Add exec/execv/execve support #273

MrIndeciso · 2025-08-20T01:32:35Z

No description provided.

Pretty sure this isn't correct

…ingy

Copilot

Pull request overview

This PR adds initial support for exec/execve syscall interception and handling, building upon the existing multiprocessing/fork support. The changes include refactoring EventType from a class with string attributes to a proper Enum in a dedicated module, converting ResumeContext to a dataclass, and implementing exec event detection and cleanup handlers.

Key Changes:

Introduced a new EventType.EXEC enum member and moved EventType to a separate module (libdebug/data/event_type.py)
Implemented exec event handling that properly cleans up threads, breakpoints, syscall handlers, and signal catchers when a process calls exec
Added public API methods (hook_event, unhook_event, current_argv, current_path) to support event-driven debugging and inspection of process state after exec

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
`test/scripts/multiprocessing_test.py`	Updated multiprocessing tests to explicitly validate FORK events using the new EventType enum and resume_context
`test/scripts/exec_test.py`	Added new test file for exec functionality (currently contains only a placeholder test)
`test/scripts/__init__.py`	Imported and exposed the new `ExecTest` class
`test/run_suite.py`	Added `ExecTest` to the fast test suite
`newsfragments/273.feature.md`	Added changelog entry documenting the new exec support feature
`libdebug/state/resume_context.py`	Converted `ResumeContext` to a dataclass and moved `EventType` to a separate module; removed the nested EventType class definition
`libdebug/ptrace/ptrace_status_handler.py`	Added `_handle_exec` method and exec event case handler; updated FORK handling to include VFORK and set resume to False
`libdebug/debugger/internal_debugger.py`	Added event callback system (`hook_event`, `unhook_event`), event callback propagation to child processes, `clear_internal_state` method, and modified wait loop to execute event callbacks
`libdebug/debugger/debugger.py`	Exposed event hooking methods and added `current_argv`, `current_path`, and `resume_context` properties for runtime inspection
`libdebug/data/event_type.py`	New file defining `EventType` as an Enum with all event types including the new `EXEC` event

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

test/scripts/multiprocessing_test.py

libdebug/state/resume_context.py

test/scripts/multiprocessing_test.py

test/scripts/__init__.py

test/scripts/exec_test.py

MrIndeciso · 2025-11-24T21:07:09Z

@io-no I think we need the junior dev's opinion on this draft implementation, I think there's problems that we need to consider but I like the main idea of this.

libdebug/debugger/internal_debugger.py

io-no · 2025-11-29T02:14:48Z

libdebug/debugger/internal_debugger.py

+                continue
+
+            # We check if we have any event callbacks to execute
+            for event_type in list(self.resume_context.event_type.values()):


We should call this at each wait, no? Why just when we have an event w/o a callback? Also, I find it would be more coherent to have it in the manage_change flow

io-no · 2025-11-29T02:21:37Z

libdebug/ptrace/ptrace_status_handler.py

+                    self.forward_signal = False
+                    # We interrupt the process to allow the user to handle the exec event
+                    self.internal_debugger.resume_context.event_type[pid] = EventType.EXEC
+                    self.internal_debugger.resume_context.resume = False


Having False here as a fixed value is controversial. I mean, what's the point of having a callback on the exec/fork, so?

It is not coherent with the normal libdebug behaviour, where the hooks decide if something should stop or not the process. I see the point in having a default value when no hooks are registered, but the hooks must override this value. Also, I am not totally sure I want False as the default value (again, libdebug never stops the process if no hooks w/o callbacks are installed)

io-no · 2025-11-29T02:21:54Z

libdebug/ptrace/ptrace_status_handler.py

                        self.internal_debugger.set_child_debugger(message)
                    self.forward_signal = False
                    self.internal_debugger.resume_context.event_type[pid] = EventType.FORK
+                    self.internal_debugger.resume_context.resume = False


libdebug/state/resume_context.py

libdebug/data/event_type.py

libdebug/state/resume_context.py

io-no · 2025-11-29T02:29:01Z

Okay for the main idea. It seems coherent with the direction we discussed for event hooking (and what the pentester suggested to us).

libdebug/debugger/internal_debugger.py

…s neq

io-no · 2025-11-29T19:20:03Z

libdebug/debugger/internal_debugger.py

        if "_process_name" in self.__dict__:
            del self._process_name
+
+    def clear_internal_state(self: InternalDebugger) -> None:


you should clear also the new hooks

…eeded ones

…as first argument

…ort-exec

Now it shows up as a property, not a method

Now no behavior change even with the new event API

MrIndeciso · 2025-12-25T22:35:50Z

Things to think about:

entry/exit state of syscalls after fork/exec/clone

Copilot

Pull request overview

Copilot reviewed 16 out of 16 changed files in this pull request and generated 16 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

libdebug/debugger/internal_debugger.py

libdebug/debugger/debugger.py

libdebug/debugger/internal_debugger.py

libdebug/debugger/debugger.py

libdebug/debugger/internal_debugger.py

libdebug/debugger/debugger.py

libdebug/data/event_hook.py

test/scripts/__init__.py

Copilot

Pull request overview

Copilot reviewed 16 out of 16 changed files in this pull request and generated 6 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

test/scripts/exec_test.py

libdebug/debugger/internal_debugger.py

libdebug/ptrace/ptrace_status_handler.py

libdebug/debugger/debugger.py

libdebug/__init__.py

Onto writing tests next.

…y still cause CPU burning in some multiprocessing edge cases

Copilot

Pull request overview

Copilot reviewed 23 out of 23 changed files in this pull request and generated 8 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-05T15:35:48Z

libdebug/ptrace/ptrace_status_handler.py

-        elif signum == signal.SIGSTOP and self.internal_debugger.resume_context.force_interrupt:
-            # The user has requested an interrupt, we need to stop the process despite the ohter signals
+        elif signum == signal.SIGSTOP and self.internal_debugger.resume_context._force_interrupt:
+            # The user has requested an interrupt, we need to stop the process despite the other signals


There's a typo in the comment: "the user has requested an interrupt, we need to stop the process despite the ohter signals" should be "the user has requested an interrupt, we need to stop the process despite the other signals".

Copilot · 2026-01-05T15:35:49Z

libdebug/data/event_hook.py

+        hit_count (int): The number of times this event hook has been triggered.
+    """
+
+    event: EventType = field(default=None)


The default value for the 'event' field is set to None, which is inconsistent with the type annotation EventType. This could lead to issues when the event attribute is accessed before being properly initialized. Consider either removing the default value or using a sentinel value that aligns with the EventType enum.

Suggested change

event: EventType = field(default=None)

event: EventType

Copilot · 2026-01-05T15:35:49Z

libdebug/ptrace/native/libdebug_ptrace_binding.cpp

+                return (unsigned long)ip << 8 | TRAP_BRKPT;
+            }
+        } catch (...) {
+            // Could not read memory, just ignore IT


There's a typo in the comment: "Could not read memory, just ignore IT" should be "Could not read memory, just ignore it" (lowercase "it").

Suggested change

// Could not read memory, just ignore IT

// Could not read memory, just ignore it

Copilot · 2026-01-05T15:35:49Z

libdebug/ptrace/native/libdebug_ptrace_binding.cpp

+    }
+    // For other si_code values, we don't have extra info to return
+    else {
+        // Uknown si_code, return it as is


There's a typo in the comment: "Uknown si_code" should be "Unknown si_code".

Suggested change

// Uknown si_code, return it as is

// Unknown si_code, return it as is

Copilot · 2026-01-05T15:35:50Z

libdebug/data/event_hook.py

+    _internal_debugger: InternalDebugger = field(default=None, init=True, repr=False)
+


The default value for '_internal_debugger' is set to None with init=True, which means EventHook instances could be created with None as the internal debugger. This will cause AttributeError when any property is accessed (e.g., enabled, is_post_hook) since they all call self._internal_debugger._ensure_process_stopped(). Consider making this a required field without a default value, or add validation to ensure it's never None.

Suggested change

_internal_debugger: InternalDebugger = field(default=None, init=True, repr=False)

_internal_debugger: InternalDebugger = field(init=True, repr=False)

def __post_init__(self: "EventHook") -> None:

"""Validate internal debugger after dataclass initialization."""

if self._internal_debugger is None:

raise ValueError("_internal_debugger must not be None")

Copilot · 2026-01-05T15:35:50Z

libdebug/debugger/internal_debugger.py

+            def callback(_: ThreadContext, __: EventHook) -> None:
+                pass
+


The inner function 'callback' shadows the parameter 'callback' from the outer scope. When callback is True, this creates a new function with the same name, which then gets passed to EventHook. This works but is confusing and considered bad practice. Consider using a different variable name for the inner function, such as 'noop_callback' or 'default_callback'.

Suggested change

def callback(_: ThreadContext, __: EventHook) -> None:

pass

def default_callback(_: ThreadContext, __: EventHook) -> None:

pass

callback = default_callback

Copilot · 2026-01-05T15:35:51Z

libdebug/debugger/internal_debugger.py

+    @property
+    def stop_on_fork(self: InternalDebugger) -> bool:
+        """Get whether the debugger stops on fork events."""
+        return self._stop_on_fork
+
+    @stop_on_fork.setter
+    def stop_on_fork(self: InternalDebugger, value: bool) -> None:
+        """Set whether the debugger stops on fork events.
+
+        Args:
+            value (bool): True to stop on fork events, False otherwise.
+        """
+        self._stop_on_fork = value
+        if not value and self._stop_on_fork_hook:
+            self.unhook_event(self._stop_on_fork_hook)
+            self._stop_on_fork_hook = None
+        elif value and not self._stop_on_fork_hook:
+            self._stop_on_fork_hook = self.__set_stop_hook(EventType.FORK)
+
+    @property
+    def stop_on_exec(self: InternalDebugger) -> bool:
+        """Get whether the debugger stops on exec events."""
+        return self._stop_on_exec
+
+    @stop_on_exec.setter
+    def stop_on_exec(self: InternalDebugger, value: bool) -> None:
+        """Set whether the debugger stops on exec events.
+
+        Args:
+            value (bool): True to stop on exec events, False otherwise.
+        """
+        self._stop_on_exec = value
+        if not value and self._stop_on_exec_hook:
+            self.unhook_event(self._stop_on_exec_hook)
+            self._stop_on_exec_hook = None
+        elif value and not self._stop_on_exec_hook:
+            self._stop_on_exec_hook = self.__set_stop_hook(EventType.EXEC)
+
+    @property
+    def stop_on_clone(self: InternalDebugger) -> bool:
+        """Get whether the debugger stops on clone events."""
+        return self._stop_on_clone


The properties stop_on_fork, stop_on_exec, and stop_on_clone have getters that return self._stop_on_fork, self._stop_on_exec, and self._stop_on_clone respectively, but these attributes are never initialized in init. This causes AttributeError when _setup_utility_hooks() tries to read them (lines 353-358) if they haven't been set via the property setters first. Initialize these attributes to False in the init method to prevent this error.

MrIndeciso added 8 commits August 8, 2025 10:17

feat: add long-awaited support for execve in libdebug

f5636af

fix: remove breakpoints and all stopping events on execve

9680373

test: add empty test file for execve support

9c640e0

Merge branch 'main' into support-exec

0fd7d5b

chore: add PR #273 newsfragment

885c4dd

feat: implement exec support and event handling

657128f

Pretty sure this isn't correct

test: change multiprocessing tests according to new fork behavior

61ffaf1

test: fix remaining multiprocessing tests after new event handling th…

5bf3833

…ingy

MrIndeciso requested a review from Copilot November 24, 2025 16:19

Copilot started reviewing on behalf of MrIndeciso November 24, 2025 16:19 View session

Copilot finished reviewing on behalf of MrIndeciso November 24, 2025 16:24

Copilot AI reviewed Nov 24, 2025

View reviewed changes

fix: correct EventType refactor-related things

59ea0b8

MrIndeciso requested a review from io-no November 24, 2025 21:06

fix: add missing decorators in InternalDebugger

35e8e89

io-no requested changes Nov 29, 2025

View reviewed changes

Merge branch 'main' into support-exec

fbcff97

io-no reviewed Nov 29, 2025

View reviewed changes

libdebug/debugger/internal_debugger.py Outdated Show resolved Hide resolved

fix: expose ResumeContext and EventType for easy import, add dataclas…

6fdd3e4

…s neq

io-no reviewed Nov 29, 2025

View reviewed changes

MrIndeciso and others added 5 commits November 29, 2025 13:21

style: document ResumeContext members, hide internal ones, remove unn…

4f71edd

…eeded ones

fix: allow overriding of event hooks

4a8e33d

fix: hooked events now pass the debugger, not the internal debugger, …

5603a57

…as first argument

Merge branch 'support-exec' of github.com:libdebug/libdebug into supp…

5255038

…ort-exec

fix: refresh the mem if fast memory is enabled

657c370

io-no mentioned this pull request Dec 5, 2025

Fix race on fatal signals #294

Draft

MrIndeciso added 2 commits December 24, 2025 18:33

Merge branch 'main' into support-exec

a9b8383

refactor: cleanup dead code and unneeded checks in ptrace_status_handler

28c323c

MrIndeciso added 5 commits December 25, 2025 19:30

fix: correct typing for check_aliased_property

2e5073e

Now it shows up as a property, not a method

feat: add fully-fledged event hooks, with support for pre/post hooking

c47f344

test: change multiprocessing_test to support new fork behavior

82b60c1

Now no behavior change even with the new event API

feat: add builtin hook stops for fork/exec/clone

706d110

fix: clear event hooks on exec

6da6d08

MrIndeciso requested a review from Copilot December 25, 2025 22:34

Copilot started reviewing on behalf of MrIndeciso December 25, 2025 22:35 View session

Copilot AI reviewed Dec 25, 2025

View reviewed changes

fix: CoPilot caught all of my skill issues, very nice

0731741

MrIndeciso requested a review from Copilot December 25, 2025 22:48

Copilot started reviewing on behalf of MrIndeciso December 25, 2025 22:49 View session

Copilot AI reviewed Dec 25, 2025

View reviewed changes

MrIndeciso and others added 6 commits December 26, 2025 00:02

fix: CoPilot caught all of my skill issues, very nice (pt. 2)

d5b6341

Onto writing tests next.

perf: avoid burning CPU during wait using WNOWAIT and P_PGID. This ma…

61fa07c

…y still cause CPU burning in some multiprocessing edge cases

feat: finally implement correct reporting of SIGTRAP stop events

171dfd9

test: fix watchpoint test for amd64

c9f8b0d

feat: move some of the bp detection logic to the native binding

8dd1465

test: fix watchpoint test for i386

dffdd10

MrIndeciso force-pushed the support-exec branch 3 times, most recently from df554e4 to 38cd949 Compare December 29, 2025 15:19

fix: do not decrement IP on BRK for aarch64

732919d

MrIndeciso force-pushed the support-exec branch from 38cd949 to 732919d Compare January 5, 2026 14:22

MrIndeciso requested a review from Copilot January 5, 2026 15:30

Copilot started reviewing on behalf of MrIndeciso January 5, 2026 15:31 View session

Copilot AI reviewed Jan 5, 2026

View reviewed changes

	// Could not read memory, just ignore IT
	// Could not read memory, just ignore it

	// Uknown si_code, return it as is
	// Unknown si_code, return it as is

		_internal_debugger: InternalDebugger = field(default=None, init=True, repr=False)

-    _internal_debugger: InternalDebugger = field(default=None, init=True, repr=False)
+    _internal_debugger: InternalDebugger = field(init=True, repr=False)
+    def __post_init__(self: "EventHook") -> None:
+        """Validate internal debugger after dataclass initialization."""
+        if self._internal_debugger is None:
+            raise ValueError("_internal_debugger must not be None")

-            def callback(_: ThreadContext, __: EventHook) -> None:
-                pass
+            def default_callback(_: ThreadContext, __: EventHook) -> None:
+                pass
+            callback = default_callback

Uh oh!

Add exec/execv/execve support #273

Are you sure you want to change the base?

Add exec/execv/execve support #273

Uh oh!

Conversation

MrIndeciso commented Aug 20, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

MrIndeciso commented Nov 24, 2025

Uh oh!

Uh oh!

io-no Nov 29, 2025

Choose a reason for hiding this comment

Uh oh!

io-no Nov 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

io-no Nov 29, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

io-no commented Nov 29, 2025

Uh oh!

Uh oh!

io-no Nov 29, 2025

Choose a reason for hiding this comment

Uh oh!

MrIndeciso commented Dec 25, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 5, 2026

io-no Nov 29, 2025 •

edited

Loading