linux - How to find the "exit" of a C program -

the test on 32-bit x86 linux.

so trying log information of executed basic blocks insert instrumentation instructions in assembly code.

my strategy this: write index of executed basic block in globl array, , flush array memory disk when array full (16m).

here problem. need flush array disk when execution of instrumented binary over, if not reach 16m boundary. however, don't know find exit of assembly program.

i tried this:

1. grep exit target assembly program, , flush memory right before call exit instruction. according debugging experience, target c program, say, md5sum binary, not call exit when finishes execution.

2. flush memory @ end of main function. however, in assembly code, don't know exact end of main function. can conservative approach, say, looking ret instruction, seems me not main function ends ret instruction.

so here question, how identify exact execution end of assembly code , , insert instrumentation instructions there? hooking library code fine me. understand different input, binary exit @ different position, guess need conservative estimation. clear? thanks!

i believe cannot in general case. first, if main returning code, exit code (if main has no explicit return recent c standards require compiler adds implicit return 0;). function store address of exit in data (e.g. global function, field in struct, ...), , other function indrectly call thru function pointer. practically, program can load plugins using dlopen , use dlsym "exit" name, or call exit inside plugin, etc... afaiu solving problem (of finding actual exit calls, in dynamic sense) in full generality can proved equivalent halting problem. see rice's theorem.

without claiming exhaustive approach, suggest else (assuming interested in instrumenting programs coded in c or c++, etc... source code available you). customize gcc compiler melt change basic blocks processed inside gcc call of instrumentation functions. not trivial, doable... of course you'll need recompile c code such customized gcc instrument it.

^{(disclaimer, main author of melt; feel free contact me more...)}

btw, know atexit(3)? helpful flushing issue... , might use ld_preload tricks (read dynamic linkers, see ld-linux(8)).