Dynamic instrumentation

摘要

Techniques for dynamic instrumentation are provided. A method for instrumentation preparation may include obtaining address data of an original instruction in an original instruction stream, obtaining kernel mode data comprising a kernel breakpoint handler, obtaining user mode data comprising a user breakpoint handler, allocating a page of a process address space, creating a trampoline, associating the trampoline with a breakpoint instruction, and replacing the original instruction with the breakpoint instruction. A method for instrumentation may include detecting the breakpoint instruction, calling the kernel breakpoint handler, modifying an instruction pointer via the kernel breakpoint handler such that the instruction pointer points to the trampoline, and executing the trampoline. The system for instrumentation may include a breakpoint setup module and a breakpoint execution module for respectively setting up and completing instrumentation involving the trampoline.

主权项

1. A method comprising:
creating a trampoline associated with a breakpoint instruction, the trampoline comprising a copy of an original instruction in an original instruction stream, a set of instructions for saving register states and stack data of the original instruction, and a set of instructions for restoring the register states and the stack data of the original instruction; detecting the breakpoint instruction; calling a kernel breakpoint handler; modifying an instruction pointer via the kernel breakpoint handler such that the instruction pointer points to the trampoline; and executing the trampoline by operation of one or more processors, wherein executing the trampoline comprises executing the original instruction.