9

I've found some universities that are porting DynamoRIO (or something very similar) to Linux kernel space, but the code doesn't seem to be available. Is there a resource I am unaware of?

Here's an example.

0xC0000022L
  • 10,908
  • 9
  • 41
  • 79
RobotHumans
  • 563
  • 2
  • 16
  • Could you provide a link to some of the university efforts? It would help to know what kind of functionality you're looking for. E.g. if you just want something that does dynamic binary translation for kernel-mode code, QEMU in whole-system mode technically fits the bill. – Brendan Dolan-Gavitt Apr 11 '13 at 19:36
  • http://static.usenix.org/event/hotdep10/tech/slides/feiner.pdf says they will open source it on slide 16... dunno what happened to it. – cb88 Apr 11 '13 at 21:13
  • 1
    There is a branch in the DynamoRIO Google Code project called "DRK", and commit 1323 has the log message "DRK: DynamoRIO as a Linux kernel module". I don't know enough about DynamoRIO to tell if that branch actually contains the kernel version of DynamoRIO though. – Brendan Dolan-Gavitt Apr 11 '13 at 21:34
  • @BrendanDolan-Gavitt Awesome, I was in fact looking for DRK. If you move that to an answer I would be glad to accept it. – RobotHumans Apr 11 '13 at 21:44

3 Answers3

8

Yes, there is DynamoRIO Kernel (DRK), which is a DynamoRIO (DR) port created by Peter Feiner at the University of Toronto (U of T). The current DR source tree; however, does not contain DRK, despite the existence of a branch. DRK has yet to be open sourced, and U of T is actively doing kernel DBT research using DRK and a new DBT framework.

If you are thinking of porting it yourself, the two main challenges are:

  • Interrupts and how they interact with the code cache. DRK took the "direct port" approach. For example, where DR uses thread-private code caches, DRK uses CPU-private code caches. This results in a lot of annoyances w.r.t. transparency and interrupts.
  • What level of transparency you want. DR was designed with a lot of transparency in mind, and DRK kept that promise. My experience with kernel instrumentation so far has been that it is remarkably well-behaved (unless you care about a small portion of device drivers). Transparency on several fronts can be sacrificed, but this is more challenging within the general DR framework.
Peter Goodman
  • 366
  • 2
  • 4
6

There is a branch in the DynamoRIO Google Code project called "DRK", and commit 1323 has the log message "DRK: DynamoRIO as a Linux kernel module". That should contain the code you're looking for, though since I haven't used DynamoRIO before I can't guarantee it.

0xC0000022L
  • 10,908
  • 9
  • 41
  • 79
Brendan Dolan-Gavitt
  • 2,888
  • 2
  • 19
  • 37
5

Recently, two new kernel instrumentation systems have been released, of which I am the creator of one:

  1. Granary, which is primarily focused on module instrumentation. This is the instrumentation created by me. Granary internally uses parts of DynamoRIO, but works rather differently. The goal of Granary is to make it easy to develop debugging and analysis tools. There will be a paper in HotDep'13 about one of the major memory debugging tools built on top of Granary.
  2. btkernel, a recently released full kernel instrumentation system. You can find a paper about btkernel in SOSP'13.
Peter Goodman
  • 366
  • 2
  • 4