The previous reconstructor was flawed and served well as prototype, but
this new one is meant to stay for a while. Some features
- Strictly typing of the different variants of calls (functions, inlined functions, symbols, etc).
- Special handling of inline function, including inlined functions that have no instructions of their own
- Better formatting for the dumper
- Extensible code structure. It's easy to create new call types and special handlers based on instruction types and symbol information
- Added better tests
As a note, the latest version of libipt included a new instruction kind "indirect" with is either an indirect jump or a call that libipt can't distinguish better. It used to be signaled as an error instruction but not anymore (see https://github.com/intel/libipt/commit/27513274c897851e15a46bb19a3861219d87c6cb). Besides that, the LLVM disassembler fails to disassembly some functions that libipt doesn't. I imagine Intel is doing a better job than LLVM at disassembling x86 instructions. So I decided to use the instruction kinds from libipt until we improve the disassembler.
In a following diff I'll add a JSON dumper for the graph.
do we need to store this or can this information be calculated on demand? just thinking about massive traces and want to make sure we're intentional about only storing what we absolutely need to for each instruction