Method Call Interception (MCI) in C++

Introduction

Method Call Interception (MCI) is the technique of intercepting methods, and performing certain extra, specified, operations before / instead of / after the called method. MCI while not the same as Aspect Oriented Programming is the most common technique, used to implement AOP. As such MCI is often used for

  1. Tracing
  2. Code Profiling
  3. Transaction management
  4. Thread safety (locking)

By going in for MCI, one can re-factor code by separating out core business logic, from infrastructure goop. There are several interesting articles / blogs / papers on AOP and MCI, a few of which are

  1. Semantics of method call interception (http://homepages.cwi.nl/~ralf/smci/)
  2. XEROX Parc SDA (http://www2.parc.com/csl/groups/sda/publications.shtml)
  3. AOP != Interception (http://www.neward.net/ted/weblog/index.jsp?date=20030107)
  4. AOSD Homepage (www.aosd.net)
  5. AOP with .Net (http://www.c-sharpcorner.com/Code/2002/Nov/aop.asp)

All these articles / blogs / papers while discussing AOP and MCI implementations, do so in the context of interpreted languages, supported by beefy runtimes. And this is because implementing MCI for an interpreted language is trivial (interpreted code is usually loaded into data pages, and can be re-written at run time to include forwarding calls).

However, when it comes to compiled code from a programming language like C++, things are not so easy, because compiled code is moved into code pages, which cannot be written. So, if the call is to be intercepted, the source code must be changed, to include a call before and after the method. This technique is discussed at bAspect Oriented programming and C++ at

(http://www.ddj.com/documents/s=9220/ddj0408h/0408h.html).

While this method is definitely straight forward, it also requires that you modify existing code in order to fit in MCI. Which I feel once again violates one of the basic principles of AOP - core logic code should not be mixed with infrastructure goop.

An alternate Solution

An alternate approach would be to make use of compiler specific extensions /switches -in the case of VC++, the /GH and /Gh switches. More information on these switches can be found at

(http://msdn.microsoft.com/library/default.asp?url=/library/en-us/vccore/html/_core_.2f.gh.asp) and

(http://msdn2.microsoft.com/en-US/library/xc11y76y.aspx)

The approach basically, is to generate function prologues and epilogues and bake in a call to _penter and _pexit. Within these two functions, we make use of the symbol debugging APIs present in dbghlp.dll to get details about the function, and then forward it to any interested listeners. (dbghelp.dll is provided by Microsoft as part of the debugging tools for widows. This is available at

http://www.microsoft.com/whdc/devtools/debugging/default.mspx

for free)

Problem Statement

Quickly summarizing our objectives - Given a particular application source (core logic code), intercept all method calls in the core logic code (with an interceptor), and forward details of the call to some arbitrary code (any interested listeners).

The problem can be split into four parts

  1. Locating and loading interested listeners
  2. Intercepting method calls
  3. Retrieving information about the called method
  4. Passing this information on to any interested listeners.

Overview of the proposed Solution

There are three main entities

  1. Core Code : The main application source
  2. Interceptor - The mechanism to intercept method calls
  3. Listener - The observer, who is to be notified of method calls

  1. Core Code : The core code need not be modified. It will however, need to be re-built using the /GH and /Gh switches, while linking dynamically to the _penter and _pexit functions exported from the Interceptor. (The /GH is not available in MS VC++ 6.0. So my solution places a thunk to make the function return to the _pexit function, after which it returns to its original return address.)
  2. Interceptor - This can be thought of as instrumentation code, which is baked into the Core Code. There are two exported methods - _penter and _pexit which are baked into the prologue / epilogue of every method in the Core Code. The interceptor is also responsible for locating, loading interested listeners, and notifying them within the _penter and _pexit functios.
  3. Listener - This is the observer (if you were considering our solution from the viewpoint of the Observer pattern). There can be any number of listeners. They are located and loaded in a chain by the interpreter. All notifications are offered to all the loaded listeners, who can then perform appropriate actions.

Implementation

There are 3 projects divided into two solutions

  1. App
    1. CoreApp
    2. Interceptor
  2. Listener
    1. Listener0

  1. CoreApp is a basic MFC based dialog application. It is compiled with the /Gh flag.
  2. Interceptor is a Win32 dll. It exports a method _penter. This dll when loaded, searches for interested listeners (named listener%d.dll in the current folder). If it finds and listener, it loads them, locates a known factory method (MCICreateListener), and uses it to create an instance of IListener for each thread spawned within Test_Stub.
  3. Listener0 is a Win32 Dll. It exports two methods MCICreateListener and MCIFreeListener. It also has an implementation of IListener (CLogListener), which when notified of a method, logs it into a .CSV file.

The interceptor is the most complicated module. Its basic functionalities are

  1. Locate all interested listeners, when it is loaded.
  2. Whenever a thread is created in CoreApp, create a separate handler for it and bind it into the threadbs TLS.
  3. Each thread handler on creation, would create a list of Ilistener objects, based on the listeners loaded during start up.
  4. Whenever a method is called in CoreApp, _penter is called. _penter in turn forwards it to the handler associated with that particular thread. The handler then iterates over all subscribed listeners for that thread, and informs them of the method.
  5. Similarly after a method executes, _pexit is called, which proceeds along the same notifications as described above.
  6. _penter makes use of the Symxxx methods present in dbghelp.dll, to load module and method names.

Problems with this approach

  1. As mentioned before, the /GH and /Gh methods are compiler specific (MS VC++ 7 and above. /Gh is present in MS VC++ 6 but not /GH.)
  2. Some amount of processor specific code needs to be written in the interceptor.
  3. Function information is retrieved using debug symbols. And the debug file format is proprietary (and heavy!). This in turn adversely affects performance.

Note:

  1. The code provided is NOT production grade code. The code (and the approach) is only meant for illustrative purposes.
  2. The debug symbols generated by the MS VC++ 7.1 compiler require the version 6.x of dbghelp.dll or higher. This is available as part of the debugging tools package provided by Microsoft. The dbghelp.dll is usually loaded from the system32 folder. If you already have an older version of dbghelp.dll there, do NOT over write it. Instead, it is better to copy the newer version into your application path. If you are using MS VC++ 6, version 5.x is sufficient.
  3. In a development machine, consider downloading symbols for your particular OS. Using the online Microsoft symbol server can be very slow at times.



About the Author

Raghupathy Srinivasan

just a run of the mill code monkey aspiring to be a grease monkey. i write articles infrequently and blog on http://quixver.blogspot.com/

Downloads

Comments

  • http://www.tomsoutletw.com/ wsyrft

    Posted by http://www.tomsoutletw.com/ Suttonkst on 03/30/2013 10:42am

    Angrily break through from the numerous traps marine monsters have not had time to vent their feelings, a road color fleeting fast from the sky to the ray ban prescription glasses Overhead down Zhenfei many monsters formed numerous pit, empowerment bombs, firewall, ice blanket and smog at the same time show, colorful, beautiful and eye-catching, also filled with murderous intention, taking the lives of countless monsters discount oakley sunglasses to rejoin the embrace of hell. Even be able to successfully make it through this monster Beautiful Death Road arrows, followed greet oakley sunglasses sale, countless merciless deadly arrows as death squads ray ban eventually able to escape into the fate of the hornet's nest. Successful interdiction after the first shock, the monster group's assault also started to become more fierce and ferocious, behind the monster group even began to swamp burning reinforcement frozen solidified many monsters open up wider and wide road, if cheap ray ban sunglasses behind the commanding others, I believe that an individual will not believe.

    Reply
  • http://www.oakleysunglassesoutc.com/ mlpocf

    Posted by http://www.oakleysunglassesoutc.com/ Suttoneyd on 03/30/2013 08:32am

    ghd sale,At present, the whole scheme mainly personnel training mainly China after every year will be sending students overseas to learn the knowledge of related disciplines, classes prepare students to double mission, ghd australia not only in science keeping up with cutting-edge, but also the use of ghd hair straightener identity to do intelligence work.ghd, Temperature bedrock of experience in the Tan Yan seems he can find the best meets his requirements, maybe later there will be a better person than he, but come into contact with this plan that temperature bedrock will this action binding lifetime.ghd straightener, 10 km east of Vladivostok, through a telescope, you can see the depth of 40 km as the basis, to the opposite hill Russian defensive positions suddenly makes Vladivostok - Russian partial mobilization of troops from more than thirty thousand one o'clock jumped to seven thousand people.

    Reply
  • ghd australia zmhgii

    Posted by Suttonxag on 03/08/2013 11:34pm

    ghd gmmvumxd GHD Hair Straightener plgfjmtd GHD Australia gswourje cheap ghd

    Reply
  • ghd australia qdiott

    Posted by Mandyoas on 03/08/2013 12:01am

    beats by dr dre sgtdvmyg beats by dre lecjjqta beats dr dre rafuouyb beats for sale iffraldh beats headphones xtyqcxlw cheap monster beats ccbgrtqo dr dre beats boxlrqvm dr dre headphones bxmlcdsh monster beats by dre clkyvjkh monster beats headphones ldfwnnwo monster beats kggyswvl monster headphones fhgbrbgj

    Reply
  • ghd australia dykncv

    Posted by Suttonkya on 02/07/2013 07:36pm

    1sCeg ugg tKeo aEax nike shox sko 1wNbd toms outlet 7rKeu hollister sale uk 0jLuw ugg 3pLua longchamp pas cher 2qHlt louis vuitton outlet 4dVtz michael kors outlet 9iIht christian louboutin 1vGvr Anthony Davis Jersey 2cJdc 1mFrq 9iRgv ghd 4mJkj cheap uggs

    Reply
  • ghd australia doviir

    Posted by Suttoncuj on 02/07/2013 04:42pm

    6oBgw christian louboutin xJkr longchamp outlet gJbb michael kors outlet 2qGwz 0jNgj chi 8eHhr michael kors outlet 4pOwy cheap nfl jerseys 0pItk nike uk 4jTid ghd 0jXfq ugg 4sOav toms outlet 6gNxe Tory Burch Robinson Zip Continental Grey Wallets Cheap 4yVbl hollister lyon 4hVcv ghd 9zZiw cheap uggs

    Reply
  • ugg boots ittonn http://www.cheapfashionshoesas.com/

    Posted by Suttondcb on 01/27/2013 02:51pm

    0dCry nike outlet store qMbr Michael Kors outlet nQsf ugg boots 5aSdb monster beats 7iXtq Cheap nfl jerseys 5eYph uggs sko 0lSos burberry bags 6sNew longchamp bags 4mPum nike air max 0iLxs ugg boots sale 3uZgv beats dr dre 0yCkd ugg espa?a 6iZnf cheap ghd 8bXhj 1iZpu

    Reply
  • ugg boots pykcgc http://www.cheapfashionshoesas.com/

    Posted by Suttondtw on 01/27/2013 01:19am

    7tKev cheap nike shoes sNfh Michael Kors outlet vMqn ugg boots 8lCuh monster beats 0qIav Cheap nfl jerseys 6kCzz uggs sko 7hXka burberry outlet 1pHxv longchamp 3wKtr nike shoes online 5jZxw ugg boots uk 5mTku monster beats 7wPrz ugg 3kGpb GHD Australia 7vJuf 2tQxw

    Reply
  • coach outlet texas

    Posted by Ralclabycer on 11/17/2012 05:45am

    ljpjf epbuh beats by dre apple beats dr dre cheap cheap beats by dre under 50 jtsfb lzwooc Method Call Interception (MCI) in C++ wolical coach outlet jacksonville coach factory outlet coach handbags jacksonville lcbvclj dxygp christian louboutin rolando shoes louboutin outlet usa louboutin outlet canada jplgedcn ugg キッズ ugg アグ 販売店 geutdacy

    Reply
  • http://www.cheapabeatsheadphonesonline.us uzvdjl zocbmw

    Posted by Ralclabycer on 11/15/2012 04:26am

    bkgjbe utahtl coach outlet grand prairie coach purses coach handbags and wallets tgongaef christian louboutin shoes china cheap christian louboutin louboutin outlet review hgdtfyr lknxvxs usrfp Method Call Interception (MCI) in C++ szbpskd ugg アウトレット ugg ムートンブーツ ugg emu apmypwgm モンクレール ガムブルー モンクレール ダウン moncler france gubpbgpk

    Reply
  • Loading, Please Wait ...

Leave a Comment
  • Your email address will not be published. All fields are required.

Top White Papers and Webcasts

  • Flash technology is becoming more prominent in the storage industry. Offering superior speed and reliability when compared to traditional hard disk drives – flash storage is a flexible and increasingly cost-effective technology that can be used to optimize enterprise storage environments. This ebook explores the many uses and benefits of flash storage technology in the enterprise. Check it out to discover and learn all you need to: Optimize storage performance Leverage server flash as storage cache …

  • Do you know where your data is? Consumer cloud-based file sharing services store your sensitive company data on servers outside of your control, outside of your policy and regulatory guidelines – maybe even outside your country – and not managed by you. The potential for data leakage, security breaches, and harm to your business is enormous. Download this white paper to learn about file sync and share alternatives that allow you to manage and protect your sensitive data while integrating and …

Most Popular Programming Stories

More for Developers

Latest Developer Headlines

RSS Feeds