Home

Awesome

MAMBO: A Low-Overhead Dynamic Binary Modification Tool for RISC architectures

News

Publications

MAMBO was created as part of Cosmin's EPSRC-funded PhD in the School of Computer Science at the University of Manchester. MAMBO has been previosly developed as part of the PAMELA EP/K008730/1 and DOME EP/J016330/1 EPSRC projects. MAMBO is currently supported by the UK Industrial Strategy Challenge Fund (ISCF) under the Digital Security by Design (DSbD) Programme delivered by UKRI as part of the MoatE (10017512) and Soteria (75243) projects.

Status

MAMBO's compatibility with applications is continuously being improved as needed. We are using it on ARMv7 and ARMv8 and RISC-V64GC systems. Our ARM systems run the armhf / arm64 builds of Debian, Ubuntu and Arch Linux ARM. Our RISC-V systems use Ubuntu 22.04 for RISC-V 64-bit. Most GNU/Linux applications work correctly. The following more complex applications and benchmark suites are working correctly under MAMBO on ARM systems (this is not an exhaustive list):

Also read the Known issues section below.

Build

Prerequisites: an ARM or RISC-V64GC system (physical or virtual) to build and run MAMBO on; dependencies: gcc toolchain, libelf(-dev), ruby (>=1.9.1). Debian or Ubuntu users can install the required packages with sudo apt-get install build-essential libelf-dev ruby.

git clone https://github.com/beehive-lab/mambo.git
cd mambo
make

Usage

To launch an application under MAMBO, run:

./dbm <path_to_executable> [application's command line arguments]

For example to run ls -a under MAMBO, execute:

./dbm /bin/ls -a

Tip: When an application running under MAMBO exits, the string We're done; exiting with status: <APPLICATION'S EXIT CODE> will be printed to stderr.

Plugin API

The plugin API is event-driven. Plugins should use an initialisation function with __attribute__((constructor)) to register themselves using mambo_register_plugin(). Once a plugin is registered, it can install callbacks for various events using the mambo_register_*_cb() functions. Callback-related functions are listed in api/plugin_support.h. Code generation helpers are listed in api/helpers.h and code generation functions are listed in api/emit_<INST SET>.h headers, which are generated at build-time).

Sample plugins are available in the plugins/ directory.

To build MAMBO with plugin support, the source code or object file(s) of the plugin you're trying to build must be added to the PLUGINS= line in the makefile, or provided as an argument/envvar. Note that multiple plugins can be enabled at the same time (and will work correctly if properly designed). For performance reasons, it is recommended to remove unused plugins from the PLUGINS= list. Additional arguments that are required to build the plugins can be provided through PLUGIN_ARGS.

Known issues

Reporting bugs

If you think you have found a bug which is not in the list of Known issues, please report it here, on Github. However, note that we have limited time available to investigate and fix bugs which are not affecting the workloads we are using. Therefore, if you can't pinpoint the cause of the bug yourself, we ask that you provide as many details on how to reproduce it, and preferably provide a statically linked executable which triggers it.

Contributions

We welcome contributions. Use pull requests on Github. However, note that we are doing most development in a private git tree and we are working on a number of features which are not quite ready for public release. Therefore, we would strongly encourage you to get in touch before starting to work on anything large, to avoid duplication of effort. We can probably expedite our release of any WIP features you might be interested in, if you do that.

Sandboxing

Note that similarly to most other DBM / DBI frameworks and to optimise performance / development effort, MAMBO is not designed to secure itself against malicious activity from the application it is translating. This means that without hardening MAMBO itself, it would not be possible to use it to implement a secure sandbox.