Initial commit.

.gitignore

@@ -0,0 +1 @@
+*.elf

LICENSE-0BSD.txt

@@ -0,0 +1,12 @@
+Copyright (C) 2019 whitequark@whitequark.org
+
+Permission to use, copy, modify, and/or distribute this software for
+any purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN
+AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
+OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

Makefile

@@ -0,0 +1,20 @@
+NAME = unfork
+ALL = $(NAME)64.elf $(NAME)32.elf
+
+.PHONY: all clean
+all: $(ALL)
+clean:
+	rm -f $(ALL)
+
+CXX64 ?= gcc -specs musl-gcc-64.specs
+CXX32 ?= gcc -specs musl-gcc-32.specs
+CXXFLAGS += -std=c++14 -fno-exceptions -Wall -Wextra \
+	-pthread -static -Wl,-Ttext-segment,0x00100000 -g
+CXXFLAGS64 = -m64
+CXXFLAGS32 = -m32
+
+$(NAME)64.elf: $(NAME).cc
+	$(CXX64) $(CXXFLAGS64) $(CXXFLAGS) -o $@ $^
+
+$(NAME)32.elf: $(NAME).cc
+	$(CXX32) $(CXXFLAGS32) $(CXXFLAGS) -o $@ $^

README.md

@@ -0,0 +1,56 @@
+unfork(2)
+=========
+
+Introduction
+------------
+
+### Q: What the hell is this?
+
+**A:** The inverse of fork(2).
+
+### Q: That doesn't explain a lot.
+
+**A:** Not really a question, but sure. fork(2) splits one process (really, address space) into two. unfork(2) joins two address spaces into one.
+
+### Q: And doesn't sound very useful.
+
+**A:** More of a comment again. Think of this technique as taking a cheap snapshot of another application that you can read, write, execute, discard, repeat, all while leaving no <sub>p</sub>*trace* and sending no *signal*. Heh.
+
+### Q: How would that even work?
+
+**A:** The magic of Linux! By combining [`userfaultfd`][] with [`process_vm_readv`][], any userspace application can obtain a copy-on-write mapping (with some limitations) of memory it never owned. All it needs is ptrace privileges, which is to say, having the same uid usually works.
+
+[`userfaultfd`]: http://www.man7.org/linux/man-pages/man2/userfaultfd.2.html
+[`process_vm_readv`]: http://man7.org/linux/man-pages/man2/process_vm_readv.2.html
+
+### Q: Still, what do you actually need it for?
+
+**A:** Dynamic binary analysis and instrumentation of applications with built-in integrity checks. As far as I know `process_vm_readv` isn't even detectable if the agent process is more privileged than the examinee process—so you're free to manipulate your private copy of the application in the comfort of your own address space.
+
+### Q: How limited is this approach?
+
+**A:** It's true that meshing address spaces is much harder than copying them. Especially on 32-bit systems, the likelihood of a collision is high, and that's why everything is built using [musl][], which excels at producing compact, straightforward binaries that fit into the areas the kernel doesn't place anything into; 64-bit systems with ASLR are far more forgiving. Nevertheless, I think that with some effort two allocators or even dynamic linkers could survive together.
+
+In terms of functionality, you get virtual memory and [TLS](https://en.wikipedia.org/wiki/Thread-local_storage "Thread-Local Storage, not that socket thing") (TLS is everywhere!) but not, say, files or shared memory; at some point a kernel module would be necessary. On the platform support side, x86_64 and i386 seem to work well, and those two are also the most challenging ones.
+
+[musl]: https://www.musl-libc.org
+
+### Q: Very interesting, thank you.
+
+**A:** You're welcome!
+
+Getting started
+---------------
+
+Keep in mind that this repository is nothing more than a proof of concept.
+
+You'll need musl-gcc. Stock musl-gcc (mostly) works for x86_64, but to get i386 to behave, it's necessary to [patch](musl-i386-no-vdso.patch) musl. After that, check the paths in the `*.specs` files, run `make` and it's done.
+
+The demo code uses `puts` as an entry point and prints two messages; the first one using a clean snapshot of another process, and the second one reusing the same snapshot. Any process that dynamically loads `libc.so` works, e.g. `/bin/cat`. Run `./unfork[32|64].elf $(pidof cat)` and enjoy.
+
+Although `puts` may seem trivial, it involves a surprisingly deep call stack (well... in glibc), syscalls, TLS, vDSOs, and is probably more complicated than the kind of problems I originally set out to solve.
+
+License
+-------
+
+[0-clause BSD](LICENSE-0BSD.txt).

musl-gcc-32.specs

@@ -0,0 +1,32 @@
+%rename cpp_options old_cpp_options
+
+*cpp_options:
+-nostdinc -isystem /usr/local/i386-linux-musl/include -isystem include%s %(old_cpp_options)
+
+*cc1:
+%(cc1_cpu) -nostdinc -isystem /usr/local/i386-linux-musl/include -isystem include%s
+
+*link_libgcc:
+-L/usr/local/i386-linux-musl/lib/ -L .%s
+
+*libgcc:
+libgcc.a%s %:if-exists(libgcc_eh.a%s)
+
+*startfile:
+%{!shared: /usr/local/i386-linux-musl/lib/Scrt1.o} /usr/local/i386-linux-musl/lib/crti.o crtbeginS.o%s
+
+*endfile:
+crtendS.o%s /usr/local/i386-linux-musl/lib/crtn.o
+
+*link:
+-melf_i386 -dynamic-linker /lib/ld-musl-i386.so.1 -nostdlib %{shared:-shared} %{static:-static} %{rdynamic:-export-dynamic}
+
+*esp_link:
+
+
+*esp_options:
+
+
+*esp_cpp_options:
+
+

musl-gcc-64.specs

@@ -0,0 +1,32 @@
+%rename cpp_options old_cpp_options
+
+*cpp_options:
+-nostdinc -isystem /usr/local/x86_64-linux-musl/include -isystem include%s %(old_cpp_options)
+
+*cc1:
+%(cc1_cpu) -nostdinc -isystem /usr/local/x86_64-linux-musl/include -isystem include%s
+
+*link_libgcc:
+-L/usr/local/x86_64-linux-musl/lib -L .%s
+
+*libgcc:
+libgcc.a%s %:if-exists(libgcc_eh.a%s)
+
+*startfile:
+%{!shared: /usr/local/x86_64-linux-musl/lib/Scrt1.o} /usr/local/x86_64-linux-musl/lib/crti.o crtbeginS.o%s
+
+*endfile:
+crtendS.o%s /usr/local/x86_64-linux-musl/lib/crtn.o
+
+*link:
+-dynamic-linker /lib/ld-musl-x86_64.so.1 -nostdlib %{shared:-shared} %{static:-static} %{rdynamic:-export-dynamic}
+
+*esp_link:
+
+
+*esp_options:
+
+
+*esp_cpp_options:
+
+

musl-i386-no-vdso.patch

@@ -0,0 +1,38 @@
+diff --git a/arch/i386/syscall_arch.h b/arch/i386/syscall_arch.h
+index 22b0b28b..8f79ed81 100644
+--- a/arch/i386/syscall_arch.h
++++ b/arch/i386/syscall_arch.h
+@@ -3,7 +3,7 @@
+ ((union { long long ll; long l[2]; }){ .ll = x }).l[1]
+ #define __SYSCALL_LL_O(x) __SYSCALL_LL_E((x))
+
+-#if SYSCALL_NO_TLS
++#if 1 || SYSCALL_NO_TLS
+ #define SYSCALL_INSNS "int $128"
+ #else
+ #define SYSCALL_INSNS "call *%%gs:16"
+@@ -82,8 +82,8 @@ static inline long __syscall6(long n, long a1, long a2, long a3, long a4, long a
+ 	return __ret;
+ }
+
+-#define VDSO_USEFUL
+-#define VDSO_CGT_SYM "__vdso_clock_gettime"
+-#define VDSO_CGT_VER "LINUX_2.6"
++// #define VDSO_USEFUL
++// #define VDSO_CGT_SYM "__vdso_clock_gettime"
++// #define VDSO_CGT_VER "LINUX_2.6"
+
+ #define SYSCALL_USE_SOCKETCALL
+diff --git a/src/env/__libc_start_main.c b/src/env/__libc_start_main.c
+index 8fbe5262..48beb3a2 100644
+--- a/src/env/__libc_start_main.c
++++ b/src/env/__libc_start_main.c
+@@ -28,7 +28,7 @@ void __init_libc(char **envp, char *pn)
+ 	libc.auxv = auxv = (void *)(envp+i+1);
+ 	for (i=0; auxv[i]; i+=2) if (auxv[i]<AUX_CNT) aux[auxv[i]] = auxv[i+1];
+ 	__hwcap = aux[AT_HWCAP];
+-	if (aux[AT_SYSINFO]) __sysinfo = aux[AT_SYSINFO];
++	// if (aux[AT_SYSINFO]) __sysinfo = aux[AT_SYSINFO];
+ 	libc.page_size = aux[AT_PAGESZ];
+
+ 	if (!pn) pn = (void*)aux[AT_EXECFN];