Dynamic instrumentation via user-level mechanisms

1. A computer-implemented method of instrumenting a source process, comprising:

identifying, by a processor, a system call from a source process executable;

building a trampoline for the system call, the trampoline having a first area comprising instructions to invoke a handler in association with executing a relocated copy of the system call and return flow to an address immediately following the system call;

writing a first jump instruction to jump to the trampoline, in an unused or borrowed space of the source process executable;

overwriting the system call in the source process executable with a second jump instruction to jump to the first jump instruction; and

causing execution of the source process executable with the trampoline operable to instrument the system call.

2. The computer-implemented method of claim 1 , wherein

the source process executable is loaded but paused during the identifying, and

the identifying comprises disassembling the source process executable to identify the system call.

3. The computer-implemented method of claim 1 , further comprising

identifying a relocatable instruction from the source process executable,

the trampoline comprising a check flag instruction to check a flag and two areas that are selectively executed depending on whether the flag is set,

the two areas including the first area and a second area comprising instructions to execute a relocated copy of the relocatable instruction and return flow to an address immediately following the relocatable instruction,

wherein the first jump instruction is written into the borrowed space and a location of the relocatable instruction in an instruction space of the source process executable corresponds to the borrowed space.

4. The computer-implemented method of claim 3 , wherein

the relocatable instruction is overwritten with a set flag instruction to set the flag and the first jump instruction to jump to the trampoline, and

the first area includes a clear flag instruction to clear the flag.

5. The computer-implemented method of claim 3 , wherein the second area of the trampoline further comprises instructions that invoke the handler with on entry parameters before executing the system call and invoke the handler with on exit parameters after executing the system call.

6. The computer-implemented method of claim 1 , wherein the first jump instruction is written into the unused space and the unused space is not reachable in a normal program flow of the source process executable.

7. The computer-implemented method of claim 3 , wherein no instruction between the relocatable instruction and the system call is identified as a target of a jump or a branch from another part of the source process executable.

8. The computer-implemented method of claim 3 , further comprising:

identifying a function call that is not a system call from a second source process executable;

identifying a second relocatable instruction from the second source process executable;

building a second trampoline for the function call, the trampoline having a third area comprising instructions to invoke a second handler in association with executing a relocated copy of the function call and return flow to an address immediately following the function call and a fourth area comprising instructions to execute a relocated copy of the second relocatable instruction and return flow to an address immediately following the second relocatable instruction.

9. The computer-implemented method of claim 1 , further comprising:

collecting, from the handler, results associated with instrumenting the system call;

reporting the results to a user device.

10. The computer-implemented method of claim 1 , further comprising:

identifying a second system call from the source process executable;

building a second trampoline for the second system call having a third area comprising instructions to invoke a handler in association with executing a relocated copy of the second system call and return flow to an address immediately following the second system call.

11. The computer-implemented method of claim 1 , wherein a code length of the first jump instruction is greater than a code length of the second jump instruction, and the code length of the second jump instruction is less than or equal to a code length of the system call.

12. One or more non-transitory storage media storing instructions which, when executed by one or more computing devices, cause performance of a method of instrumenting a source process, the method comprising:

identifying a system call from a source process executable;

building a trampoline for the system call, the trampoline having a first area comprising instructions to invoke a handler in association with executing a relocated copy of the system call and return flow to an address immediately following the system call;

writing a first jump instruction to jump to the trampoline, in an unused or borrowed space of the source process executable;

overwriting the system call in the source process executable with a second jump instruction to jump to the first jump instruction; and

causing execution of the source process executable with the trampoline operable to instrument the system call.

13. The one or more non-transitory storage media of claim 12 , the method further comprising

identifying a relocatable instruction from the source process executable,

the trampoline comprising a check flag instruction to check a flag and two areas that are selectively executed depending on whether the flag is set,

the two areas including the first area and a second area comprising instructions to execute a relocated copy of the relocatable instruction and return flow to an address immediately following the relocatable instruction,

wherein the first jump instruction is written into the borrowed space and a location of the relocatable instruction in an instruction space of the source process executable corresponds to the borrowed space.

14. The one or more non-transitory storage media of claim 13 , wherein

the relocatable instruction is overwritten with a set flag instruction to set the flag and the first jump instruction to jump to the trampoline,

the first area includes a clear flag instruction to clear the flag.

15. The one or more non-transitory storage media of claim 13 , wherein the second area of the trampoline further comprises instructions that invoke the handler with on entry parameters before executing the system call and invoke the handler with on exit parameters after executing the system call.

16. The one or more non-transitory storage media of claim 12 , wherein the first jump instruction is written into the unused space and the unused space is not reachable in a normal program flow of the source process executable.

17. The one or more non-transitory storage media of claim 13 , the method further comprising:

identifying a function call that is not a system call from a second source process executable;

identifying a second relocatable instruction from the second source process executable;

building a second trampoline for the function call, the trampoline having a third area comprising instructions to invoke a second handler in association with executing a relocated copy of the function call and return flow to an address immediately following the function call and a fourth area comprising instructions to execute a relocated copy of the second relocatable instruction and return flow to an address immediately following the second relocatable instruction.

18. The one or more non-transitory storage media of claim 12 , the method further comprising:

identifying a second system call from the source process executable;

building a second trampoline for the second system call having a third area comprising instructions to invoke a handler in association with executing a relocated copy of the second system call and return flow to an address immediately following the second system call.

19. The one or more non-transitory storage media of claim 12 , wherein a code length of the first jump instruction is greater than a code length of the second jump instruction, and the code length of the second jump instruction is less than or equal to a code length of the system call.