A CIL Tutorial - Department of Computer Science - ETH Zürich

Chapter 6
Overriding Functions
When performing a dynamic analysis, it happens frequently that we would like to intercept calls to
the C Library, or to system calls. We can accomplish this using the dynamic linker 1 .
Using the dynamic linker is preferable to using CIL to replace calls to these library functions.
If you use CIL, the call is only replaced in the code that CIL touches. Other code that is linked
into the program will use the original version. This will either have strange eects or render your
dynamic analysis unsound. Thus, if you want to override a library or system call, don't use CIL;
instead, use the dynamic linker as shown below.
6.1 tut6.ml
There's nothing going on here in the OCaml module corresponding to this tutorial because all of
the action happens in ciltut-lib/src/tut6.c.
6.2 Overriding Library Calls
Instead, we'll take this opportunity to discuss a few ways that overriding library calls can be useful.
• You can override pthread create to keep extra state for threads spawned by the application
you are analyzing.
• You can override malloc and friends to analyze and prole memory allocation.
• You can override system calls that request resources from the Operating System, like cores,
or memory, or I/O bandwidth, in order to shape the demands placed on the system.
• ...and many others.
1 Intercepting system calls can be a bit more complicated than intercepting library calls. Applications may directly
use the syscall system call instead of the C Library interface. Luckily, one may still wrap this call, with a bit more
work.
47