Dynamorio stop capture after executed execve

12 views
Skip to first unread message

Songyan Tang CN

unread,
Aug 17, 2024, 10:34:57 AMAug 17
to DynamoRIO Users
Hi all,

I static link dynamorio in my app and use like this:

dr_client_main(...) {
    dr_register_fork_init_event(...);
    drmgr_register_post_syscall_event(...);
}

my_app() {
dr_app_setup();
dr_app_start();

pid_t pid = fork(); // <--- fork_init_event could be triggered here
if (pid > 0) {
    // ...
} else {
    execve("launch.sh", ...); // <--- fork_init_event would not be triggered here
}

}

I hope I could capture all subprocess init event in launch.sh, but after run execve DR seems lose control of the process, the fork init event not triggered and in post syscall event I could not get SYS_execve event, but SYS_execve event could be get when execve failed. So maybe I mistook something?

Derek Bruening

unread,
Aug 17, 2024, 3:33:18 PMAug 17
to Songyan Tang CN, DynamoRIO Users
DR that is statically linked into the application cannot follow across an execve as it has no mechanism for doing that: DR as a standalone binary is required for that.  A mixture could be used but is not currently supported.

--
You received this message because you are subscribed to the Google Groups "DynamoRIO Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to dynamorio-use...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/dynamorio-users/393fe5d5-43a0-43f0-9c0b-fee6270e6086n%40googlegroups.com.
Reply all
Reply to author
Forward
0 new messages