关键词:
Computer engineering
Information technology
Computer science
摘要:
Binary instrumentation facilitates the insertion of additional code into an executable in order to observe or modify the executable’s behavior. The uses of binary instrumentation generally fall in to two categories — program observation tooling such as performance profilers and program augmentation tooling such as software updaters and security hardening tools. Both above types of uses are, however, hindered by the instrumentation overhead. For example, fine-grained performance profiling is often done offline due to high overheads. Also, many security hardening schemes such as shadow stacks and control-flow-integrity have not found mass adoption due to their overheads. I present two approaches which can reduce the binary instrumentation overheads and thus, can help bring some of these tooling online and more widely adopted. The first approach is on-demand instrumentation, which is the ability to enable and disable, aka toggle, instrumentation at run-time. Current instrumentation frameworks lack the primitives for cheap run-time instrumentation toggling. I present several novel instruction patching primitives, Wordpatch, Callpatch and Instruction Punning, which in combination, can be used to implement cheap, rapidly togglable instrumentation. I demonstrate the application of these primitives by developing a lightweight latency profiler. The second approach is instrumentation elision, which skips inserting instrumentation at certain program locations using a particular instrumentation policy. Using shadow stacks as a case study, I demonstrate how we can elide shadow stack instrumentation on certain safe code regions as determined by binary static analysis. Finally, I present how this application of instrumentation elision leads to significant overhead reductions in shadow stacks.