diff options
| author | Christian Krinitsin <mail@krinitsin.com> | 2025-07-17 09:10:43 +0200 |
|---|---|---|
| committer | Christian Krinitsin <mail@krinitsin.com> | 2025-07-17 09:10:43 +0200 |
| commit | f2ec263023649e596c5076df32c2d328bc9393d2 (patch) | |
| tree | 5dd86caab46e552bd2e62bf9c4fb1a7504a44db4 /results/scraper/fex/documentation/1914 | |
| parent | 63d2e9d409831aa8582787234cae4741847504b7 (diff) | |
| download | qemu-analysis-main.tar.gz qemu-analysis-main.zip | |
Diffstat (limited to 'results/scraper/fex/documentation/1914')
| -rw-r--r-- | results/scraper/fex/documentation/1914 | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/results/scraper/fex/documentation/1914 b/results/scraper/fex/documentation/1914 new file mode 100644 index 000000000..8d85ec4f8 --- /dev/null +++ b/results/scraper/fex/documentation/1914 @@ -0,0 +1,18 @@ +Address Space Stealing +As part of #1885 a few ideas turned up + +We want to steal the address space first thing, before libc's _start, and also before the dynamic linker. + +Current ideas on how to get there +- Make a custom ld-linux replacement, ld-stealmem +- ld-stealmem should steal the address space (example: https://github.com/FEX-Emu/fex-assorted-tests-bins/blob/main/address-space-stealing/alloc.cpp) +- Implement our own mmap, munmap and put them in a section +- Use seccomp-bpf (test: https://github.com/FEX-Emu/fex-assorted-tests-bins/blob/main/seccomp/secccomp.c) to redirect to our internal mmap, munmap if the syscall doesn't come from our special section. Verified to work on x86_64 (ubuntu 22.04) and arm64 (ubuntu 20.04) +- Possibly make a virtual mmap flag to control host/guest mmaps +- Load the real ld-linux via our ELF loader (example: https://github.com/FEX-Emu/FEX/blob/main/Source/Tests/ELFCodeLoader2.h#L104) +- Modify the AT_ENTRYPOINT & friends 'as if' ld-linux was launched by the kernel +- destroy the stack frame and jump to ld-loader, which will load FEX +- (maybe for each thread?) make a je_malloc arena that is host-prefered +- provide host_malloc & friends + +We can also define virtual syscalls, or extend prctl to control `ld-stealmem` better \ No newline at end of file |