{"action":"closed","issue":{"url":"https://api.github.com/repos/rodionovd/cuckoo-osx-analyzer/issues/25","labels_url":"https://api.github.com/repos/rodionovd/cuckoo-osx-analyzer/issues/25/labels{/name}","comments_url":"https://api.github.com/repos/rodionovd/cuckoo-osx-analyzer/issues/25/comments","events_url":"https://api.github.com/repos/rodionovd/cuckoo-osx-analyzer/issues/25/events","html_url":"https://github.com/rodionovd/cuckoo-osx-analyzer/issues/25","id":95804656,"number":25,"title":"Tracing calls to APIs from libraries loaded at runtime","user":{"login":"rodionovd","id":5719520,"avatar_url":"https://avatars.githubusercontent.com/u/5719520?v=3","gravatar_id":"","url":"https://api.github.com/users/rodionovd","html_url":"https://github.com/rodionovd","followers_url":"https://api.github.com/users/rodionovd/followers","following_url":"https://api.github.com/users/rodionovd/following{/other_user}","gists_url":"https://api.github.com/users/rodionovd/gists{/gist_id}","starred_url":"https://api.github.com/users/rodionovd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rodionovd/subscriptions","organizations_url":"https://api.github.com/users/rodionovd/orgs","repos_url":"https://api.github.com/users/rodionovd/repos","events_url":"https://api.github.com/users/rodionovd/events{/privacy}","received_events_url":"https://api.github.com/users/rodionovd/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rodionovd/cuckoo-osx-analyzer/labels/dtrace","name":"dtrace","color":"c7def8"},{"url":"https://api.github.com/repos/rodionovd/cuckoo-osx-analyzer/labels/musthave","name":"musthave","color":"0052cc"}],"state":"closed","locked":false,"assignee":{"login":"rodionovd","id":5719520,"avatar_url":"https://avatars.githubusercontent.com/u/5719520?v=3","gravatar_id":"","url":"https://api.github.com/users/rodionovd","html_url":"https://github.com/rodionovd","followers_url":"https://api.github.com/users/rodionovd/followers","following_url":"https://api.github.com/users/rodionovd/following{/other_user}","gists_url":"https://api.github.com/users/rodionovd/gists{/gist_id}","starred_url":"https://api.github.com/users/rodionovd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rodionovd/subscriptions","organizations_url":"https://api.github.com/users/rodionovd/orgs","repos_url":"https://api.github.com/users/rodionovd/repos","events_url":"https://api.github.com/users/rodionovd/events{/privacy}","received_events_url":"https://api.github.com/users/rodionovd/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/rodionovd/cuckoo-osx-analyzer/milestones/2","html_url":"https://github.com/rodionovd/cuckoo-osx-analyzer/milestones/end-term","labels_url":"https://api.github.com/repos/rodionovd/cuckoo-osx-analyzer/milestones/2/labels","id":1100672,"number":2,"title":"end-term","description":"GSoC final evaluations deadline","creator":{"login":"rodionovd","id":5719520,"avatar_url":"https://avatars.githubusercontent.com/u/5719520?v=3","gravatar_id":"","url":"https://api.github.com/users/rodionovd","html_url":"https://github.com/rodionovd","followers_url":"https://api.github.com/users/rodionovd/followers","following_url":"https://api.github.com/users/rodionovd/following{/other_user}","gists_url":"https://api.github.com/users/rodionovd/gists{/gist_id}","starred_url":"https://api.github.com/users/rodionovd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rodionovd/subscriptions","organizations_url":"https://api.github.com/users/rodionovd/orgs","repos_url":"https://api.github.com/users/rodionovd/repos","events_url":"https://api.github.com/users/rodionovd/events{/privacy}","received_events_url":"https://api.github.com/users/rodionovd/received_events","type":"User","site_admin":false},"open_issues":2,"closed_issues":9,"state":"open","created_at":"2015-05-07T18:03:45Z","updated_at":"2015-07-18T13:39:52Z","due_on":"2015-08-24T19:00:00Z","closed_at":null},"comments":1,"created_at":"2015-07-18T08:44:34Z","updated_at":"2015-07-18T13:39:52Z","closed_at":"2015-07-18T13:39:52Z","body":"The problem is that `dtrace/pid` can't enable probes on functions that haven't been loaded on program startup. Which basically means that if a target process loads a library at runtime (e.g. via `dlopen()`), we won't be able to install probes on any symbol from this library.\r\n\r\n\r\n#### Demo\r\n\r\n```c\r\n// clang -o demo demo.c\r\n#include <dlfcn.h>\r\nint main(int argc, char const *argv[])\r\n{\r\n    void *h = dlopen(\"/usr/lib/libThaiTokenizer.dylib\", RTLD_NOW);\r\n    int (*isThai)(int) = dlsym(h, \"isThai\");;\r\n    int x = isThai(123);\r\n    return 0;\r\n}\r\n```\r\nCompile and try attaching `dtrace` to it: \r\n```bash\r\nsudo dtrace -n \"pid$target::isThai:entry { printf(\\\"isThai()\\\"); }\" -c ./demo\r\n```\r\nThe following error will occur:\r\n```\r\ndtrace: invalid probe specifier pid::isThai:entry { printf(\"isThai()\"); }: probe description pid::isThai:entry does not match any probes\r\n```"}}