Google has released the initial versions of tools designed to detect errors in the execution stage of applications compiled for X86-64 and ARM64 architectures. The tool, known as gwpsan, is implemented as a shared library that is linked when the application is launched using LD_PRELOAD. It utilizes mechanisms available in the Linux kernel, such as stopping mechanisms (Perf_type_breakpoint) and process monitoring. The code is written in C++ and is distributed under the Apache 2.0 license.
gwpsan is designed as a modular framework that supports the connection of modules with various error detection mechanisms. It performs dynamic analysis through signal handlers, eliminating the need to modify the application’s executable code. To effectively run most detectors, the application must be compiled with specific compiler flags and metadata. The tool requires at least Clang 18 and Linux 6.4 core to function.
Currently, three detectors are available:
- uar (use-fter-real): identifies errors related to object use in the stack after exiting the defining function. It intercepts the function’s entry and exit points to protect the stack by replacing it with a copy during function execution.
- tsan (Thread Sanitizer): detects data races where multiple threads access shared memory without proper synchronization. The protection is implemented using hardware breakpoints tied to memory regions, suspending thread execution temporarily to check for possible conflicts.
- Lmsan (Lightweight Memory Sanitizer): identifies memory access errors and is considered experimental, not recommended for general use.
GWPSAN analyzes executable code using the dynamorio framework to decode machine code into abstract ISA instructions. Emulation is then used to execute these instructions. Specific detectors tailored for certain instructions, such as memory access, are triggered during emulation phase through periodic timer signals to analyze and identify potential issues.