Internal shadow stack on_clone
Closed this issue · 5 comments
The internal shadow stack needs to handle threading events.
Specifically, clone calls that lead to threads.
Use drmgr for the thread init event (does not get called for fork, this was tested)
Note: thread exit event does get called when even a single threaded process dies.
Instead of one stack, maybe keep a map<tid, shadowstack> ?
Also: thread SS should clear stack on thread event
This map requires syscall get tid on each call. Maybe try to do this once and store the result in TLS?
Drmgr gives an interface to store things in a thread local context. Look up the memtrace sample, it had a per_thread_t struct that's manipulated.
Also need to figure out what happens to TLS for k threads on fork event?
Uses drmgr_register_tls_field, drmgr_get_tls_field, and drmgr_set_tls_field.
Done