{"id":13830868,"url":"https://github.com/srg-imperial/SaBRe","last_synced_at":"2025-07-09T13:30:30.643Z","repository":{"id":34960154,"uuid":"165082773","full_name":"srg-imperial/SaBRe","owner":"srg-imperial","description":"Load-time selective binary rewriting","archived":false,"fork":false,"pushed_at":"2022-08-26T17:16:40.000Z","size":584,"stargazers_count":152,"open_issues_count":5,"forks_count":16,"subscribers_count":10,"default_branch":"master","last_synced_at":"2024-11-20T12:45:51.162Z","etag":null,"topics":["binary-rewriting"],"latest_commit_sha":null,"homepage":null,"language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/srg-imperial.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2019-01-10T15:22:28.000Z","updated_at":"2024-10-23T06:56:54.000Z","dependencies_parsed_at":"2022-07-14T08:18:15.559Z","dependency_job_id":null,"html_url":"https://github.com/srg-imperial/SaBRe","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/srg-imperial/SaBRe","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/srg-imperial%2FSaBRe","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/srg-imperial%2FSaBRe/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/srg-imperial%2FSaBRe/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/srg-imperial%2FSaBRe/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/srg-imperial","download_url":"https://codeload.github.com/srg-imperial/SaBRe/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/srg-imperial%2FSaBRe/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":264467852,"owners_count":23612990,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["binary-rewriting"],"created_at":"2024-08-04T10:01:10.936Z","updated_at":"2025-07-09T13:30:30.227Z","avatar_url":"https://github.com/srg-imperial.png","language":"C","funding_links":[],"categories":["C"],"sub_categories":[],"readme":"# SaBRe 2.0\n\n[![Build Status](https://app.travis-ci.com/srg-imperial/SaBRe.svg?branch=master)](https://app.travis-ci.com/srg-imperial/SaBRe)\n\nSaBRe is a modular selective binary rewriter.\nIt is able to rewrite system calls, vDSO and named functions.\nWe currently support two architectures: `x86_64` and `RISC-V`.\nWe provide three plugins:\n\n* *sbr-id*: intercepts system calls but does not do any processing -- mainly aimed at testing\n* *sbr-trace*: a fast system-call tracer that mimics the original `strace` output\n* *sbr-scfuzzer*: a parametric fault injector to fuzz system calls\n\nSaBRe has two different system architectures. SaBRe 1.0 currently lives under [branch sabre_1.0](https://github.com/srg-imperial/SaBRe/tree/sabre_1.0) of this repo, while SaBRe 2.0 is the current main branch. For the differences between the two systems, look at section [SaBRe 1.0 vs 2.0](#sabre-10-vs-20). To learn more about the implementation details read our papers in [SaBRe research and papers](#sabre-research-and-papers).\n\n## Building SaBRe\n\n---\n\n### Quick start and requirements\n\nSaBRe execution does not rely on any third-party library.\nHowever, SaBRe requires `cmake`, `make` and `gcc` for building.\nTo quickly get started, run:\n\n```bash\ngit clone https://github.com/srg-imperial/SaBRe\ncd SaBRe\nmkdir build\ncd build\ncmake ..\nmake\n```\n\nThe executable will be located at `./sabre` assuming you are in the build\ndirectory you just created.\nThe compiled plugins will lie in separate subfolders under `plugins/`.\nFor instance, to run the `ls` command under the `sbr-trace` plugin:\n\n```bash\n./sabre plugins/sbr-trace/libsbr-trace.so -- /bin/ls\n```\n\n---\n\n### Compiling SaBRe executable\n\n`gcc` is recommended for compiling SaBRe.\nAlso the build system uses `cmake` and `make`.\nSo if you do not have them installed, use your package manager, e.g. for Debian/Ubuntu:\n\n```bash\nsudo apt install cmake make gcc\n```\n\nYou can [download a snapshot of the repository](https://github.com/srg-imperial/SaBRe/archive/master.zip) or clone it if you have `git` installed:\n\n```bash\ngit clone https://github.com/srg-imperial/SaBRe\n```\n\nThe following build instructions assume that you are currently in the top level directory\nof your copy of the SaBRe repository:\n\n```bash\ncd SaBRe\nmkdir build\ncd build\ncmake ..\nmake\n```\n\nThe sequel assumes the working directory is still `build/`.\nIf everything goes well, the executable will be located at `./sabre`.\n\n---\n\n### Running SaBRe\n\nThe general syntax to invoke SaBRe is:\n\n```bash\nSaBRe \u003cPLUGIN\u003e [\u003cPLUGIN_OPTIONS\u003e] -- \u003cCLIENT\u003e [\u003cCLIENT_OPTIONS\u003e]\n```\n\nBoth `PLUGIN` and `CLIENT` denote full paths to, respectively, the plugin library and the client program to be run under SaBRe.\nOnce built, plugin libraries are located in separate subfolders under `plugins/`.\nFor instance, the path to the `sbr-trace` library is: `plugins/sbr-trace/libsbr-trace.so`.\nAs a full working example, if you want to execute the `ls` command under the `sbr-trace` plugin, just run:\n\n```bash\n./sabre plugins/sbr-trace/libsbr-trace.so -- /bin/ls\n```\n\n---\n\n## How to debug in SaBRe\n\nWhen using GDB with SaBRe you will notice that when the execution has reached the plugin's or the client's code, GDB is not able to show neither symbols nor source code.\nTo fix this you will have to load `debug-tools/gdb-symbol-loader.py` in your GDB and then run the registered commands.\nSaBRe offers two helper commands:\n\n* `sbr-src`: Loads some paths for the source code of well known libraries like `libc` under Ubuntu 18.04.\n* `sbr-sym`: If provided with no arguments, it tries to load the symbols of some well know libraries that SaBRe is currently relocating (e.g. `libc`, `pthreads`, etc.). If strings are provided as arguments, we try to match those with the paths of libraries found in the maps of the running application and load their symbols. `sbr-sym` is using `add-symbol-file` under the hood and thus all restrictions and requirements apply.\n\n---\n\n## SaBRe 1.0 vs 2.0\n\nSaBRe is binary rewriter that loads a user provided plugin into the memory space of a client application. This plugin is called to handle the intercepted system calls or function calls of the client application. The main difference between SaBRe 1.0 and 2.0 is in *which* memory space the plugin lives and operates.\n\nUnder SaBRe 1.0 the plugin lives in the memory space of SaBRe. That gives the maximum possible isolation between memory management and called libraries between SaBRe and the client. For example, if you use `malloc` inside the plugin, the memory will be allocated inside the memory arenas of SaBRe, while in 2.0 the plugin uses the same infrastructure as the client. The same difference applies for libraries too. If you choose some `libc` alternative or different version to be loaded with your plugin, SaBRe 1.0 will keep your plugin dependencies separate from the client. SaBRe 2.0 blends the plugin with the dependencies of the underlying client, and thus the same libraries will be used.\n\nSaBRe 1.0 comes with some technical limitations though. Keeping this isolation between client and plugin is not an easy task. For example a custom allocator needs to be properly and carefully used. There are also some other restrictions with respect to multithreading and the TLS. There is currently a long discussion [here](https://github.com/srg-imperial/SaBRe/pull/54) that highlights some of these technical limitations and what effort is required from the plugin developer to overcome them.\n\nIf your priority is to maximise memory isolation and library interference, choose SaBRe 1.0. If you want to build complex application we recommend SaBRe 2.0.\n\n---\n\n## SaBRe research and papers\n\n* [The original paper on SaBRe 1.0](https://link.springer.com/content/pdf/10.1007/s10009-021-00644-w.pdf)\n* [SaBRe 1.0 limitation discussion](https://github.com/srg-imperial/SaBRe/pull/54)\n* [SaBRe 2.0 used in fuzzing](https://arxiv.org/abs/2201.04048)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsrg-imperial%2FSaBRe","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsrg-imperial%2FSaBRe","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsrg-imperial%2FSaBRe/lists"}