Skip to content

feat: inline instrumentation optimizations #53

Description

@ndrewh

Follow-up to #5

from pwnlib.asm import asm
def lib_hook(b):
    b.raw(asm("int3"))
  • Calling b.raw for every call to the instrumentation builder is decoding the instruction sequence each time. If we had a way of constructing (thread-global) raw expressions that could be reused, then we could avoid this overhead
  • Calls to raw assembly instructions must un-reserve registers, commit the abstract state, and re-reserve registers. This is really inefficient, especially for sequences of raw assembly. At a minimum, we could elide the reservation and commit if there's no other changes (i.e. for hooks that only contain calls to b.raw).
fuck = ctypes.c_long(1337)
def lib_hook(b):
    b.regs.rsi += b.load(ctypes.addressof(fuck))
  • I believe dynamorio provides special instruction builders for if fuck has an address reachable from the code cache (e.g. you can do LEA with a 32-bit offset from RIP rather than constructing a 64-bit immediate and loading from that.

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or requestinlineinline instrumentation compilerperfImproves performance (often only in edge cases)

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions