linux-kernel - Re: Any tracing mechanism can track the executed instructions of a user process in the kernel?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YW002dG2NebAMNlf@kroah.com>
Date:   Mon, 18 Oct 2021 10:48:25 +0200
From:   Greg KH <gregkh@...uxfoundation.org>
To:     Dongliang Mu <mudongliangabcd@...il.com>
Cc:     FMDF <fmdefrancesco@...il.com>,
        Pavel Skripkin <paskripkin@...il.com>,
        linux-kernel <linux-kernel@...r.kernel.org>,
        Dan Carpenter <dan.carpenter@...cle.com>,
        kernelnewbies <kernelnewbies@...nelnewbies.org>
Subject: Re: Any tracing mechanism can track the executed instructions of a
 user process in the kernel?

On Mon, Oct 18, 2021 at 04:41:14PM +0800, Dongliang Mu wrote:
> On Mon, Oct 18, 2021 at 4:07 PM FMDF <fmdefrancesco@...il.com> wrote:
> >
> > On Mon, 18 Oct 2021, 04:46 Dongliang Mu, <mudongliangabcd@...il.com> wrote:
> >>
> >> Hi all,
> >>
> >> I am writing to kindly ask one question: is there any tracing
> >> mechanism in Linux kernel that can trace all the executed instructions
> >> of a user process? If this user process is run on different
> >> processors, traces of this process on different processors should be
> >> also recorded.
> >
> >
> > You've not explained in detail what is the purpose of the tracing that you want to do. Missing this information I can only provide you a list of links to various tools and methods. Take a look by yourself and try to figure out what is better suited for your needs...
> 
> I want to log all the executed instructions of a user process (e.g.,
> poc.c in syzkaller) in the kernel mode and then would like to leverage
> backward analysis to capture the root cause of kernel panic/crash.
> 
> Therefore, I need the instruction-level tracing mechanisms or tools.

Then use a userspace debugger like gdb, that is what they are designed
for.

good luck!

greg k-h