TARDIS
TARDIS copied to clipboard
Fix vdso
Closes #6.
In order to disable vDSOI replace the AT_SYSINFO_EHDR tag in tracee auxv with AT_IGNORE as suggested by this gist.
To do that I first assume the rsp will point to argc after execve call.
Then I find auxv at rsp + argc + argc*wordsize (argv[]) + envp (skip until first NULL).
A simple iteration should yield AT_SYSINFO_EHDR 😎
Some related and unrelated changes:
- Refactored
ptracemagic to separateptrace.c. - Cleaned up child trace logic and replaced with TRACEME call
- Added some minor error handling.
How does this interact with ptrace debugging? Specifically can you still use e.g. gdb with a program run with tardis (since it will now be ptracing itself)?
@maxbla Hey! I haven't changed tracer-tracee relationship. Tardis is not ptracing it's main thread, just sets up child thread as a tracee (and parent as tracer) before calling execve. This was just a stylistic choice that simplified code a little.
As before, you can debug tardis, but not a program run with it.