Okay, I think set up now so let's get started.
to.
Good morning everyone.
Let's go and get started.
So the plan for today is I'm going to assign one solutions are our least and.
And
so this is my plan today.
Yep, there.
So, it's there.
Go ahead and, you know, you're going to take a look but I'm not going to go over it out and answer questions about at the end. But we have more stuff to cover remember, we are sitting here at.
You know where the fifth, the midterm is in two weeks from today tutorial for just came out assignment to will come out tomorrow sometime. And so then you have a week to finish up the assignment.
Again the assignment is based on the two tutorials so if you spent your time on the tutorials you're in good shape.
And to assign a tutorial three is, I think kind of long tutorial for is much more straightforward
tutorial three question for
you.
We're definitely go through a trial three and we're going through tutorials.
you are if you email, the submissions have closed, if you want to ask for mercy email your TA. Your, your answers right now. So, so Okay.
Okay so, email it right now to your TA.
And then, you know, we can see what we can do. But yeah, So, um,
let's talk about so, yeah. So the one thing I hadn't really talked about was this, we're going to talk more about about this, this whole tutorial.
But let's first talk about.
So basically it comes down to GDP. Do I have.
Okay, let's do this. Oh, okay, I'm moving this. Come on. Goodness. Yes, perfect. Okay, I've got my two windows here.
Let's.
So let's let's play with GDP now.
So first off, there's something you need to do in order for it to play with GDP for things to work well.
There you will get an error, doing what I'm telling you to do, unless you become root, And then run this command.
So.
or.
so we put pound signs here this is just a comment.
So I've already done this here. And now what I'm going to do is run 3000 show.
So first off, I compiled this with missing a word I do my GCC.
So I compiled it to Mabel maximum debugging, adding a dash G, to enable full symbols, it makes the binary bigger but, you know, do that.
Sometimes people say that if you to enable debugging, don't enable optimizations. I find if you ever look at the low level thing.
Generally, things are actually exactly what you want with optimization so don't just add dash G.
Then you
compile was just G.
G.
What's.
Thank you, deep begin.
Okay.
Hold on.
Come in, come in
to come to dash. Oh and dash oh two, I believe are equivalent. I always use this dashboard.
The main thing is just enable some basic optimization because.
Yeah.
And then.
So now I have two windows into, into here. So what I've done is I SSH.
You know, I SSH twice.
Connecting to Windows, and one
snow.
Now we've got our files here
now.
there's lots of ways to find out what the processes.
So you'll see now we're running 2840.
So now we're running GDP.
And then we say attach.
Is there ever any reason not to run with Dasha when compiling
it used to be, because you wouldn't do it because it was faster.
But nowadays know me especially if you ever want to look at the assembler someone says, an optimized binaries are just gross. It just the C compiler just so many common sense things with it.
So I have 3000 shell here I have, I have this here.
And now, and not once you do this.
Once you type something it's going to freeze.
So.
So you notice that it's running.
OK, so now see I've got this now, it's running, and for example if I hit control see now in it. I've sent an interrupt GDP will catch this and you can see where coffee interrupt they can tell you where the code it was got it, you interrupted in the middle
of us read system calls so it's showing that you're in the C library here.
But
we instead can just come with it.
Yes.
So this program now is. Okay,
let's run this again.
Okay. Good. Great.
On.
Let's see what.
that was silly.
I'll go here. Okay 3000 show let's break on.
I'm
running run program
was telling me that it's there.
The echo command. So, the echo command is sorry.
If you try doing the attach operation, it will show you it will tell you what you, what file, you have to access.
So it actually explains it to you like, oh yeah there's a security mechanism that's got doing this.
So, so you have GDP here, we have this other window here. It's now. So now what we have is L if I type ls here. Every time I type ls, and now it's stopping at run program it's telling me the arguments and stuff and I get out.
And I can see what's going on. Now one thing cool is.
I can do this.
I can do to you I enable.
So, one thing cool now is we're now here in run program.
And we've got this pause and I can actually now step through it by typing next topic, and for next. So it saying p ID equals fork.
What will stay with the parent here.
So detaching after fork so notice. By default, we're going to be fought we're now following the parent, so no GDP will only follow.
Remember, Remember, set.
Follow mode.
I set up the event thank you Father for mode Yeah, thank you.
So, what's nice is.
So, we've got now this thing here we got follow, I said fall for quote child but we'll just, we'll just watch I'll just say continue and William say next we're already in the parents here.
And now it's doing this.
And now we're back at the prompt, we just say, continue.
So it's as continuing. Now do. ls again. And now again we're here. We've already set the follow mode for the next, next, and here now we see we're here.
Now, if I just hit end here. I will, it will go to the next line, but if I hit us here.
I'll now be inside find binary.
And then I can go next, and follow through an ad, you know, all these things and if I want to see what.
So, you see here when I say print P.
It then shows me that Oh look, it's a pointer here and oh it's pointing to the string.
So, so, so what's next. So, so next thing. So, continue yeah continue go till next year. Continue until next.
So, so net continue just continues on.
There's also x
variables.
Can you step out.
Yes you can, I forget all the, you know, yeah next step in line by line.
You can't do
run backwards.
There's some cool things that let you debug programs by going forward and backwards to the execution. That is not a standard debugger. It takes a lot of work to do that but there are some systems I'll let you do that, you can step out.
if you don't set a breakpoint. The program just continues as it goes.
I saw advanced option which is mixer.
You say attach pod.
Okay. Where do I say a touch.
Yeah. Can you hear
advance. I haven't tried advanced before I mean GDP has so many commands, and honestly I don't live in GDP much the time.
So, it's kind of thing I use it when I need to. And I've definitely used it for some pretty crazy things but then you forget about it. So it's, It's a very but it's a very powerful tool.
Are breakpoints by line numbers breakpoints can be set by.
So I can say a
point 112.
Yeah, be break point, so I can set, I can set a breakpoint here now on a specific line, or I can you know.
so.
So anyway so so here we can do we walk through it you can step through it and look at memory so you can you exactly what's going on.
We also say.
Okay, so let's just say, continue.
Okay, let's.
clear.
Yeah.
Good.
So,
okay, Oh yeah program run program Dillard defined. So what happened here,
even know what happened here. We started running LS, and so things acted very strange.
Specific Facebook. So what happened was is now we're so let's.
Okay, let's, where is
what process where we.
Okay.
So two. Okay, so we're saying attached to eight for OQI enable.
And we say,
breaking main, and I say continue.
And I can do. ls.
Okay so good. we're now we're still we're tracing everything here.
Oh,
I didn't set a breakpoint was not going to continue. Yeah.
I can do this.
Okay, so I can interrupt that great.
Oh, that's not what I want. Anyway, I'm breaking. Oh.
So, sorry I'm trying to remember how I how I follow sis calls. I'm console look in the chat.
There was something, showing how to catch to stop on system calls that Josh posted to one of the forums. Oh, yeah.
It's a, is it catch this call.
Okay.
Okay. Good.
So let's do this. So now. Oh says call read, okay. Continue.
So you can see now.
So now returned from Cisco read we say continue.
Call this this call clone, you say continue, continue called assist call wait for
returning from this call wait for calls this call right.
Okay.
For this call right.
So you can just so basically this is catch.
So.
So, what is the catch says a dress in without staying the location.
So what's so what's it saying here is.
So we saw in this this call right so we can continue here, it stops there. Now let's see where is it. So let's step.
So you can step with it.
Or we could say next.
Yeah, There we go. So next,
right so we'll get basically we're getting statements in the library right now.
Okay, fine. So we've typed the next.
So these are all basically we're going through lines in these functions in the library.
Think.
So this is where a breakpoint would be very helpful.
If you set a breakpoint somewhere that you can see where you are, but basically where we are in the code is right now we're in the prompt loop. We just did the F gas, so we're stuck in the code for F gas.
And we want to get out of it. So would have been great if we had set a breakpoint right here. And if we did. So he said he said main that we can look at set a breakpoint here then we could have caught it there.
So breakpoints you set them by doing be.
So, break.
267.
Good.
And now we say continue.
And now we get there.
Yep, so so idea so so basically now we're here, we're back in the prop loop we can see this year, and we can go see next
See next step into parse ours that work. Oh, yeah. So now we're breaking on clone.
We're breaking on all the system calls right now in here. So, Anyway, I'm going to stop here with GDP.
So.
So what I want to discuss now and this actually leads us into tutorial for is how does GDP work.
I remember we talked about.
So, it turns out the way these work it ask them.
It asked them.
So P trace
process trace the process trace system called provides a means by which one process that trace or may observe and control the execution of another process that Tracy and examine and change the Tracy's memory and registers.
So.
so P trace is a very powerful system, it's very useful for making tools like the buggers like GDP. It's also useful for doing things like s trays which shows system calls 11 calls mean, it's, it's a really useful thing for monitoring things and that's
we've been using p traits under the hood, a lot.
but p trace has a lot of limitations.
You really don't want to use anything with Pete right so as tres el trace. Um, GDP, doesn't matter you do not want to use these if someone actually cares about the program like if you're doing something at production, like sources, I know you could easily
crash the program.
Because you all have different structures, but I just want grammatically.
Yeah.
So once. So once they usually for, so.
that's basically what we do is we use debug programs.
So P trace is an old mechanism it's been around a Unix forever.
It's very powerful. But if you want to use in production.
It's painful but what if you know.
Answer soft tutorial for. Yeah.
But.
So, what we have today is a technology called EBPF.
It stands for enhanced.
Yes, yes, it's based on this technology called Berkeley packet filter.
There are no BPF tree scripts in the VM to do tutorial for a. Yes, there are. Ah, so.
Uh, yes there are. Ah, so. So if you. So,
here all the scripts.
Jacob. If you do not see these scripts.
You are not running, you're not running the 3000, you're not running the right VM. So you're going to need to create a new VM.
This was saying.
is this before after the bunch of installs at the beginning.
Um.
What do you mean this was, this is,
this is the VM that was created.
Why do we have three choices of VM with
William, what could use it. What do you mean by the three choices of VM.
There's only one for 2020 100 it's like a tutorial for okay so in tutorial for.
So let's go to tutorial for so the, everything is set up for BPF trace in the VM, except for one thing, and I messed it up.
And it's like I can't believe like.
This is not a problem. I anticipated.
What I was.
So the problem is, which is explained here is there's this this big section here uh getting setting up, run the right kernel. So what I give you instructions, it turns out that right now.
What you shouldn't be running is basically the generic kernel.
You need to be running the 511 generic Colonel. But if you look at the VM by default.
I was trying to be clever and trying to optimize space usage. So what didn't want to install a full generic Colonel because as support for a lot of hardware.
And that takes some extra space so I've been I was trying to optimize how much space it took up.
And I went with the KVM Colonel, and it has actually most of the VP of support but not all so BPF trace will kind of work, but certain things will break.
And it was like, I did a test was like yeah okay things work but no not so
your problems.
When you create an instance on OpenStack you have a choice of four different images.
There's lots of images but there's only one image from 2021.
Yeah, it's it's us, it's us installing the colonel.
The is there is there any difference in the Generic Girl On The KVM Colonel.
So basically the K VM Colonel, I think it's an oversight, but they've left out once particular option, I will talk about Colonel configurations later.
I don't want to. I didn't want to go into that right now. This is, but I will remember for next time this is my first time trying to teach with BPF trace, and of course there's been some glitch, because it's kind of a cutting edge tool.
But anyway, install the colonel, it'll work fine.
Yes, the generic just has much more main more drivers. That's the big thing but it's a different configuration and when they did it, they must anyway.
For this stuff to work reliably. Make sure you're running.
Okay, so
if you don't have this directory.
The user local share BPF trace tools, you don't have the right VM.
And in order for it to work you're going to have to install a number of things. So, don't do it, just create another VM, and throw away this one.
So, this is, this is what you want to do here.
Okay, so anyway, but let me show you what you can do here so I've got this stuff here.
What can.
So, EBPF based tools can see everything. So, yeah, it's very it's very cool, but with great power comes great responsibility so anyway let's let me show you some of the cool things you can do here.
So,
Let's do.
Yeah.
So I'm ready now exact Snoop here.
Now here I can type.
So you can see exactly what to notice now for all any program on the system might create another window.
Okay, so now.
Oh well, yeah.
So notice all the stuff that happened, like all these things programs were run when I logged in.
ls. So now, LS is over here. And notice it's not running, it's running LS with these colors, auto. That's how you gain the color so that's, that's how we're getting translated here.
Here.
So notice we're doing this for every process on the system, we're watching. Exactly.
Yep.
Is there a way to tell that you're using OpenStack right now.
Some time is basically for.
There is no time here was the time, it's a oh yes oh so title Yes, I guess you're right. What is that, yeah I guess it's the time since you started VP of choice Yeah exactly, That's what that column is.
And then the P ID and the arguments basically what was said.
It's, it's, it's kind of like PS a UX, except that it is showing you, every is showing you programs, as they are run as opposed to the programs that are running.
This is literally what so what's,
what is exactly. This is the code for exact sneak. This is YBPF trace is really cool because the scripts to do stuff with BPF trace are crazy short, and what you recently are doing is saying when you add a little thing here that says that event.
And then what you should do. So, here is when the program begins when the, that's a special event print this so this is how you get the header, you know line that it prints, and then it saying whenever you enter an exact system called well anything starting
with exact that's what the stars print F.
And then it gives this print off, and it has all the standard variables here, and then it just joined together all the command line arguments.
like these are all like if you look up, there's all these cool things that you'll get the BPM trace a reference there's all kinds of cool things for reporting of what's going on. So, so that's that.
And then, let's try doing, you know, DPF trace opens.
So now I'm just watching all the files that are being opened on the entire system.
Now, if I do an ls now you can see that. Oh look, all these opens happened of all these dynamic libraries, you know, and if I say top row looking at opening all these files because it's looking in, but you know every second, it's just reading.
You know, all these different things.
So you're getting a view of everything that's happening on the system.
So.
so, so then now I watch this. So you're just so I can do.
And now.
So the first command you type it won't trace it because it is in the middle of a read but now everyone else.
I have another I have another window here.
So here.
So again, it's the middle of a read it won't catch that one because it's only going to catch the one after you know as because it's, it's already in the system call and it's going to start at the beginning of the read, but.
But no, it's like jobs won't generate a system calls or.
But this will catch every command line, any bash on the system does.
So what does this mean for security I know effective the tool. but so this.
Yeah, yeah basically when your route. You can do almost anything to the system up.
Talk about route though it's a it's a very interesting thing because you can.
The story is more complicated than this but for first approximation we can do this.
But let's look here at.
So look, you rap prob.
So what does you read po pro means that when in the binary been bash when the read line function returns print this out.
So, we can monitor arbitrary functions in user space, and do things so we're going to play more with BPF trace, making things work in BPF trace can be kind of tricky.
I have to fiddle with things to get stuff working, but really, in this tutorial. All I want you to do is, is run certain tools, is I want you to play with opens new exacts new kill snoops discount battery like, Oh, I didn't show you discounts discounts
cool.
The bt files are scripts for BPF trace.
Windows has good tools but not quite this good.
Whoops.
That's not quite what I want to do.
But anyway, so like I'm just now. It's just doing stuff here now and if I just hit Control C.
And now it tells me top 10 system calls that were made.
You know, and the top 10 processes WPA supplicant is running. Whoa, that's annoying WPA, so you can definitely see things are like, Oh, why is this running because so SSH and made like hundred pages.
This is called PPF phrase made 185 so it's monitoring itself WPA supplicant is used for wireless security, and the VM has no need of wireless security so that but only made one system call so.
So top here, so top here means most frequent. So this is basically it's, it's given us the most used system calls.
So it's saying here system called to 54 was called 20 times system called nine was called 27 times and so called 13 was called at three times. Now you're wondering, what was the system call.
Remember, there's a header that tells you which says no calls which
are you required to know the numbers, definitely not.
No No, definitely not the most ones, and this one.
Yeah, this is it probably didn't actually sort this properly. So, so, yeah, I guess you'd have, you know that that's not it's a top 10 but it's not sorted so.
Oh no.
Oh yes it is sorted my goodness it's an ascending order.
No, it's the same. It's a 2027 3134, so the most used one was to 32. So what is to 32 so last.
Yes, these are the system call since you started this discount bt program and we get control See, it's just saying for however long it was running
is.
I will, I will post the.
I always forget which whichever it is.
Yes. And what is it attaching three probs me at the beginning of running the program. So, good question.
So, the way.
So let me give you a clue what I'm talking about here.
That's all.
I'll say you proves
it shows you the user space, it shows you the colonel functions.
These are all k probes are these are all Colonel functions, and the current all.
Let's see.
54,449, different possible pro points.
How is three probes enough for that number of pro plan so let's see if we can.
let's see I think I can see a dash B.
Yeah, so here
knows when you use a dash V, we can see that attaching trace point says call an open system, and are open at.
Same thing for
attaching trace point system under exactly he says enter exact VAT.
Or I think of attached again. So, so you got to begin. and then we get these two trace points.
So, three is isn't is.
So the dash D So, so.
GPS traces pretty magical, I don't care.
So,
this, so this is, it's just something, it's a tool to play with, to get you to understand what is going on on the system.
There's a lot of
a lot of stuff going on here.
So let me.
I'm going to ask you all something.
Let's, let's add a poll so we're going to call this.
Okay, so now let's go back to the polls and.
Are you able to write your own BPF trace scripts. Yes, you very much are, and in fact I'm going to try to get you the right ones.
Later, you're welcome to make your own BPF trace script up, but that's certainly not a requirement I'm not expecting to do that for the midterm I'm just expecting you play with the things I've showed you under the hood to show you.
There isn't much there, it's so me it's relatively simple I mean these are just four or five line programs that are just doing all these crazy things.
So, we know the syntax is for these things you have to do is, we give you a little sneak you know persnickety but it's not like you can't just keep iterating and trying it And the beautiful thing is it's very hard to mess your system up, it is almost
it i'm not saying it's impossible, but it is very very difficult to cause your system to crash with GDPR phase two tools, which is kind of extraordinary if you think about it.
Okay, great.
Okay, so I'm going to stop the.
I'm going to stop the poll now let's.
Okay share results.
Yeah, so if you, um,
So most of you seem to be
okay for
gaming hacks Yes, yes, yes good yeah yeah that's. You can you can do all kinds of things right you know exactly.
But, but yeah please try to answer but what I'm seeing now is a good half of you are seeing things as mysterious, you know, a third of you are, you know, kind of excited.
Yeah, you know, but then you know if some of you are came out and not clue.
That's about what I mean, I expect there to be some of you.
Hopefully the light bulb will go off when you start playing with it but it's very important to play with these tools and see what they give you, rather than
you know. But, so, Julian you know i'm not sure when you use it, um, you don't use the sort of tools, these are real power tools.
You wouldn't use them to sort of ordinarily but like if you're going, what the heck is this program doing, I don't know how you know what's going on with this thing.
And you needed to watch something in production of these, you know it's it's you know, it's nothing like it.
know,
I know Beatrice.
So BPF trace
BPM traces just one tool it's a very very cool tool but, No, it's a deep.
Yeah, yeah okay you're good.
it's all about observe ability.
So you see there you know like Redis envoy like you want to know what all these things are doing in the cloud.
They're using EVPF to give you a view of everything
is BPFO, a more secure way of doing p trace. Um,
it's a more secure more stable. Yes, but it can do things that P trace can do remember p trace can only monitor want you know, a specific process, and you have to have one process, watching another process, but with BPF trace you watch everything all
at once.
So it's much more efficient.
It's.
Yeah, it's crazy. So I'm very bullish on the VP of technology and I'm. This is my first time really trying to use it to teach operating systems.
I've included as like a module towards the end of class but if this is the earliest I've ever shown it in a run of this class and so I'm very curious to see what you all think of the tools, and whether it helps you understand what's going on.
So, so let me know.
Now, back to so in terms of material now so the 212 you've got that. So, so really the key to tutorial three is kind of the big thing tutorial for is really to help you understand what's going on, and things like tutorial three so
the things that you have to figure out, we're going to you know we have a few more classes before the midterm and where we have more to talk about but, like, understanding what's happening here.
When this.
When you run this like when you run p list.
What is this doing
so.
So let's go to.
So when I say I'm running through a shot and I do keyless.
Now, what is this doing mean this is listing every process on the system. How did it get its information. It looked in.
Do you know the question is, do you understand how this code, did that.
And that's part of understanding, oh to access a director we do opened her reader closed her.
And then how do we find out the information on the process is doing these opens and reading the contents of this column file.
And so, you know, then what's the single handle during we haven't talked as much about this, we're going to we're talking, you know, kind of go into more depth but everything is here, in this program.
So, if you don't have parts of this program with Delilah, what is that doing.
You should be trying to figure out what each line is doing and you now have the tools, like, you can ask me and I can try to explain it but a much better way for you to understand this is to use the tools at your disposal us as trace US GDP, or, you know,
to, you know, your walk through it step by step, or if you wind like like what the heck is that weight system call when is that happening, you can use about you potentially use things like you know BPF trace to watch when that happened now.
I don't think I have a weight weight watcher, but if you all have questions about specific BPM trace scripts you would like to see.
I will take requests.
So,
so can use BPF prison normal binaries or C files
BPF trays can run on any binary.
It can run on anything. Well, what so.
More specifically, a BPF tre script.
system.
What language the BPFK scripts written. It's its own language.
Show.
This is where's the homepage for trace that BPF
yeah here's the
here's the reference guide.
Here's a basic tutorial, don't want no one liners.
So.
So BPF trace is.
pf based tools, not at all.
There are the world of EBPF is much bigger and.
so is Python plus the site but not exactly sure.
Not exactly. Sure. So, there's I mean it's a big. It's a big world with GDPR.
Yeah, yeah. So, yes, we are going to do more with EBPF.
Because that's.
So we're gonna we're going to use a path to learn how the funnel works.
So.
Okay, so I've got five minutes left.
I'm happy I'm, I'm basically done for today I mean otherwise.
We're gonna do in five minutes, but I'm happy to answer any questions.
What, what is the form of the midterm, the midterm is going to look like the midterm looks like the assignments it's short answer, you know, fill out things um, but of course is time limited so can have you going off and doing crazy experiments.
Um, how do you know about how much overhead you're incurring with different programming languages jobs old garbage collector.
know if you're if you're if you're Vk Colonel is KVM, you do not have to throw it out. Just follow the directions in the tutorial. It tells you how to run the generic Colonel, all the V costumes are running the K VM Colonel.
That was a mess up for me. And frankly, I think it's a bug. I think they enabled all the options except one, which breaks. These BP BP BP of trace, because other BPF stuff works so it's DOM.
Yes, assignment to does still end on the 13th.
So why do you use attach.
But I want to explain attach, try, try running.
Try this. you'll see why we do attach,
you'll you'll notice try running.
Just try running it and you'll, you'll see why you really want to use.
The reason it's painful is because you're mixing stick input and output from two programs in one terminal, and that is just no so assignment to should be out tomorrow, so that you'll have, you'll have time to work on that.
So the 13th, the issue with the 13th.
The reason I needed to. I can't really change the deadlines much because we're running up on the midterm being on the 19th. So I want to go over solutions on the 14th.
The mentor so the midterm.
So the midterm is not proctored.
But I will be doing randomized and selected interviews after I'm.
the hard deadline is, is the same thing. I mean, basically, I will.
Yes, you can volunteer for end of year.
the midterm will be done through bright space.
explained to the problem. I've mentioned it, you know I tried to mention it here. Okay, we're out of time here sorry I gotta wrap things up let's do the interview is just going through your answers, the interviews, is not, I'm talking about
is the midterm format and like the assignments. Yes, exactly. That's part of the reason why I do it. So, Yeah.