derek.bruening/2010/i138-module-path.diff

[derekbruening]

From [email protected] on January 03, 2010 21:24:30

issue #138: provide full path to module separately from name

• module_data_t.full_path field was already present, just not set.
• for linux, taking non-short version of /proc/maps comment.
  module_names_t.file_name is the short name version of full_path.
• for windows, NtQueryVirtualMemory with MemorySectionName
  does work for image sections on XP+, and there it always gives absolute
  (NT-style) paths, so we use it when available.
• as Nebbett points it, MemorySectionName queries fail for image sections
  on 2K and NT. there we expand the code written for ASLR that
  records the file used to open the last section to use a global hashtable,
  which avoids issues with handles shared among threads and with
  non-sequential section-mapping sequences (PR 213463/case 9028).
  • I added a generic hashtable wrapper around the hashtablex.h macros,
    which had never been used outside of fragment.c and required some
    updates to work properly
  • DR now watches NtClose and NtDuplicateObject to update the
    section-to-file hashtable
• we don't see the map for modules present at init time: there we use
  the potentially unsafe get_module_name() but there should only be one
  thread
• I kept the name-tracking code under -track_module_filenames
• on a MemorySectionName query by the app to DR memory, we return
  STATUS_INVALID_ADDRESS (C0000141) to hide our dlls
• when using either MemorySectionName or NtQueryInformationFile we get an
  NT path, and clients will want Dos paths. I added
  convert_NT_to_Dos_path(), which converts /Device/LanmanRedirector to //
  and queries the ProcessDeviceMap to convert /Device/HarddiskVolumeN to x:/
• on 2K/NT for image sections, we can only use NtQueryInformationFile,
  which sometimes returns a relative path: for those cases I map in the
  file as a non-image and then call MemorySectionName.
  sort of expensive, but limited to legacy platforms. note that can't do
  this mapping trick w/ just section handle since section is already image
  or not so still need hashtable.

Testing done:

• modified suite/tests/client-interface/modules.dll.c module_load_event to
  print the full path and ran calc on xp and 2K: we successfully retrieved
  the full path for already-loaded app modules, client libs, DR lib, and
  dynamically-loaded libs
• ditto on linux, with events.dll.c

NOCHECKIN: add real test? have modules.dll.c ensure path starts w/ drive letter?

stats: 2260 diff lines
CMakeLists.txt | 2
api/docs/release.dox | 4
core/dynamo.c | 8
core/fragment.h | 6
core/hashtable.c | 139 +++++++++++++
core/hashtable.h | 55 +++++
core/heap.h | 3
core/lib/statsx.h | 1
core/linux/module.c | 13 !
core/linux/os.c | 6
core/module_list.c | 16 !
core/module_shared.h | 9
core/monitor.h | 1
core/utils.h | 1
core/win32/aslr.c | 30 -!
core/win32/aslr.h | 13 !
core/win32/module.c | 154 ++++++++++!!!!!
core/win32/ntdll.c | 71 +++-!
core/win32/ntdll.h | 28 ++
core/win32/os.c | 87 ++++++!!
core/win32/os_private.h | 19 +
core/win32/syscall.c | 296 +++++!!!!!!!!!!!!!!!!!!!!!!
core/win32/syscallx.h | 2
core/x86/instrument.c | 25 +!
core/x86/instrument.h | 4
suite/tests/client-interface/events.dll.c | 4
suite/tests/client-interface/modules.dll.c | 1
27 files changed, 559 insertions(+), 37 deletions(-), 402 modifications(!)

Original issue: http://code.google.com/p/dynamorio/issues/detail?id=245

[derekbruening]

From [email protected] on April 20, 2010 10:44:27

Status: Verified