- Use
PTRACE_O_EXITKILLso the tracee process can't escape - Save/restore more state:
- Full set of x86 registers
- Signal handlers and signal mask
- Opened FDs
- Futex robust list (not very important)
- Multiple threads
- Initial stack:
- Ensure the stack is properly aligned
- Make the stack bigger
- Check that various inputs are unchanged at
restoretime:- File contents
- Inode numbers from
stat()andfstat() - UID, GID, etc.
- x86 segment selector registers (to be nit-picky)
- Save and replay output to stdout/stderr
- Ensure
restore's temporary mapping does not conflict with restored program - Check that syscalls are for the correct architecture (x86-64 not x86-32)
- Combine the two dump files into a single file
- Add an argument for the snapshot file; stop hard-coding the filename
- Make
ptracerrunelf_loaderautomatically
- Use
/proc/$PID/memto read memory instead ofptrace() - Don't write zero pages into the snapshot file
- De-duplicate filenames in the snapshot file
- Don't leave the
restoreprogram mapped at a fixed address
- Add a tool to examine a snapshot:
- Print mappings in the format of
/proc/$PID/maps - Show memory consumption
- Show what triggered producing the snapshot (e.g. the syscall we didn't handle)
- Print mappings in the format of