Automatically identify the initialization code blocks (i.e., functions or basic blocks)

[xjtuwxg]

We can use the tracer from the razor project. In that project, the tracer records a list of basic blocks that are executed (a CFG). Maybe we can extend it to find the initialization CFG and remove it.

[xjtuwxg]

I wrote a patch to DynamoRIO 9.0.0 to dump the code coverage based on execution phases. We can further use the tracediff.py to find a complete list of basic blocks that are only used in the initialization phase.

Currently, it works fine for single-process, single-thread applications. I need to spend more time understanding how DynamoRIO deals with multi-process applications.

I'm working on the CRIT tool to automatically remove the basic blocks by replacing the 1st instruction with int3.

[xjtuwxg]

Alright, I update the CRIT code a bit to automatically replace the 1st byte of each unused initialization BB with an int3. It seems there are a few BBs not identified by the 2nd phase, so when I remove the init BBs from the code analysis, it cannot continue execution. A similar situation happens for the original design.

See if the DynamoRIO author can give us some hints:
https://groups.google.com/g/dynamorio-users/c/C3-SYLtb6o8