Anywhere, Any-Time Binary Instrumentation
Andrew R. Bernat, Barton P. Miller
Proceedings of the 10th ACM SIGPLAN-SIGSOFT workshop
on Program analysis for software tools (PASTE), 2011
-
Dyninst is a versatile framework that enables Anywhere, Any-Time (AWAT) instrumentation by abstracting programs into control flow structures like functions and loops. Unlike purely static or JIT-based tools, it utilizes graph transformation and state interception to allow immediate modification or removal of instrumentation on actively executing code while maintaining proportional cost, ensuring uninstrumented code runs at native speed
-
In my view
Dyninst provides a more sophisticated and detailed strategy compared to Detours and PEBIL by employing high-level abstractions. -
Limitations
-
Increased Complexity and Overhead for Obfuscated Code the tool must relocate more code (e.g., indirect jumps/calls) than usual to enable analysis, losing its characteristic "proportional cost" advantage
-
Structural Mapping Complexity in Overlapping Code
Correctly mapping these onto a CFG requires sophisticated techniques like block cloning and aliases, which increases the risk of analysis errors. -
Inefficiency in Space-Constrained Patching Like Detours and PEBIL, Dyninst relies on patching. If the selected code is too small to hold an interception branch, it must either enlarge the region or use traps as a last resort.
-
