extension (see \ref page_drwrap).
|
||||
The sample <a href="https://github.com/DynamoRIO/dynamorio/tree/master/api/samples/ssljack.c">ssljack.c</a> demonstrates how to
|
||||
hook OpenSSL and GnuTLS functions, using the drwrap extension.
|
||||
|
||||
\if vmsafe
|
||||
\section probe_samples Probe API Examples
|
||||
|
||||
Not available yet.
|
||||
\endif
|
||||
|
||||
\if vmsafe
|
||||
\anchor sec_mf_samples
|
||||
\section mf_samples Memory Firewall Examples
|
||||
|
||||
An example Memory Firewall client implementation is provided at <a
|
||||
href="https://github.com/DynamoRIO/dynamorio/tree/master/api/samples/MF_moduledb.c">samples/MF_moduledb.c</a> (see that file
|
||||
for additional documentation). The MF_moduledb sample client reads in
|
||||
a list of module names and options from a config file and exempts security
|
||||
violations associated with those modules based on the type of
|
||||
violation and the options in the file. In this manner violations from
|
||||
dlls known to have certain types of false positives can be avoided.
|
||||
It also supports dynamically changing its exemptions with a nudge
|
||||
handler that triggers re-reading the config file.
|
||||
|
||||
The MF_moduledb sample client is provided with a configuration file <a
|
||||
href="https://github.com/DynamoRIO/dynamorio/tree/master/api/samples/MF_moduledb-sample.config">MF_moduledb-sample.config</a>
|
||||
and a violation generating executable <a
|
||||
href="https://github.com/DynamoRIO/dynamorio/tree/master/api/samples/VIPA_test.exe">VIPA_test.exe.c</a> for easy
|
||||
testing. To use :
|
||||
|
||||
Use drdeploy.exe to configure VIPA_test.exe to run under security_api mode with
|
||||
the appropriate options.
|
||||
drdeploy.exe -reg VIPA_test.exe -root \<root path\> -mode security_api -client \<path
|
||||
to MF_moduledb.dll\> -ops "-client_ops \<path to MF_moduledb-sample.config\>"
|
||||
|
||||
Then run VIPA_test.exe. Clicking on the heap attack button should produce messages
|
||||
that a potential security violation is being allowed. Clicking on the stack attack
|
||||
button should produce a message that a potential security violation is being blocked
|
||||
by killing the process.
|
||||
|
||||
Use 'drdeploy.exe -nudge VIPA_text.exe' to nudge the process to re-read the
|
||||
configuration file.
|
||||
|
||||
\endif
|
||||
|
||||
\section bt_examples Discussion of Selected Samples
|
||||
|
||||
@@ -597,7 +557,6 @@ for this example is in the file <a
|
||||
href="https://github.com/DynamoRIO/dynamorio/tree/master/api/samples/bbsize.c">bbsize.c</a>.
|
||||
|
||||
|
||||
\ifnot vmsafe
|
||||
********************
|
||||
\subsection sec_drstats Use of Custom Client Statistics with the Windows GUI
|
||||
|
||||
@@ -613,15 +572,10 @@ properly. They can be modified to use a "Global" prefix instead of "Local"
|
||||
for cross-session sharing, though this requires running with administrative
|
||||
privileges.
|
||||
|
||||
\endif
|
||||
|
||||
\ifnot vmsafe
|
||||
********************
|
||||
\subsection sec_ex8 Use of Standalone API
|
||||
|
||||
The binary tracedump reader also functions as an example of
|
||||
\ref page_standalone : <a href="https://github.com/DynamoRIO/dynamorio/tree/master/api/samples/tracedump.c">tracedump.c</a>.
|
||||
|
||||
\endif
|
||||
|
||||
*/
|
||||
|
||||
+3
-23
@@ -1,5 +1,5 @@
|
||||
/* **********************************************************
|
||||
* Copyright (c) 2012-2020 Google, Inc. All rights reserved.
|
||||
* Copyright (c) 2012-2021 Google, Inc. All rights reserved.
|
||||
* Copyright (c) 2007-2010 VMware, Inc. All rights reserved.
|
||||
* **********************************************************/
|
||||
|
||||
@@ -44,22 +44,16 @@ flexibility but complicates transparency. To achieve transparency,
|
||||
DynamoRIO cannot make any assumptions about a program's stack usage, heap
|
||||
usage, or any of its dependencies on the instruction set architecture or
|
||||
operating system. DynamoRIO's transparency restrictions necessarily apply
|
||||
to a client as\if vmsafe well (though they are lessened when using the Probe API in
|
||||
lightweight mode).\else well.\endif
|
||||
to a client as well.
|
||||
|
||||
Contents:
|
||||
- \ref sec_trans_resource
|
||||
- \ref sec_trans_unmod
|
||||
- \ref sec_trans_pretend
|
||||
- \ref sec_trans_alertable
|
||||
\if vmsafe
|
||||
- \ref sec_trans_probe
|
||||
\endif
|
||||
|
||||
We first describe each of the three transparency categories for DynamoRIO
|
||||
and their ramifications for clients using the code cache. \if vmsafe
|
||||
Finally, we discuss transparency issues for the Probe API, which has
|
||||
fewer limitations. \endif
|
||||
and their ramifications for clients using the code cache.
|
||||
|
||||
***************************************************************************
|
||||
\section sec_trans_resource Resource Usage Conflicts
|
||||
@@ -321,20 +315,6 @@ issues noted above.
|
||||
On Windows, DynamoRIO does not support a client making alertable system
|
||||
calls. See \ref sec_alertable for more information.
|
||||
|
||||
\if vmsafe
|
||||
***************************************************************************
|
||||
\section sec_trans_probe Transparency of Probe API Clients
|
||||
|
||||
For the Probe API, any particular probe routine is interrupting the
|
||||
application at a single, known point. If the client is certain that this
|
||||
is a safe point for invoking shared resources or performing other actions
|
||||
that are risky when attempted at arbitrary points, then they may be
|
||||
invoked. However, be warned that it can be difficult to be certain that
|
||||
library routines are safe, as they may themselves acquire locks or call
|
||||
other routines that are not safe.
|
||||
|
||||
\endif
|
||||
|
||||
***************************************************************************
|
||||
****************************************************************************
|
||||
****************************************************************************
|
||||
|
||||
@@ -1,106 +0,0 @@
|
||||
#FIG 3.2 Produced by xfig version 3.2.5
|
||||
Landscape
|
||||
Center
|
||||
Inches
|
||||
A4
|
||||
100.00
|
||||
Single
|
||||
-2
|
||||
1200 2
|
||||
0 32 #f7cb66
|
||||
0 33 #995e3c
|
||||
0 34 #6f300f
|
||||
0 35 #969696
|
||||
0 36 #ccccb1
|
||||
0 37 #3366ff
|
||||
6 1725 1050 3075 1950
|
||||
2 4 0 1 37 37 50 -1 62 0.000 0 0 11 0 0 5
|
||||
3075 1050 1725 1050 1725 1950 3075 1950 3075 1050
|
||||
4 1 7 49 -1 18 12 0.0000 4 210 1095 2400 1725 Agent App\001
|
||||
4 1 7 49 -1 18 12 0.0000 4 210 870 2400 1425 Security\001
|
||||
-6
|
||||
6 1725 2700 3075 3600
|
||||
2 4 0 1 35 35 50 -1 62 0.000 0 0 11 0 0 5
|
||||
3075 2700 1725 2700 1725 3600 3075 3600 3075 2700
|
||||
4 1 7 49 -1 18 12 0.0000 4 165 720 2400 3075 VMsafe\001
|
||||
4 1 7 49 -1 18 12 0.0000 4 165 1035 2400 3375 Front-End\001
|
||||
-6
|
||||
6 4200 1200 5550 1950
|
||||
2 4 0 1 37 37 50 -1 62 0.000 0 0 11 0 0 5
|
||||
5550 1200 4200 1200 4200 1950 5550 1950 5550 1200
|
||||
4 1 7 49 -1 18 12 0.0000 4 210 615 4875 1800 Agent\001
|
||||
4 1 7 49 -1 18 12 0.0000 4 165 615 4875 1500 Guest\001
|
||||
-6
|
||||
6 4200 2100 5550 2850
|
||||
2 4 0 1 37 37 50 -1 62 0.000 0 0 11 0 0 5
|
||||
5550 2100 4200 2100 4200 2850 5550 2850 5550 2100
|
||||
4 1 7 49 -1 18 12 0.0000 4 165 810 4875 2700 Handler\001
|
||||
4 1 7 49 -1 18 12 0.0000 4 165 795 4875 2400 Internal\001
|
||||
-6
|
||||
6 5700 750 6900 2550
|
||||
2 1 0 6 8 8 50 -1 -1 0.000 0 0 -1 1 1 2
|
||||
1 1 2.00 150.00 75.00
|
||||
1 1 2.00 150.00 75.00
|
||||
6300 1350 6300 1800
|
||||
2 4 0 1 35 35 50 -1 62 0.000 0 0 7 0 0 5
|
||||
6750 1800 5850 1800 5850 2400 6750 2400 6750 1800
|
||||
2 4 0 1 37 37 50 -1 62 0.000 0 0 7 0 0 5
|
||||
6675 1350 5925 1350 5925 900 6675 900 6675 1350
|
||||
2 4 0 1 36 36 51 -1 62 0.000 0 0 7 0 0 5
|
||||
6900 750 5700 750 5700 2550 6900 2550 6900 750
|
||||
4 1 7 49 -1 18 12 0.0000 4 165 660 6300 2175 VIPER\001
|
||||
4 1 7 49 -1 18 12 0.0000 4 165 510 6300 1200 VIPA\001
|
||||
-6
|
||||
6 7050 750 8250 2550
|
||||
2 1 0 6 8 8 50 -1 -1 0.000 0 0 -1 1 1 2
|
||||
1 1 2.00 150.00 75.00
|
||||
1 1 2.00 150.00 75.00
|
||||
7650 1350 7650 1800
|
||||
2 4 0 1 36 36 51 -1 62 0.000 0 0 7 0 0 5
|
||||
8250 750 7050 750 7050 2550 8250 2550 8250 750
|
||||
2 4 0 1 37 37 50 -1 62 0.000 0 0 7 0 0 5
|
||||
8025 1350 7275 1350 7275 900 8025 900 8025 1350
|
||||
2 4 0 1 35 35 50 -1 62 0.000 0 0 7 0 0 5
|
||||
8100 1800 7200 1800 7200 2400 8100 2400 8100 1800
|
||||
4 1 7 49 -1 18 12 0.0000 4 165 510 7650 1200 VIPA\001
|
||||
4 1 7 49 -1 18 12 0.0000 4 165 660 7650 2175 VIPER\001
|
||||
-6
|
||||
6 5475 3450 6825 4350
|
||||
2 4 0 1 35 35 50 -1 62 0.000 0 0 11 0 0 5
|
||||
6825 3450 5475 3450 5475 4350 6825 4350 6825 3450
|
||||
4 1 7 49 -1 18 12 0.0000 4 165 720 6150 3825 VMsafe\001
|
||||
4 1 7 49 -1 18 12 0.0000 4 165 975 6150 4125 Back-End\001
|
||||
-6
|
||||
2 4 0 1 34 34 51 -1 62 0.000 0 0 7 0 0 5
|
||||
8400 3300 4050 3300 4050 2700 8400 2700 8400 3300
|
||||
2 4 0 1 33 33 51 -1 62 0.000 0 0 7 0 0 5
|
||||
3600 4500 1200 4500 1200 3900 3600 3900 3600 4500
|
||||
2 4 1 2 0 7 52 -1 20 9.000 0 0 7 0 0 5
|
||||
8400 2700 4050 2700 4050 600 8400 600 8400 2700
|
||||
2 4 0 1 33 33 51 -1 62 0.000 0 0 7 0 0 5
|
||||
8400 4500 4050 4500 4050 3300 8400 3300 8400 4500
|
||||
2 1 0 6 8 8 50 -1 -1 0.000 0 0 -1 1 1 2
|
||||
1 1 2.00 150.00 75.00
|
||||
1 1 2.00 150.00 75.00
|
||||
4875 2850 5550 3525
|
||||
2 4 0 1 32 32 50 -1 62 0.000 0 0 7 0 0 5
|
||||
8400 5100 1200 5100 1200 4500 8400 4500 8400 5100
|
||||
2 4 0 1 34 34 51 -1 62 0.000 0 0 7 0 0 5
|
||||
3600 3900 1200 3900 1200 2250 3600 2250 3600 3900
|
||||
2 1 0 8 8 8 50 -1 -1 0.000 0 0 -1 1 1 2
|
||||
1 1 2.00 150.00 75.00
|
||||
1 1 2.00 150.00 75.00
|
||||
3075 3150 5475 3900
|
||||
2 1 0 6 8 8 50 -1 -1 0.000 0 0 -1 1 1 2
|
||||
1 1 2.00 150.00 75.00
|
||||
1 1 2.00 150.00 75.00
|
||||
2400 1950 2400 2700
|
||||
2 4 0 1 36 36 51 -1 62 0.000 0 0 7 0 0 5
|
||||
3600 600 1200 600 1200 2250 3600 2250 3600 600
|
||||
4 1 7 49 -1 18 12 0.0000 4 165 345 2400 4275 VM\001
|
||||
4 1 0 50 -1 18 12 0.0000 4 165 1095 4800 975 Processes\001
|
||||
4 1 7 49 -1 18 12 0.0000 4 165 330 6150 3075 OS\001
|
||||
4 1 0 49 -1 18 12 0.0000 4 210 4065 4725 4875 Virtual Infrastructure (Single ESX Host)\001
|
||||
4 1 7 50 -1 18 12 0.0000 4 165 555 1800 2550 Linux\001
|
||||
4 1 0 50 -1 18 12 0.0000 4 210 1755 2400 900 Security Monitor\001
|
||||
4 1 7 50 -1 18 12 0.0000 4 165 345 7575 3975 VM\001
|
||||
@@ -1,5 +1,5 @@
|
||||
/* **********************************************************
|
||||
* Copyright (c) 2020 Google, Inc. All rights reserved.
|
||||
* Copyright (c) 2020-2021 Google, Inc. All rights reserved.
|
||||
* Copyright (c) 2008-2010 VMware, Inc. All rights reserved.
|
||||
* **********************************************************/
|
||||
|
||||
@@ -41,7 +41,7 @@
|
||||
|
||||
/*
|
||||
* NOTE - I haven't tried running this with the dynamorio.dll in this directory so it
|
||||
* might not work. I've been using a tot VMAP=1 build of core.
|
||||
* might not work. I've been using a tot build of core.
|
||||
*
|
||||
* ls *.dll > LIST
|
||||
* for i in $( cat LIST ) ; do ../vista_hash.exe $i; done > ../OUTPUT
|
||||
|
||||
+1
-3
@@ -646,9 +646,7 @@ if (UNIX)
|
||||
if (NOT APPLE)
|
||||
# i#46, i#1541, i#1459: we have zero dependencies now by default, except
|
||||
# for MacOS where privlib is NYI (i#1285) and static lib.
|
||||
if (NOT VMSAFE AND NOT VPS) # XXX: these unsupported builds have deps
|
||||
set(check_deps ON)
|
||||
endif ()
|
||||
set(check_deps ON)
|
||||
endif ()
|
||||
# i#2632: 32-bit recent clang release builds are inserting text relocs.
|
||||
# XXX: We don't support clang for official package builds until this is fixed.
|
||||
|
||||
@@ -1720,10 +1720,6 @@ cleanup:
|
||||
false /* no flush */);
|
||||
DELETE_LOCK(client_flush_request_lock);
|
||||
#endif
|
||||
/* avoid compile error "error: label at end of compound statement"
|
||||
* from vps-release-external build
|
||||
*/
|
||||
return;
|
||||
}
|
||||
|
||||
void
|
||||
|
||||
+5
-5
@@ -1910,7 +1910,7 @@ OPTION_COMMAND_INTERNAL(bool, security_api, false, "security_api",
|
||||
"enable Security API", STATIC, OP_PCACHE_NOP)
|
||||
|
||||
/* PR 200418: program shepherding is now runtime-option-controlled. Note - not
|
||||
* option_command_internal so that we can use for VPS release builds. */
|
||||
* option_command_internal so that we can use for release builds. */
|
||||
OPTION_COMMAND(bool, security, false, "security",
|
||||
{
|
||||
if (options->security) {
|
||||
@@ -1922,9 +1922,9 @@ OPTION_COMMAND(bool, security, false, "security",
|
||||
options->syslog_init = true;
|
||||
IF_INTERNAL(options->syslog_internal_mask = SYSLOG_ALL;)
|
||||
|
||||
/* VPS had -use_moduledb by default (and then disabled with
|
||||
* -staged) */
|
||||
|
||||
/* We used to have -use_moduledb by default (disabled with
|
||||
* -staged).
|
||||
*/
|
||||
ENABLE_SECURITY(options);
|
||||
|
||||
/* memory wins over gcc/gap perf issues (PR 326815)
|
||||
@@ -3339,7 +3339,7 @@ DYNAMIC_OPTION_DEFAULT(uint, pc_num_hashes, 100,
|
||||
|
||||
/* detect_mode for process_control; see case 10610. Only reason to have it
|
||||
* separate is that it is distinctly different than other core features,
|
||||
* and is exposed in UI as orthogonal to other VPS features.
|
||||
* and is exposed as orthogonal to other security features.
|
||||
*
|
||||
* FIXME: having a separate detect_mode option for each
|
||||
* security mechanism won't scale even if each used the OPTION_* flags
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/* **********************************************************
|
||||
* Copyright (c) 2011-2020 Google, Inc. All rights reserved.
|
||||
* Copyright (c) 2011-2021 Google, Inc. All rights reserved.
|
||||
* Copyright (c) 2009-2010 VMware, Inc. All rights reserved.
|
||||
* **********************************************************/
|
||||
|
||||
@@ -71,7 +71,7 @@
|
||||
#cmakedefine DR_HOST_X64
|
||||
#cmakedefine DR_HOST_NOT_TARGET
|
||||
|
||||
/* set by high-level VMAP/VMSAFE/VPS configurations */
|
||||
/* high-level configuration */
|
||||
#cmakedefine PROGRAM_SHEPHERDING
|
||||
#cmakedefine CLIENT_INTERFACE
|
||||
#cmakedefine APP_EXPORTS
|
||||
|
||||
@@ -384,40 +384,6 @@ if (NOT cross_aarchxx_linux_only AND NOT cross_android_only AND NOT a64_on_x86_o
|
||||
if (ARCH_IS_X86 AND NOT APPLE)
|
||||
# we do not bother to support these on ARM
|
||||
if (DO_ALL_BUILDS)
|
||||
testbuild("vmsafe-debug-internal-32" OFF "
|
||||
VMAP:BOOL=OFF
|
||||
VMSAFE:BOOL=ON
|
||||
DEBUG:BOOL=ON
|
||||
INTERNAL:BOOL=ON
|
||||
${install_path_cache}
|
||||
")
|
||||
endif ()
|
||||
if (DO_ALL_BUILDS)
|
||||
testbuild("vmsafe-release-external-32" OFF "
|
||||
VMAP:BOOL=OFF
|
||||
VMSAFE:BOOL=ON
|
||||
DEBUG:BOOL=OFF
|
||||
INTERNAL:BOOL=OFF
|
||||
${install_path_cache}
|
||||
")
|
||||
endif (DO_ALL_BUILDS)
|
||||
if (NOT arg_debug_only)
|
||||
testbuild("vps-debug-internal-32" OFF "
|
||||
VMAP:BOOL=OFF
|
||||
VPS:BOOL=ON
|
||||
DEBUG:BOOL=ON
|
||||
INTERNAL:BOOL=ON
|
||||
${install_path_cache}
|
||||
")
|
||||
endif ()
|
||||
if (DO_ALL_BUILDS)
|
||||
testbuild("vps-release-external-32" OFF "
|
||||
VMAP:BOOL=OFF
|
||||
VPS:BOOL=ON
|
||||
DEBUG:BOOL=OFF
|
||||
INTERNAL:BOOL=OFF
|
||||
${install_path_cache}
|
||||
")
|
||||
# Builds we'll keep from breaking but not worth running many tests
|
||||
testbuild("callprof-32" OFF "
|
||||
CALLPROF:BOOL=ON
|
||||
|
||||
+10
-80
@@ -96,7 +96,7 @@ endif (UNIX)
|
||||
|
||||
# FIXME i#1807: below, we convert all long suite test subsets to ^common
|
||||
|
||||
set(vmap_run_list
|
||||
set(main_run_list
|
||||
# our main configuration
|
||||
"SHORT::-code_api"
|
||||
# sanity check: run single app to make sure these options aren't totally broken
|
||||
@@ -151,81 +151,19 @@ set(vmap_run_list
|
||||
"ONLY::^(runall|${osname})::-finite_shared_trace_cache -cache_shared_trace_regen 80"
|
||||
)
|
||||
|
||||
# This is no longer an actively supported config so we have few tests.
|
||||
set(vmsafe_run_list
|
||||
# keep lightweight modes alive
|
||||
# i#24: -thin_client not working: once it works, re-enable
|
||||
#"WIN::ONLY::^runall::-thin_client"
|
||||
"WIN::ONLY::^runall::-probe_api -hotp_only"
|
||||
# We no longer actively support this build so we run only a few tests.
|
||||
"ONLY::^security::-code_api -probe_api"
|
||||
"ONLY::^security ^runall runinterface::-security_api"
|
||||
"ONLY::^security::-security_api -code_api -probe_api"
|
||||
)
|
||||
|
||||
# Xref the very long set of runs we used to test in
|
||||
# suite/old-runregression-runs-2-6-08.
|
||||
# This is no longer an actively supported config so we have few tests.
|
||||
set(vps_run_list
|
||||
"ONLY::^(common|${osname}|security|runall)::-security"
|
||||
"WIN::ONLY::^runall::-security -client"
|
||||
"WIN::ONLY::^runall::-security -low" # not a default config
|
||||
# Test with -use_moduledb relaxations, (is on by default, but tests Makefile
|
||||
# adds -staged which turns it off, we re-enable by turning the option back on).
|
||||
# The tests Makefile adds different version resource information to different
|
||||
# tests in runall/ and security-{common,win32}/ to fully exercise this.
|
||||
"WIN::ONLY::^runall::-security -use_moduledb"
|
||||
)
|
||||
# if building dedicated vps, want short suite of all tests
|
||||
set(vps_short_list
|
||||
"SHORT::-security"
|
||||
)
|
||||
|
||||
if (CALLPROF AND TEST_SUITE)
|
||||
set(run_list "ONLY::^common::")
|
||||
elseif (VMAP)
|
||||
else ()
|
||||
if (TEST_SUITE)
|
||||
# We don't redo all tests for internal vs external, but we do for debug vs release
|
||||
if (DEBUG OR NOT INTERNAL)
|
||||
set(run_list ${vmap_run_list})
|
||||
set(run_list ${main_run_list})
|
||||
else ()
|
||||
set(run_list "ONLY::^client::-code_api")
|
||||
endif ()
|
||||
else (TEST_SUITE)
|
||||
set(run_list ${vmap_run_list})
|
||||
set(run_list ${main_run_list})
|
||||
endif (TEST_SUITE)
|
||||
elseif (VMSAFE)
|
||||
if (TEST_SUITE)
|
||||
if (DEBUG AND INTERNAL)
|
||||
set(run_list ${vmsafe_run_list})
|
||||
else (DEBUG AND INTERNAL)
|
||||
set(run_list
|
||||
"ONLY::^client::-code_api -probe_api"
|
||||
"ONLY::^(client|security)::-security_api"
|
||||
"ONLY::^runall::-probe_api -hotp_only"
|
||||
)
|
||||
endif (DEBUG AND INTERNAL)
|
||||
else (TEST_SUITE)
|
||||
set(run_list ${vmsafe_run_list})
|
||||
endif (TEST_SUITE)
|
||||
elseif (VPS)
|
||||
if (TEST_SUITE)
|
||||
if (DEBUG AND INTERNAL)
|
||||
set(run_list ${vps_run_list})
|
||||
else (DEBUG AND INTERNAL)
|
||||
set(run_list
|
||||
"ONLY::^common::"
|
||||
"ONLY::^security::-security -detect_mode -report_max 0 -no_diagnostics"
|
||||
"WIN::ONLY::^(common|${osname}|security|runall)::-security -liveshields"
|
||||
"WIN::ONLY::^(runall|security)::-security -client"
|
||||
)
|
||||
endif (DEBUG AND INTERNAL)
|
||||
else (TEST_SUITE)
|
||||
set(run_list ${vps_short_list})
|
||||
endif (TEST_SUITE)
|
||||
else (CALLPROF AND TEST_SUITE)
|
||||
# no tests
|
||||
set(run_list "")
|
||||
endif (CALLPROF AND TEST_SUITE)
|
||||
|
||||
# i#4059: Reduce Appveyor time by reducing the # of tests run for 32-bit.
|
||||
@@ -1224,9 +1162,6 @@ function(runtest_cmd outcmd outops key native standalone_dr dr_ops_aux separate_
|
||||
string(REGEX REPLACE "//" "/" drrun_path "${drrun_path}")
|
||||
set(cmd "${drrun_path}" -s ${timeout} -quiet)
|
||||
prefix_cmd_if_necessary(cmd OFF ${cmd})
|
||||
if (VMSAFE)
|
||||
set(cmd ${cmd} -mode code)
|
||||
endif ()
|
||||
if (DEBUG)
|
||||
set(cmd ${cmd} -debug)
|
||||
endif ()
|
||||
@@ -1244,9 +1179,6 @@ function(runtest_cmd outcmd outops key native standalone_dr dr_ops_aux separate_
|
||||
# we pass -exit0 to avoid ctest from considering our segfault and other tests
|
||||
# to have failed (also xref PR 548997).
|
||||
set(cmd ${cmd} -exit0)
|
||||
if (VPS AND VMAP OR VMSAFE)
|
||||
set(cmd ${cmd} -mode code)
|
||||
endif (VPS AND VMAP OR VMSAFE)
|
||||
if (native)
|
||||
set(cmd ${cmd} -noinject)
|
||||
endif ()
|
||||
@@ -2004,12 +1936,10 @@ tobuild(common.getretaddr common/getretaddr.c)
|
||||
|
||||
if (X86) # FIXME i#1551, i#1569: port asm to ARM and AArch64
|
||||
# nativeexec tests are under CLIENT_INTERFACE b/c they link w/ DR and need api_headers.
|
||||
# We do not run for VMSAFE as they fail there and we just don't support that
|
||||
# combination now (i#1793).
|
||||
# XXX i#1287: implement for MacOS
|
||||
# We do not support -no_early_inject on Android (i#1873).
|
||||
# FIXME i#1799: clang does not support "asm goto".
|
||||
if (CLIENT_INTERFACE AND NOT VMSAFE AND NOT APPLE AND NOT ANDROID
|
||||
if (CLIENT_INTERFACE AND NOT APPLE AND NOT ANDROID
|
||||
AND ANNOTATIONS AND NOT CMAKE_COMPILER_IS_CLANG)
|
||||
# XXX i#1651: we don't support -native_exec combined with -early_inject so
|
||||
# for now we pass -no_early_inject to all of these tests.
|
||||
@@ -4216,11 +4146,11 @@ if (UNIX)
|
||||
endif ()
|
||||
else (UNIX)
|
||||
add_exe(win32.infloop win32/infloop.c)
|
||||
if (VPS)
|
||||
# too flaky across platforms so we limit to VPS only: not too useful
|
||||
if (PROGRAM_SHEPHERDING)
|
||||
# too flaky across platforms so we limit to security mode only: not too useful
|
||||
# for other than testing our ASLR anyway
|
||||
tobuild(win32.aslr-dll win32/aslr-dll.c)
|
||||
endif (VPS)
|
||||
endif ()
|
||||
tobuild(win32.callback win32/callback.c)
|
||||
tobuild(win32.crtprcs win32/crtprcs.c)
|
||||
if (X64)
|
||||
@@ -4534,10 +4464,10 @@ if (X86) # FIXME i#1551, i#1569: port asm to ARM and AArch64
|
||||
mark_execstack(${decode_bad_stack_name})
|
||||
tobuild(security-common.retexisting security-common/retexisting.c)
|
||||
endif (X86)
|
||||
if (VPS) # relies on being aborted on .B violation
|
||||
if (PROGRAM_SHEPHERDING) # relies on being aborted on .B violation
|
||||
tobuild(security-common.jmp_from_trace security-common/jmp_from_trace.c)
|
||||
tochcon(security-common.jmp_from_trace textrel_shlib_t)
|
||||
endif (VPS)
|
||||
endif ()
|
||||
tobuild(security-common.ret_noncall_trace security-common/ret_noncall_trace.c)
|
||||
if (NOT ARM) # FIXME i#1551: fix bugs on ARM
|
||||
# FIXME i#1423: somehow when built with VS2013 x64 you can't catch a fault on
|
||||
|
||||
@@ -31,8 +31,6 @@
|
||||
* DAMAGE.
|
||||
*/
|
||||
|
||||
/* compile with make VMAP=1 for a vmap version (makefile defaults to VMSAFE version) */
|
||||
|
||||
#include "configure.h"
|
||||
|
||||
#ifdef WINDOWS
|
||||
|
||||
Reference in New Issue
Block a user