Method and system for computer assisted hot-tracing mechanism
This invention provides a new mechanism for “Hot-Tracing” using a novel placeholder mechanism and binary rewriting techniques, which leverages existing compiler flags in order to enable light-weight and highly flexible dynamic instrumentation. Broadly, I-Probe can be divided in 2 distinct workflows—1. Pre-processing (ColdPatch), and 2. Hot Tracing. The first phase is a pre-processing mechanism to prepare the binary for phase 2. The second phase is the actual hot-tracing mechanism, which allows users to dynamically instrument functions (more specifically symbols) of their choice.
1. A computer implemented method for monitoring systems for misconfigurations difficult to detect, the method comprising:
employing a cold patch preprocess using a processor for preparing a target application for hot tracing, the target application having at least one library, the cold patch preprocess including using compiler flags to generate calls to symbols and adding NOPs in place of all the calls to symbols except those that need to be cold started;
executing the preprocessed target application resulting in a run time of the preprocessed target application;
interrupting the run time of the preprocessed target application;
implementing instrumentation or de-instrumentation during the interrupted run time of the preprocessed target application enabled by the hot tracing;
replacing selected ones of the NOPs with calls to instrumentation depending on functions which a user wishes to instrument;
preloading the instrumentation in the form of a shared library before start of execution of the preprocessed target application, generating a list of offsets that act as the placeholders for the hot tracing; and
providing interactive graphical user interfaces for the cold patch and the hot tracing, wherein the hot tracing enables users to dynamically instrument functions in the system for monitoring for misconfigurations.
2. The method of claim 1 , wherein the cold patch preprocess comprises compiling source files with instrument functions, a flag in this compilation stage introducing calls at the entry and exit of each function to instrumentation.
3. The method of claim 1 , wherein the cold patch preprocess comprises replacing all calls to the instrumentation functions with no-operation instructions (NOP), the replacing step parsing through the binary and looking for all calls to symbols, after finding offsets for all these calls, they are replaced by the NOP op code, these offsets acting as placeholder that can be later replaced with calls to the instrumentation functions.
4. The method of claim 3 , wherein the cold patch further comprises a parser generating a list of all offsets discovered in an executable binary or a shared library, enabling using pre-existing flags which are common in most compilers but for generating placeholders.
5. A computer implemented method for monitoring systems for misconfigurations difficult to detect, the method comprising:
employing a cold patch preprocess using a processor for preparing a target application for hot tracing, the target application having at least one library, the cold patch preprocess including using compiler flags to generate calls to symbols and adding NOPs in place of all the calls to symbols except those that need to be cold started;
executing the preprocessed target application resulting in a run time of the preprocessed target application;
interrupting a run time of the preprocessed target application;
implementing instrumentation or de-instrumentation during the interrupted run time of the preprocessed target application enabled by the hot tracing;
replacing selected ones of the NOPs with calls to instrumentation depending on functions which a user wishes to instrument;
preloading the instrumentation in the form of a shared library before start of execution of the preprocessed target application, generate ng a list of offsets that act as the placeholders for the hot tracing; and
providing interactive graphical user interfaces for the cold patch and the hot tracing, wherein the hot tracing enables users to dynamically instrument functions in the system for monitoring for misconfigurations;
wherein the cold patch preprocess comprises replacing all calls to instrumentation function with no-operation instructions NOP except select functions.
6. The method of claim 5 , wherein the cold patch preprocess comprises at the end of the cold patch preprocess linking an instrumentation library to an executable and beginning execution.
7. The method of claim 1 , wherein the hot tracing comprises a hotpatch of the instrumentation for functions specified by the user to a given binary or shared library using the offset list, the hot patching including modifying code segment to add the instrumentation.
8. The method of claim 1 , wherein the hot tracing comprises a hotpatch for removing instrumentation functions for functions specified by the user to a given binary or shared library using the offset list, the hotpatch including removing instrumentation for the function by modifying a code segment and returning it to an original state.
9. A system for monitoring for misconfigurations difficult to detect in large scale complex systems, the system comprising:
a processor executing instructions stored in a memory to:
cold patch preprocess a target application to prepare it for hot tracing, the target application having at least one library, the cold patch preprocess including using compiler flags to generate calls to symbols and adding NOPs in place of all the calls to symbols except those that need to be cold started;
interrupting a run time of the preprocessed target application;
implement instrumentation or de-instrumentation during the interrupted run time of the preprocessed target application enabled by the hot tracing;
generate a shared library from preloading the instrumentation before start of execution of the preprocessed target application; and
generate a list of offsets generated that act as placeholders for the hot tracing; and
interactive graphical user interfaces provided for the cold patch and the hot tracing,
wherein the hot tracing enables users to dynamically instrument functions in the system for monitoring for misconfigurations.
10. The system of claim 9 , wherein the cold patch preprocess comprises compiling source files with instrument functions, a flag in this compilation stage introducing calls at the entry and exit of each function to instrumentation.
11. The system of claim 9 , wherein the cold patch preprocess comprises replacing all calls to the instrumentation functions with no-operation instruction (NOP), the replacing step parsing through the binary and looking for all calls to symbols, after finding offsets for all those calls, they are replaced by the NOP op code, these offsets acting as a placeholder that can be later replaced with calls to the instrumentation functions.
12. The system of claim 11 , wherein the cold patch further comprises a parser generating a list of all offsets discovered in an executable binary or a shared library, enabling using pre-existing flags which are common in most compilers but for generating placeholders.
13. A system for monitoring for misconfigurations difficult to detect in large scale complex systems, the system comprising:
a processor executing instructions stored in a memory to:
cold patch preprocess a target application to prepare it for hot tracing, the target application having at least one library, the cold patch preprocess including using compiler flags to generate calls to symbols and adding NOPs in place of all the calls to symbols except those that need to be cold started;
interrupt a run time of the preprocessed target application;
implement instrumentation or de-instrumentation during the interrupted run time of the preprocessed target application enabled by the hot tracing;
replace selected ones of the NOPs with calls to instrumentation depending on functions which a user wishes to instrument;
generate a shared library from preloading the instrumentation before start of execution of the preprocessed target application, and
generate a list of offsets generated that act as placeholders for the hot tracing; and
interactive graphical user interfaces provided for the cold patch and the hot tracing;
wherein the hot tracing enables users to dynamically instrument functions in the system for monitoring for misconfigurations; and
wherein the cold patch preprocess comprises replacing all calls to instrumentation functions with no-operation instructions NOP except select functions.
14. The system of claim 13 , wherein the cold patch preprocess comprises at that end of the cold patch preprocess linking an instrumentation library to an executable and beginning execution.
15. The system of claim 9 , wherein the hot tracing comprises a hotpatch of the instrumentation for functions specified by the user to a given binary or shared library using the offset list, the hot patching including modifying code segment to add the instrumentation.
16. The system of claim 9 , wherein the hot tracing comprises a hotpatch for removing instrumentation functions for functions specified by the user to a given binary or shared library using the offset list, the hotpatch including removing instrumentation for the function by modifying a code segment and returning it to an original state.