Translate C++/Rust type into C type with the same memory layout

盏一

Last update: Nov 17, 2022

Related tags

Overview

clayout, translate C++/Rust type into C type with the same memory layout. Generally, clayout is used together with bpftrace.

clayout is developed on ddbug. THANKS FOR ddbug!

Usage

Imagine a scenario where you want to use bpftrace to track the value of S::x during the running of the following program.

#include <stdio.h>
#include <unistd.h>

struct X {
  virtual ~X() {}

  int x1;
};

struct S : public X {
  S() : x(0) {}

  S(const S &other) : x(other.x) {}

  S f(int y, int z) {
    printf("output from a.out: this.x=%d y=%d z=%d\n", x, y, z);
    x += (y + z);
    return *this;
  }

  int x;
};

int main(int argc, char **argv) {
  S s;
  int i = 0;
  while (1) {
    s.f(i, i);
    ++i;
    sleep(1);
    // break;
  }
  return 0;
}

clayout can translate S into a C structure with the same memory layout:

# clayout will generate struct.h, struct.c
$ clayout -i ${binary path} -o struct S

// struct.h
// Generated by hidva/clayout! 大吉大利!
#pragma once
#include <linux/types.h>
struct HidvaStruct2 {
  void** __mem1;
  int x1;
} __attribute__((__packed__));


struct S {
  struct HidvaStruct2 __parent0;
  int x;
} __attribute__((__packed__));

So you can easily write the following bpftrace script:

#include "struct.h"

u:/apsara/zhanyi.ww/tmp/bphtrace/x/trace:_ZN1S1fEii {
  printf("output from bpftrace: ret=%p this.x=%d y=%d z=%d\n", (int32*)arg0, ((struct S*)arg1)->x, arg2, arg3)
}

$ bpftrace  -c ./trace t.bt
Attaching 1 probe...
output from a.out: this.x=0 y=0 z=0
output from bpftrace: ret=0x7ffff3044610 this.x=0 y=0 z=0
output from a.out: this.x=0 y=1 z=1
output from bpftrace: ret=0x7ffff3044610 this.x=0 y=1 z=1

Please note that you may intuitively think that the layout of S is as follows:

struct X {
  void** __mem1;
  int x1;
}

struct S {
  struct X __parent0;
  int x;
}

But actually it is wrong! S::x will reuse the padding part of X in C++!

multi input

clayout supports multiple input files, and type references across files.

// x.h
struct X {
  virtual ~X();

  int x1;
};

struct S : public X {
  S();

  S(const S &other);

  S f(int y, int z);

  int x;
};

// X.cc
#include <stdio.h>
#include "x.h"

X::~X() {}

S::S(): x(0) {}

S::S(const S &other) : x(other.x) {}

S S::f(int y, int z) {
  printf("output from a.out: this.x=%d y=%d z=%d\n", x, y, z);
  x += (y + z);
  return *this;
}

// trace.cc
#include <unistd.h>
#include "x.h"

int main(int argc, char **argv) {
  S s;
  int i = 0;
  while (1) {
    s.f(i, i);
    ++i;
    sleep(1);
  }
  return 0;
}

$ clang++ -fPIC -shared -g -O0 X.cc -o libzh_x.so
$ clang++ -g -O0 trace.cc -o trace -L. -lzh_x

Because of -fstandalone-debug, the trace binary file does not contain any debugging information of X:

$ readelf --debug-dump=info trace
 <1><fc>: Abbrev Number: 13 (DW_TAG_structure_type)
    <fd>   DW_AT_name        : X
    <ff>   DW_AT_declaration : 1

Because there is no debugging information of X in the trace binary file, a placeholder __u8 __unknown_type1[12] is used.

$ clayout -i trace -o output S

// output.h
// Generated by hidva/clayout! 大吉大利!
#pragma once
#include <linux/types.h>

struct S {
  __u8 __unknown_type1[12];
  int x;
} __attribute__((__packed__));

We can use multi input file to get the detail of X:

$ clayout -i trace -i libzh_x.so -o output S

// output.h
// Generated by hidva/clayout! 大吉大利!
#pragma once
#include <linux/types.h>
struct HidvaStruct2 {
  void** __mem1;
  int x1;
} __attribute__((__packed__));


struct S {
  struct HidvaStruct2 __parent0;
  int x;
} __attribute__((__packed__));

You might also like...

High-performance QEMU memory and instruction tracing

Cannoli Cannoli is a high-performance tracing engine for qemu-user. It can record a trace of both PCs executed, as well as memory operations. It consi

412 Oct 18, 2023

Mononym is a library for creating unique type-level names for each value in Rust.

52 Dec 16, 2022

CBOR (binary JSON) for Rust with automatic type based decoding and encoding.

THIS PROJECT IS UNMAINTAINED. USE serde_cbor INSTEAD. This crate provides an implementation of RFC 7049, which specifies Concise Binary Object Represe

121 Dec 27, 2022

Error context library with support for type-erased sources and backtraces, targeting full support of all features on stable Rust

Error context library with support for type-erased sources and backtraces, targeting full support of all features on stable Rust, and with an eye towards serializing runtime errors using serde.

1 Feb 12, 2022

Comments

pretty type name

union u {
	long u_l;
	char u_c;
	long u_b: 2;
	S1 s1;
};

will be translated to

struct HidvaStruct1 {  // #2
  long int l;
  char ch;
} __attribute__((__packed__));


// tyidx=TypeIndex { input_id: 0, typoff: TypeOffset(92) } tyname=::u
union HidvaUnion3 {  // #1
  long int u_l;
  char u_c;
  __u8 __bitfield0[1];  
  struct HidvaStruct1 s1;  // #2
  __u8 __HIDVA_dont_use2[16];
} __attribute__((__packed__));

opened by hidva 0

duplicate type debuginfo

// tyname=::std::_Rb_tree_node_base tyidx=TypeIndex { input_id: 0, typoff: TypeOffset(60984357) }
// tyname=::std::_Rb_tree_node_base tyidx=TypeIndex { input_id: 0, typoff: TypeOffset(28125307) }
// tyname=::std::_Rb_tree_node_base tyidx=TypeIndex { input_id: 0, typoff: TypeOffset(69763994) }
// tyname=::std::_Rb_tree_node_base tyidx=TypeIndex { input_id: 0, typoff: TypeOffset(22768814) }
// tyname=::std::_Rb_tree_node_base tyidx=TypeIndex { input_id: 0, typoff: TypeOffset(56430823) }
// tyname=::std::_Rb_tree_node_base tyidx=TypeIndex { input_id: 0, typoff: TypeOffset(31413305) }

$ grep -F 'char_Array16' 12.h  |grep -F typedef
typedef char char_Array16[16];
typedef char char_Array16_1[16];
typedef char char_Array16_2[16];
typedef char char_Array16_3[16];
typedef char char_Array16_4[16];
typedef char char_Array16_5[16];
typedef char char_Array16_6[16];
typedef char char_Array16_7[16];
typedef char char_Array16_8[16];
typedef char char_Array16_9[16];
typedef char char_Array16_10[16];
typedef char char_Array16_11[16];
typedef char char_Array16_12[16];

opened by hidva 0

bitfield support

union u {
	long u_l;
	char u_c;
	long u_b: 2;
	S1 s1;
};

will be translated to:

union HidvaUnion3 {
  long int u_l;
  char u_c;
  __u8 __bitfield0[1];   // #1
  struct HidvaStruct1 s1;
  __u8 __HIDVA_dont_use2[16];
} __attribute__((__packed__));

opened by hidva 0

Translate C++/Rust type into C type with the same memory layout

Related tags

Overview

Usage

multi input

You might also like...

High-performance QEMU memory and instruction tracing

Mononym is a library for creating unique type-level names for each value in Rust.

CBOR (binary JSON) for Rust with automatic type based decoding and encoding.

Error context library with support for type-erased sources and backtraces, targeting full support of all features on stable Rust

An annotated string type in Rust, made up of string slices

A tuple crate for Rust, which introduces a tuple type represented in recusive form.

Type-check non-existing `Phantom` code for Fun And Profit

Type-safe IPC for Tauri using GraphQL

The most fundamental type for async synchronization: an intrusive linked list of futures

Comments

pretty type name

duplicate type debuginfo

bitfield support

Owner

盏一

A memory efficient immutable string type that can store up to 24* bytes on the stack

Rust binding of fortran Limited memory LBFGS subroutine

This crate allows writing a struct in Rust and have it derive a struct of arrays layed out in memory according to the arrow format.

A rust library that makes reading and writing memory of the Dolphin emulator easier.

A memory visualizer in Rust (ptrace + userfaultfd)

bustd is a lightweight process killer daemon for out-of-memory scenarios for Linux!

A memory profiler for Linux.

messloc is a drop in replacement for malloc that can transparently recover from memory fragmentation without any changes to application code.

Allocscope - a memory tracking tool

A memory-based evasion technique which makes shellcode invisible from process start to end.