rbpf icon indicating copy to clipboard operation
rbpf copied to clipboard

Jit Code Disassembler?

Open hsqStephenZhang opened this issue 10 months ago • 3 comments

motivation

disassemble the code into x86/aarch64 instruction format for debug usage, this can be gated behind a disassemble feature

example

demo code

// in JitMemory
//capstone = { version = "0.13", optional = true }
let cs = capstone::Capstone::new()
                  .x86() // shall handle x86 and aarch64 in the real world
                  .mode(arch::x86::ArchMode::Mode64)
                  .syntax(arch::x86::ArchSyntax::Att)
                  .detail(detail)
                  .build()
                  .unwrap()
let code = &self.contents[0..self.offset];
let insns = cs.disasm_all(code, 0).unwrap();
for insn in insns {
    println!("{}", insn);
}

output

for instructions

    let prog = &[
        0x71, 0x10, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, // ldxh r0, [r1+2]
        0x95, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // exit
    ];

output is

0x0: pushq %rbp
0x1: pushq %rbx
0x2: pushq %r13
0x4: pushq %r14
0x6: pushq %r15
0x8: movq %rdx, %r10
0xb: movq %rdx, %rdi
0xe: movq %rsp, %rbp
0x11: subq $0x200, %rsp
0x18: movzbl 2(%rdi), %eax
0x1c: addq $0x200, %rsp
0x23: popq %r15
0x25: popq %r14
0x27: popq %r13
0x29: popq %rbx
0x2a: popq %rbp
0x2b: retq 

hsqStephenZhang avatar Feb 06 '25 07:02 hsqStephenZhang

i'd like to make a draft first if it's wanted

hsqStephenZhang avatar Feb 06 '25 08:02 hsqStephenZhang

Thanks for the proposal, but I don't think we really need that in the crate. If users want to disassemble their program, they can probably do it outside of the library. I'm not sure we expose a way to retrieve the JITed program in rbpf, but we could add a function to do that; and then the user is free to disassemble or otherwise manipulate the JITed instructions in their app. What do you think?

qmonnet avatar Feb 06 '25 10:02 qmonnet

yeah, expose the JITed instructions as a &[u8] would be better

hsqStephenZhang avatar Feb 06 '25 10:02 hsqStephenZhang