https://github.com/whitequark/unfork Skip to content Sign up * Why GitHub? Features - + Mobile - + Actions - + Codespaces - + Packages - + Security - + Code review - + Project management - + Integrations - + GitHub Sponsors - + Customer stories- * Team * Enterprise * Explore + Explore GitHub - Learn and contribute + Topics - + Collections - + Trending - + Learning Lab - + Open source guides - Connect with others + The ReadME Project - + Events - + Community forum - + GitHub Education - + GitHub Stars program - * Marketplace * Pricing Plans - + Compare plans - + Contact Sales - + Education - [ ] [search-key] * # In this repository All GitHub | Jump to | * No suggested jump to results * # In this repository All GitHub | Jump to | * # In this user All GitHub | Jump to | * # In this repository All GitHub | Jump to | Sign in Sign up {{ message }} whitequark / unfork * Notifications * Star 1.2k * Fork 34 unfork(2) is the inverse of fork(2). sort of. 0BSD License 1.2k stars 34 forks Star Notifications * Code * Pull requests 0 * Actions * Security * Insights More * Code * Pull requests * Actions * Security * Insights main Switch branches/tags [ ] Branches Tags Could not load branches Nothing to show {{ refName }} default View all branches Could not load tags Nothing to show {{ refName }} default View all tags 1 branch 0 tags Code Clone HTTPS GitHub CLI [https://github.com/w] Use Git or checkout with SVN using the web URL. [gh repo clone whiteq] Work fast with our official CLI. Learn more. * Open with GitHub Desktop * Download ZIP Launching GitHub Desktop If nothing happens, download GitHub Desktop and try again. Go back Launching GitHub Desktop If nothing happens, download GitHub Desktop and try again. Go back Launching Xcode If nothing happens, download Xcode and try again. Go back Launching Visual Studio Code Your codespace will open once ready. There was a problem preparing your codespace, please try again. Latest commit @lbatalha @whitequark lbatalha and whitequark Replace deprecated musl homepage URL ... cf95cd2 May 29, 2021 Replace deprecated musl homepage URL musl project has changed URLs: https://www.musl-libc.org/ -> https://musl.libc.org/ cf95cd2 Git stats * 22 commits Files Permalink Failed to load latest commit information. Type Name Latest commit message Commit time .gitignore Initial commit. Oct 29, 2019 LICENSE-0BSD.txt Initial commit. Oct 29, 2019 Makefile Split instrumentation and agent code. Oct 31, 2019 README.md Replace deprecated musl homepage URL May 29, 2021 agent.cc Split instrumentation and agent code. Oct 31, 2019 musl-gcc-32.specs Initial commit. Oct 29, 2019 musl-gcc-64.specs Initial commit. Oct 29, 2019 musl-no-vdso.patch Add musl vDSO patch for x86_64, too. Oct 30, 2019 unfork.cc Allow flushing dirty mappings. Oct 31, 2019 unfork.hh Allow flushing dirty mappings. Oct 31, 2019 View code unfork(2) Introduction Q: What the hell is this? Q: That doesn't explain a lot. Q: And doesn't sound very useful. Q: How would that even work? Q: Still, what do you actually need it for? Q: How limited is this approach? Q: Very interesting, thank you. Getting started License README.md unfork(2) Introduction Q: What the hell is this? A: The inverse of fork(2). Q: That doesn't explain a lot. A: Not really a question, but sure. fork(2) splits one process (really, address space) into two. unfork(2) joins two address spaces into one. Q: And doesn't sound very useful. A: More of a comment again. Think of this technique as taking a cheap snapshot of another application that you can read, write, execute, discard, repeat, all while leaving no [p]trace and sending no signal. Heh. Q: How would that even work? A: The magic of Linux! By combining userfaultfd with process_vm_readv , any userspace application can obtain a copy-on-write mapping (with some limitations) of memory it never owned. All it needs is ptrace privileges, which is to say, having the same uid usually works. Q: Still, what do you actually need it for? A: Dynamic binary analysis and instrumentation of applications with built-in integrity checks. As far as I know process_vm_readv isn't even detectable if the agent process is more privileged than the examinee process--so you're free to manipulate your private copy of the application in the comfort of your own address space. Q: How limited is this approach? A: It's true that meshing address spaces is much harder than copying them. Especially on 32-bit systems, the likelihood of a collision is high, and that's why everything is built using musl, which excels at producing compact, straightforward binaries that fit into the areas the kernel doesn't place anything into; 64-bit systems with ASLR are far more forgiving. Nevertheless, I think that with some effort two allocators or even dynamic linkers could survive together. In terms of functionality, you get virtual memory and TLS (TLS is everywhere!) but not, say, files or shared memory; at some point a kernel module would be necessary. On the platform support side, x86_64 and i386 seem to work well, and those two are also the most challenging ones. Q: Very interesting, thank you. A: You're welcome! Getting started Keep in mind that this repository is nothing more than a proof of concept. You'll need patched musl-gcc. (Using stock musl mostly works by accident on x86_64, but will usually crash on i386 without the patch.) After that, check the paths in the *.specs files, run make and it's done. The demo code uses puts as an entry point and prints two messages; the first one using a clean snapshot of another process, and the second one reusing the same snapshot. Any process that dynamically loads libc.so works, e.g. /bin/cat. Run ./unfork[32|64].elf $(pidof cat) and enjoy. Although puts may seem trivial, it involves a surprisingly deep call stack (well... in glibc), syscalls, TLS, vDSOs, and is probably more complicated than the kind of problems I originally set out to solve. License 0-clause BSD. About unfork(2) is the inverse of fork(2). sort of. Resources Readme License 0BSD License Contributors 2 * @whitequark whitequark whitequark * @lbatalha lbatalha Luis Batalha Languages * C++ 98.6% * Makefile 1.4% * (c) 2021 GitHub, Inc. * Terms * Privacy * Security * Status * Docs * Contact GitHub * Pricing * API * Training * Blog * About You can't perform that action at this time. You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session.