rvlib-shipkit 1.4.0 → 1.6.0

package/src/trace/interpose.c

@@ -0,0 +1,655 @@
+// what a task's processes touch, logged from inside them. Loaded through
+// DYLD_INSERT_LIBRARIES, it wraps the libc calls that read, probe, write,
+// spawn and connect, and appends one line per call to <pid>.log in every dir
+// of SHIPKIT_TRACE_DIR (colon separated: a traced gate inside a traced task
+// logs to both). trace/read-trace.ts turns the logs into a read set.
+//
+// Lines, tab separated:
+//   H pid ppid exe                     this process image started, traced
+//   L path                             an image loaded: the executable, a library,
+//                                      a dlopen'd addon (dyld's shared cache left out)
+//   O flags kind dir path size mtime   an open that succeeded (kind f or d)
+//   E op errno dir path                a call on a path that failed
+//   S op kind dir path [size mtime ino] a probe that succeeded (kind f, d or l),
+//                                      with what stat said for a file
+//   D path mtime now                   a directory's entries were read: the
+//                                      dir's mtime then, and the wall clock
+//   M path name...                     the entry names one getdirentries call
+//                                      returned (0x1f between names)
+//   K dir path target                  a symlink's target, as readlink read it
+//   C path size mtime ino              a file the task wrote, as it closed it
+//   W op dir path                      a path was written, created or removed
+//   P op r pid path argv               a spawn or an exec (argv joined by 0x1f)
+//   N family addr port r errno fd      a connect, and how it ended
+//   R fd errno                         how a connect left in progress ended
+//   B family addr port r errno         a bind, with the port the kernel gave
+// `dir` is the dir a relative path was resolved against, empty for an
+// absolute path.
+//
+// A child that never writes its H line ran untraced, and the reader refuses
+// to key the answer on a trace with a hole in it. The logs themselves must
+// never become the hole, nor land in the task's files: a program that closes
+// every fd above 2 (python's subprocess does, before its exec) or reuses the
+// number for its own file would otherwise lose lines or receive them. So a
+// log fd sits above 1000, and before each write its dev and inode must still
+// be the log's, else the log is opened again. A forked child opens its own. Two ways a child goes
+// untraced are repaired here instead: a `#!/usr/bin/env X` script is spawned
+// as `X script`, since the kernel would run the protected /usr/bin/env, which
+// drops DYLD_* for everything below it, and a binary named in the remap file
+// (SHIPKIT_TRACE_REMAP) is swapped for its traceable copy.
+#include <arpa/inet.h>
+#include <dirent.h>
+#include <dlfcn.h>
+#include <mach-o/dyld.h>
+#include <sys/attr.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <limits.h>
+#include <netinet/in.h>
+#include <spawn.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+#include <sys/un.h>
+#include <time.h>
+#include <unistd.h>
+
+extern char **environ;
+extern int _NSGetExecutablePath(char *buf, uint32_t *size);
+
+#define INTERPOSE(mine, theirs)                                                                          \
+    __attribute__((used)) static struct {                                                              \
+        const void *replacement;                                                                       \
+        const void *replacee;                                                                          \
+    } interpose_##theirs __attribute__((section("__DATA,__interpose"))) = {(const void *)&mine, (const void *)&theirs};
+
+#define MAX_DIRS 4
+
+typedef struct {
+    int fd;
+    dev_t dev;
+    ino_t ino;
+    char path[PATH_MAX];
+} log_t;
+static log_t logs[MAX_DIRS];
+static int nlogs = -1;
+static pid_t logpid = 0;
+// the wrappers call libc themselves (getcwd opens "."), so a wrapper running
+// inside another one logs nothing: without this they recurse until the stack
+// is gone
+static __thread int busy = 0;
+
+/** open a log above fd 1000, remembering which file it is */
+static int open_high(log_t *l) {
+    l->fd = -1;
+    int fd = open(l->path, O_WRONLY | O_APPEND | O_CREAT | O_CLOEXEC, 0644);
+    if (fd < 0) return -1;
+    int hi = fcntl(fd, F_DUPFD_CLOEXEC, 1000);
+    if (hi >= 0) { close(fd); fd = hi; }
+    struct stat s;
+    if (fstat(fd, &s) != 0) { close(fd); return -1; }
+    l->dev = s.st_dev;
+    l->ino = s.st_ino;
+    l->fd = fd;
+    return fd;
+}
+
+static void open_logs(void) {
+    nlogs = 0;
+    logpid = getpid();
+    const char *list = getenv("SHIPKIT_TRACE_DIR");
+    if (list == NULL || list[0] == '\0') return;
+    char buf[4096];
+    strlcpy(buf, list, sizeof buf);
+    char *save = NULL;
+    for (char *d = strtok_r(buf, ":", &save); d != NULL && nlogs < MAX_DIRS; d = strtok_r(NULL, ":", &save)) {
+        log_t *l = &logs[nlogs];
+        snprintf(l->path, sizeof l->path, "%s/%d.log", d, logpid);
+        if (open_high(l) >= 0) nlogs++;
+    }
+}
+
+static void lg(const char *fmt, ...) {
+    int was = busy;
+    busy = 1;
+    int e = errno;
+    // a forked child writes its own log, never its parent's
+    if (nlogs < 0 || logpid != getpid()) open_logs();
+    if (nlogs > 0) {
+        char b[8192];
+        va_list a;
+        va_start(a, fmt);
+        int n = vsnprintf(b, sizeof b - 1, fmt, a);
+        va_end(a);
+        if (n > 0) {
+            if (n > (int)sizeof b - 2) n = sizeof b - 2;
+            b[n++] = '\n';
+            for (int i = 0; i < nlogs; i++) {
+                log_t *l = &logs[i];
+                struct stat st;
+                // the program closed this fd, or reuses its number for its own
+                // file: the old number is not ours any more, so reopen
+                if (l->fd < 0 || fstat(l->fd, &st) != 0 || st.st_dev != l->dev || st.st_ino != l->ino) {
+                    if (open_high(l) < 0) continue;
+                }
+                // one write per line: O_APPEND keeps lines from parallel
+                // threads and processes whole
+                write(l->fd, b, n);
+            }
+        }
+    }
+    errno = e;
+    busy = was;
+}
+
+/** the dir a relative path resolves against: the dirfd's path, else the cwd */
+static void base_of(int dfd, const char *p, char *dir, size_t n) {
+    dir[0] = '\0';
+    if (p == NULL || p[0] == '/') return;
+    if (dfd != AT_FDCWD && dfd >= 0) fcntl(dfd, F_GETPATH, dir);
+    else getcwd(dir, n);
+}
+
+/** fds this process opened for writing: their close logs what it left */
+#define MAX_TRACKED 8192
+static unsigned char writing[MAX_TRACKED];
+
+static void after_open(int dfd, const char *p, int flags, int r) {
+    if (r >= 0 && r < MAX_TRACKED) writing[r] = (flags & (O_WRONLY | O_RDWR | O_APPEND | O_CREAT | O_TRUNC)) != 0;
+    if (busy || p == NULL) return;
+    busy = 1;
+    int e = errno;
+    char dir[PATH_MAX];
+    base_of(dfd, p, dir, sizeof dir);
+    if (r >= 0) {
+        struct stat s;
+        if (fstat(r, &s) == 0)
+            lg("O\t%d\t%s\t%s\t%s\t%lld\t%ld.%09ld", flags, S_ISDIR(s.st_mode) ? "d" : "f", dir, p, (long long)s.st_size, (long)s.st_mtimespec.tv_sec, s.st_mtimespec.tv_nsec);
+    } else
+        lg("E\topen\t%d\t%s\t%s", e, dir, p);
+    errno = e;
+    busy = 0;
+}
+
+static void probe(const char *op, int dfd, const char *p, int r, const struct stat *s) {
+    if (busy || p == NULL) return;
+    busy = 1;
+    int e = errno;
+    char dir[PATH_MAX];
+    base_of(dfd, p, dir, sizeof dir);
+    // a file's size, mtime and inode as the task saw them: a tool with an
+    // mtime cache decides from this alone whether to read the file at all
+    if (r == 0 && s != NULL && S_ISREG(s->st_mode))
+        lg("S\t%s\tf\t%s\t%s\t%lld\t%ld.%09ld\t%llu", op, dir, p, (long long)s->st_size, (long)s->st_mtimespec.tv_sec, s->st_mtimespec.tv_nsec, (unsigned long long)s->st_ino);
+    else if (r == 0) lg("S\t%s\t%s\t%s\t%s", op, s == NULL ? "?" : S_ISDIR(s->st_mode) ? "d" : S_ISLNK(s->st_mode) ? "l" : "f", dir, p);
+    else lg("E\t%s\t%d\t%s\t%s", op, e, dir, p);
+    errno = e;
+    busy = 0;
+}
+
+static void wrote(const char *op, int dfd, const char *p) {
+    if (busy || p == NULL) return;
+    busy = 1;
+    int e = errno;
+    char dir[PATH_MAX];
+    base_of(dfd, p, dir, sizeof dir);
+    lg("W\t%s\t%s\t%s", op, dir, p);
+    errno = e;
+    busy = 0;
+}
+
+// ── reads and probes ────────────────────────────────────────────────────
+static int mode_of(int flags, va_list a) { return (flags & O_CREAT) ? va_arg(a, int) : 0; }
+
+int my_open(const char *p, int flags, ...) {
+    va_list a; va_start(a, flags); int m = mode_of(flags, a); va_end(a);
+    int r = open(p, flags, m); after_open(AT_FDCWD, p, flags, r); return r;
+}
+INTERPOSE(my_open, open)
+extern int open_nc(const char *p, int flags, ...) __asm("_open$NOCANCEL");
+int my_open_nc(const char *p, int flags, ...) {
+    va_list a; va_start(a, flags); int m = mode_of(flags, a); va_end(a);
+    int r = open_nc(p, flags, m); after_open(AT_FDCWD, p, flags, r); return r;
+}
+INTERPOSE(my_open_nc, open_nc)
+int my_openat(int d, const char *p, int flags, ...) {
+    va_list a; va_start(a, flags); int m = mode_of(flags, a); va_end(a);
+    int r = openat(d, p, flags, m); after_open(d, p, flags, r); return r;
+}
+INTERPOSE(my_openat, openat)
+extern int openat_nc(int d, const char *p, int flags, ...) __asm("_openat$NOCANCEL");
+int my_openat_nc(int d, const char *p, int flags, ...) {
+    va_list a; va_start(a, flags); int m = mode_of(flags, a); va_end(a);
+    int r = openat_nc(d, p, flags, m); after_open(d, p, flags, r); return r;
+}
+INTERPOSE(my_openat_nc, openat_nc)
+
+int my_stat(const char *p, struct stat *s) { int r = stat(p, s); probe("stat", AT_FDCWD, p, r, s); return r; }
+INTERPOSE(my_stat, stat)
+int my_lstat(const char *p, struct stat *s) { int r = lstat(p, s); probe("lstat", AT_FDCWD, p, r, s); return r; }
+INTERPOSE(my_lstat, lstat)
+int my_fstatat(int d, const char *p, struct stat *s, int f) {
+    int r = fstatat(d, p, s, f); probe(f & AT_SYMLINK_NOFOLLOW ? "lstat" : "stat", d, p, r, s); return r;
+}
+INTERPOSE(my_fstatat, fstatat)
+int my_access(const char *p, int m) {
+    int r = access(p, m);
+    if (!busy) { struct stat s; int e = errno; int ok = r == 0 && stat(p, &s) == 0; errno = e; probe("access", AT_FDCWD, p, r, ok ? &s : NULL); }
+    return r;
+}
+INTERPOSE(my_access, access)
+int my_faccessat(int d, const char *p, int m, int f) {
+    int r = faccessat(d, p, m, f);
+    if (!busy) { struct stat s; int e = errno; int ok = r == 0 && fstatat(d, p, &s, 0) == 0; errno = e; probe("access", d, p, r, ok ? &s : NULL); }
+    return r;
+}
+INTERPOSE(my_faccessat, faccessat)
+/** a symlink read: its target is what the task learned, not the file */
+static void link_read(int dfd, const char *p, const char *b, ssize_t r) {
+    if (busy || p == NULL) return;
+    busy = 1;
+    int e = errno;
+    char dir[PATH_MAX];
+    base_of(dfd, p, dir, sizeof dir);
+    if (r >= 0) {
+        char t[PATH_MAX];
+        size_t n = (size_t)r < sizeof t - 1 ? (size_t)r : sizeof t - 1;
+        memcpy(t, b, n);
+        t[n] = '\0';
+        lg("K\t%s\t%s\t%s", dir, p, t);
+    } else lg("E\treadlink\t%d\t%s\t%s", e, dir, p);
+    errno = e;
+    busy = 0;
+}
+ssize_t my_readlink(const char *p, char *b, size_t n) { ssize_t r = readlink(p, b, n); link_read(AT_FDCWD, p, b, r); return r; }
+INTERPOSE(my_readlink, readlink)
+ssize_t my_readlinkat(int d, const char *p, char *b, size_t n) { ssize_t r = readlinkat(d, p, b, n); link_read(d, p, b, r); return r; }
+INTERPOSE(my_readlinkat, readlinkat)
+extern char *realpath_ext(const char *p, char *out) __asm("_realpath$DARWIN_EXTSN");
+char *my_realpath(const char *p, char *out) { char *r = realpath_ext(p, out); probe("realpath", AT_FDCWD, p, r != NULL ? 0 : -1, NULL); return r; }
+INTERPOSE(my_realpath, realpath_ext)
+
+extern ssize_t getdirentries64(int fd, char *buf, size_t n, off_t *basep) __asm("___getdirentries64");
+/** a dir read through its fd, with the dir's mtime at that moment: an entry
+ *  another process adds while the task runs moves it */
+static void listed(int fd) {
+    if (busy) return;
+    busy = 1;
+    int e = errno;
+    char p[PATH_MAX] = "";
+    struct stat s;
+    struct timespec now;
+    clock_gettime(CLOCK_REALTIME, &now);
+    if (fcntl(fd, F_GETPATH, p) == 0 && fstat(fd, &s) == 0) lg("D\t%s\t%ld.%09ld\t%ld.%09ld", p, (long)s.st_mtimespec.tv_sec, s.st_mtimespec.tv_nsec, (long)now.tv_sec, now.tv_nsec);
+    errno = e;
+    busy = 0;
+}
+/** the names a getdirentries call returned, in lines of at most ~6KB */
+static void names_of(int fd, const char *buf, ssize_t n) {
+    if (busy || n <= 0) return;
+    busy = 1;
+    int e = errno;
+    char p[PATH_MAX] = "";
+    if (fcntl(fd, F_GETPATH, p) == 0) {
+        char line[6400];
+        size_t o = 0;
+        for (ssize_t at = 0; at < n;) {
+            const struct dirent *d = (const struct dirent *)(buf + at);
+            if (d->d_reclen == 0) break;
+            at += d->d_reclen;
+            if (d->d_ino == 0 || strcmp(d->d_name, ".") == 0 || strcmp(d->d_name, "..") == 0) continue;
+            if (o + d->d_namlen + 2 > sizeof line) { line[o] = '\0'; lg("M\t%s\t%s", p, line); o = 0; }
+            memcpy(line + o, d->d_name, d->d_namlen);
+            o += d->d_namlen;
+            line[o++] = '\x1f';
+        }
+        line[o] = '\0';
+        lg("M\t%s\t%s", p, line);
+    }
+    errno = e;
+    busy = 0;
+}
+ssize_t my_getdirentries64(int fd, char *buf, size_t n, off_t *basep) { listed(fd); ssize_t r = getdirentries64(fd, buf, n, basep); names_of(fd, buf, r); return r; }
+INTERPOSE(my_getdirentries64, getdirentries64)
+int my_getattrlistbulk(int fd, void *al, void *buf, size_t n, uint64_t o) { listed(fd); return getattrlistbulk(fd, al, buf, n, o); }
+INTERPOSE(my_getattrlistbulk, getattrlistbulk)
+
+// ── writes ───────────────────────────────────────────────────────────────
+int my_mkdir(const char *p, mode_t m) { int r = mkdir(p, m); if (r == 0) wrote("mkdir", AT_FDCWD, p); return r; }
+INTERPOSE(my_mkdir, mkdir)
+int my_mkdirat(int d, const char *p, mode_t m) { int r = mkdirat(d, p, m); if (r == 0) wrote("mkdir", d, p); return r; }
+INTERPOSE(my_mkdirat, mkdirat)
+int my_rmdir(const char *p) { int r = rmdir(p); if (r == 0) wrote("rmdir", AT_FDCWD, p); return r; }
+INTERPOSE(my_rmdir, rmdir)
+int my_unlink(const char *p) { int r = unlink(p); if (r == 0) wrote("unlink", AT_FDCWD, p); return r; }
+INTERPOSE(my_unlink, unlink)
+int my_unlinkat(int d, const char *p, int f) { int r = unlinkat(d, p, f); if (r == 0) wrote("unlink", d, p); return r; }
+INTERPOSE(my_unlinkat, unlinkat)
+int my_rename(const char *a, const char *b) { int r = rename(a, b); if (r == 0) { wrote("rename", AT_FDCWD, a); wrote("rename", AT_FDCWD, b); } return r; }
+INTERPOSE(my_rename, rename)
+int my_renameat(int da, const char *a, int db, const char *b) { int r = renameat(da, a, db, b); if (r == 0) { wrote("rename", da, a); wrote("rename", db, b); } return r; }
+INTERPOSE(my_renameat, renameat)
+int my_renameatx_np(int da, const char *a, int db, const char *b, unsigned int f) { int r = renameatx_np(da, a, db, b, f); if (r == 0) { wrote("rename", da, a); wrote("rename", db, b); } return r; }
+INTERPOSE(my_renameatx_np, renameatx_np)
+int my_symlink(const char *t, const char *p) { int r = symlink(t, p); if (r == 0) wrote("symlink", AT_FDCWD, p); return r; }
+INTERPOSE(my_symlink, symlink)
+int my_symlinkat(const char *t, int d, const char *p) { int r = symlinkat(t, d, p); if (r == 0) wrote("symlink", d, p); return r; }
+INTERPOSE(my_symlinkat, symlinkat)
+int my_link(const char *a, const char *b) { int r = link(a, b); if (r == 0) wrote("link", AT_FDCWD, b); return r; }
+INTERPOSE(my_link, link)
+int my_truncate(const char *p, off_t n) { int r = truncate(p, n); if (r == 0) wrote("truncate", AT_FDCWD, p); return r; }
+INTERPOSE(my_truncate, truncate)
+extern int clonefile(const char *src, const char *dst, uint32_t flags);
+int my_clonefile(const char *a, const char *b, uint32_t f) {
+    int r = clonefile(a, b, f);
+    if (r == 0) { struct stat s; int e = errno; int ok = stat(a, &s) == 0; errno = e; probe("clone", AT_FDCWD, a, ok ? 0 : -1, ok ? &s : NULL); wrote("clone", AT_FDCWD, b); }
+    return r;
+}
+INTERPOSE(my_clonefile, clonefile)
+
+// ── the network ──────────────────────────────────────────────────────────
+static void addr_line(const char *op, int sock, const struct sockaddr *a, int actual, int r) {
+    if (busy) return;
+    busy = 1;
+    int e = errno;
+    int err = r == 0 ? 0 : e;
+    struct sockaddr_storage st;
+    socklen_t l = sizeof st;
+    if (actual && getsockname(sock, (struct sockaddr *)&st, &l) == 0) a = (const struct sockaddr *)&st;
+    char host[INET6_ADDRSTRLEN] = "";
+    if (a == NULL) lg("%s\t?\t\t0\t%d\t%d\t%d", op, r, err, sock);
+    else if (a->sa_family == AF_UNIX) lg("%s\tunix\t%s\t0\t%d\t%d\t%d", op, ((const struct sockaddr_un *)a)->sun_path, r, err, sock);
+    else if (a->sa_family == AF_INET) {
+        const struct sockaddr_in *i = (const struct sockaddr_in *)a;
+        inet_ntop(AF_INET, &i->sin_addr, host, sizeof host);
+        lg("%s\tinet\t%s\t%d\t%d\t%d\t%d", op, host, ntohs(i->sin_port), r, err, sock);
+    } else if (a->sa_family == AF_INET6) {
+        const struct sockaddr_in6 *i = (const struct sockaddr_in6 *)a;
+        inet_ntop(AF_INET6, &i->sin6_addr, host, sizeof host);
+        lg("%s\tinet6\t%s\t%d\t%d\t%d\t%d", op, host, ntohs(i->sin6_port), r, err, sock);
+    } else lg("%s\tfamily%d\t\t0\t%d\t%d\t%d", op, a->sa_family, r, err, sock);
+    errno = e;
+    busy = 0;
+}
+int my_connect(int s, const struct sockaddr *a, socklen_t l) { int r = connect(s, a, l); addr_line("N", s, a, 0, r); return r; }
+INTERPOSE(my_connect, connect)
+extern int connect_nc(int s, const struct sockaddr *a, socklen_t l) __asm("_connect$NOCANCEL");
+int my_connect_nc(int s, const struct sockaddr *a, socklen_t l) { int r = connect_nc(s, a, l); addr_line("N", s, a, 0, r); return r; }
+INTERPOSE(my_connect_nc, connect_nc)
+// a non-blocking connect ends later, and the runtime reads how through
+// SO_ERROR: that answer says whether anything was listening
+int my_getsockopt(int s, int level, int name, void *v, socklen_t *l) {
+    int r = getsockopt(s, level, name, v, l);
+    if (r == 0 && level == SOL_SOCKET && name == SO_ERROR && v != NULL && !busy) lg("R\t%d\t%d", s, *(int *)v);
+    return r;
+}
+INTERPOSE(my_getsockopt, getsockopt)
+int my_bind(int s, const struct sockaddr *a, socklen_t l) { int r = bind(s, a, l); if (r == 0) addr_line("B", s, a, 1, r); return r; }
+INTERPOSE(my_bind, bind)
+
+// ── spawn and exec ───────────────────────────────────────────────────────
+/** the value of NAME in an env array, or NULL */
+static const char *env_in(char *const envp[], const char *name) {
+    size_t n = strlen(name);
+    for (int i = 0; envp != NULL && envp[i] != NULL; i++)
+        if (strncmp(envp[i], name, n) == 0 && envp[i][n] == '=') return envp[i] + n + 1;
+    return NULL;
+}
+
+/** `prog` resolved on PATH, into out; 0 when found */
+static int on_path(const char *prog, const char *path, char *out, size_t n) {
+    if (strchr(prog, '/') != NULL) { strlcpy(out, prog, n); return access(prog, X_OK); }
+    char buf[8192];
+    strlcpy(buf, path != NULL ? path : "/usr/bin:/bin", sizeof buf);
+    char *save = NULL;
+    for (char *d = strtok_r(buf, ":", &save); d != NULL; d = strtok_r(NULL, ":", &save)) {
+        snprintf(out, n, "%s/%s", *d == '\0' ? "." : d, prog);
+        struct stat s;
+        if (access(out, X_OK) == 0 && stat(out, &s) == 0 && S_ISREG(s.st_mode)) return 0;
+    }
+    return -1;
+}
+
+typedef struct {
+    char from[PATH_MAX];
+    char to[PATH_MAX];
+    long long size;
+    long mtime;
+    char env[1024];
+} remap_t;
+static remap_t *remaps = NULL;
+static int nremaps = -1;
+
+static void load_remaps(void) {
+    nremaps = 0;
+    const char *f = getenv("SHIPKIT_TRACE_REMAP");
+    if (f == NULL) return;
+    int fd = open(f, O_RDONLY | O_CLOEXEC);
+    if (fd < 0) return;
+    char buf[65536];
+    ssize_t n = read(fd, buf, sizeof buf - 1);
+    close(fd);
+    if (n <= 0) return;
+    buf[n] = '\0';
+    int cap = 0;
+    for (ssize_t i = 0; i < n; i++) if (buf[i] == '\n') cap++;
+    remaps = calloc(cap + 1, sizeof(remap_t));
+    if (remaps == NULL) return;
+    char *save = NULL;
+    for (char *line = strtok_r(buf, "\n", &save); line != NULL; line = strtok_r(NULL, "\n", &save)) {
+        remap_t *r = &remaps[nremaps];
+        char *parts[5] = {0};
+        int k = 0;
+        char *p2 = NULL;
+        for (char *t = strtok_r(line, "\t", &p2); t != NULL && k < 5; t = strtok_r(NULL, "\t", &p2)) parts[k++] = t;
+        if (k < 4) continue;
+        strlcpy(r->from, parts[0], sizeof r->from);
+        strlcpy(r->to, parts[1], sizeof r->to);
+        r->size = atoll(parts[2]);
+        r->mtime = atol(parts[3]);
+        strlcpy(r->env, k > 4 ? parts[4] : "", sizeof r->env);
+        nremaps++;
+    }
+}
+
+/** the traceable copy of `path`, while `path` is still the file the copy was
+ *  made from */
+static const remap_t *remap_of(const char *path) {
+    if (nremaps < 0) load_remaps();
+    for (int i = 0; i < nremaps; i++) {
+        if (strcmp(remaps[i].from, path) != 0) continue;
+        struct stat s;
+        if (stat(path, &s) != 0 || s.st_size != remaps[i].size || s.st_mtimespec.tv_sec != remaps[i].mtime) return NULL;
+        return &remaps[i];
+    }
+    return NULL;
+}
+
+/** a new env array: envp, the tracing vars when a caller dropped them, and a
+ *  remap's own assignments (`K=V;K=V`) */
+static char **env_for(char *const envp[], const remap_t *r) {
+    int n = 0;
+    while (envp != NULL && envp[n] != NULL) n++;
+    char **out = calloc(n + 16, sizeof(char *));
+    if (out == NULL) return (char **)envp;
+    int k = 0;
+    for (int i = 0; i < n; i++) out[k++] = envp[i];
+    const char *keep[] = {"DYLD_INSERT_LIBRARIES", "SHIPKIT_TRACE_DIR", "SHIPKIT_TRACE_REMAP"};
+    for (int i = 0; i < 3; i++) {
+        const char *mine = getenv(keep[i]);
+        if (mine == NULL || env_in(envp, keep[i]) != NULL) continue;
+        size_t l = strlen(keep[i]) + strlen(mine) + 2;
+        char *v = malloc(l);
+        if (v != NULL) { snprintf(v, l, "%s=%s", keep[i], mine); out[k++] = v; }
+    }
+    if (r != NULL && r->env[0] != '\0') {
+        char *copy = strdup(r->env);
+        char *save = NULL;
+        for (char *t = strtok_r(copy, ";", &save); t != NULL && k < n + 15; t = strtok_r(NULL, ";", &save)) out[k++] = t;
+    }
+    out[k] = NULL;
+    return out;
+}
+
+typedef struct {
+    char path[PATH_MAX];
+    char **argv;
+    char **envp;
+} plan_t;
+
+/** what to actually run for (path, argv): a `#!/usr/bin/env X` script runs
+ *  as X, a remapped binary as its traceable copy */
+static void plan(const char *path, char *const argv[], char *const envp[], int search, plan_t *out) {
+    char *const *env = envp != NULL ? envp : environ;
+    out->argv = (char **)argv;
+    strlcpy(out->path, path, sizeof out->path);
+    char found[PATH_MAX];
+    if (search && on_path(path, env_in(env, "PATH"), found, sizeof found) == 0) strlcpy(out->path, found, sizeof out->path);
+    int fd = open(out->path, O_RDONLY | O_CLOEXEC);
+    if (fd >= 0) {
+        char head[512] = "";
+        ssize_t n = read(fd, head, sizeof head - 1);
+        close(fd);
+        if (n > 2 && head[0] == '#' && head[1] == '!') {
+            head[n] = '\0';
+            char *nl = strchr(head, '\n');
+            if (nl != NULL) *nl = '\0';
+            char *save = NULL;
+            char *interp = strtok_r(head + 2, " \t", &save);
+            char *prog = interp == NULL ? NULL : strtok_r(NULL, " \t", &save);
+            char *rest = prog == NULL ? NULL : strtok_r(NULL, "", &save);
+            char resolved[PATH_MAX];
+            // `env -S` and friends are left to the kernel: the reader then
+            // sees the hole and keeps nothing, which is the safe way to fail
+            if (interp != NULL && strcmp(interp, "/usr/bin/env") == 0 && prog != NULL && prog[0] != '-' && rest == NULL &&
+                on_path(prog, env_in(env, "PATH"), resolved, sizeof resolved) == 0) {
+                int argc = 0;
+                while (argv != NULL && argv[argc] != NULL) argc++;
+                char **nargv = calloc(argc + 3, sizeof(char *));
+                if (nargv != NULL) {
+                    nargv[0] = strdup(prog);
+                    nargv[1] = strdup(out->path);
+                    for (int i = 1; i < argc; i++) nargv[i + 1] = argv[i];
+                    out->argv = nargv;
+                    strlcpy(out->path, resolved, sizeof out->path);
+                }
+            }
+        }
+    }
+    const remap_t *r = remap_of(out->path);
+    if (r != NULL) strlcpy(out->path, r->to, sizeof out->path);
+    out->envp = env_for(env, r);
+}
+
+static int setexec(const posix_spawnattr_t *at) {
+    short f = 0;
+    return at != NULL && posix_spawnattr_getflags(at, &f) == 0 && (f & POSIX_SPAWN_SETEXEC) != 0;
+}
+
+static void spawn_line(const char *op, int r, int pid, const char *asked, const plan_t *p) {
+    if (busy) return;
+    busy = 1;
+    char b[4096] = "";
+    size_t o = 0;
+    for (int i = 0; p->argv != NULL && p->argv[i] != NULL && o < sizeof b - 256; i++) o += snprintf(b + o, sizeof b - o, "%s\x1f", p->argv[i]);
+    lg("P\t%s\t%d\t%d\t%s\t%s\t%s", op, r, pid, asked, p->path, b);
+    busy = 0;
+}
+
+int my_posix_spawn(pid_t *pid, const char *path, const posix_spawn_file_actions_t *fa, const posix_spawnattr_t *at, char *const argv[], char *const envp[]) {
+    if (busy) return posix_spawn(pid, path, fa, at, argv, envp);
+    plan_t p;
+    busy = 1;
+    plan(path, argv, envp, 0, &p);
+    busy = 0;
+    pid_t child = -1;
+    // a SETEXEC spawn replaces this process and never returns: logged first,
+    // exactly like an exec
+    if (setexec(at)) spawn_line("exec", 0, getpid(), path, &p);
+    int r = posix_spawn(&child, p.path, fa, at, p.argv, p.envp);
+    if (setexec(at)) { spawn_line("execfail", r, getpid(), path, &p); return r; }
+    if (pid != NULL) *pid = child;
+    spawn_line("spawn", r, child, path, &p);
+    return r;
+}
+INTERPOSE(my_posix_spawn, posix_spawn)
+int my_posix_spawnp(pid_t *pid, const char *path, const posix_spawn_file_actions_t *fa, const posix_spawnattr_t *at, char *const argv[], char *const envp[]) {
+    if (busy) return posix_spawnp(pid, path, fa, at, argv, envp);
+    plan_t p;
+    busy = 1;
+    plan(path, argv, envp, 1, &p);
+    busy = 0;
+    pid_t child = -1;
+    if (setexec(at)) spawn_line("exec", 0, getpid(), path, &p);
+    int r = posix_spawn(&child, p.path, fa, at, p.argv, p.envp);
+    if (setexec(at)) { spawn_line("execfail", r, getpid(), path, &p); return r; }
+    if (pid != NULL) *pid = child;
+    spawn_line("spawn", r, child, path, &p);
+    return r;
+}
+INTERPOSE(my_posix_spawnp, posix_spawnp)
+/** set by the constructor: libSystem closes fds while it starts, before
+ *  thread-local storage exists, and touching `busy` then aborts the process */
+static volatile int ready = 0;
+
+static void closing(int fd) {
+    if (!ready || fd < 0 || fd >= MAX_TRACKED || !writing[fd]) return;
+    // what a write left, read before the fd goes: another writer after this
+    // moved the file under the task
+    if (!busy) {
+        writing[fd] = 0;
+        busy = 1;
+        int e = errno;
+        char p[PATH_MAX] = "";
+        struct stat st;
+        if (fcntl(fd, F_GETPATH, p) == 0 && fstat(fd, &st) == 0 && S_ISREG(st.st_mode))
+            lg("C\t%s\t%lld\t%ld.%09ld\t%llu", p, (long long)st.st_size, (long)st.st_mtimespec.tv_sec, st.st_mtimespec.tv_nsec, (unsigned long long)st.st_ino);
+        errno = e;
+        busy = 0;
+    } else writing[fd] = 0;
+}
+int my_close(int fd) { closing(fd); return close(fd); }
+INTERPOSE(my_close, close)
+extern int close_nc(int fd) __asm("_close$NOCANCEL");
+int my_close_nc(int fd) { closing(fd); return close_nc(fd); }
+INTERPOSE(my_close_nc, close_nc)
+int my_execve(const char *path, char *const argv[], char *const envp[]) {
+    if (busy) return execve(path, argv, envp);
+    plan_t p;
+    busy = 1;
+    plan(path, argv, envp, 0, &p);
+    busy = 0;
+    // written BEFORE the exec, which does not return when it works
+    spawn_line("exec", 0, getpid(), path, &p);
+    int r = execve(p.path, p.argv, p.envp);
+    int e = errno;
+    spawn_line("execfail", r, getpid(), path, &p);
+    errno = e;
+    return r;
+}
+INTERPOSE(my_execve, execve)
+
+/** every image dyld maps: the executable, its libraries, a dlopen'd addon.
+ *  dyld opens them with its own syscalls, so no open wrapper sees them. The
+ *  OS images in the shared cache are left out */
+static void loaded(const struct mach_header *mh, intptr_t slide) {
+    (void)slide;
+    Dl_info info;
+    if (dladdr(mh, &info) == 0 || info.dli_fname == NULL) return;
+    const char *p = info.dli_fname;
+    if (strncmp(p, "/System/", 8) == 0 || strncmp(p, "/usr/lib/", 9) == 0) return;
+    lg("L\t%s", p);
+}
+
+__attribute__((constructor)) static void hello(void) {
+    char exe[PATH_MAX] = "";
+    uint32_t n = sizeof exe;
+    _NSGetExecutablePath(exe, &n);
+    lg("H\t%d\t%d\t%s", getpid(), getppid(), exe);
+    // called at once for every image already loaded, then for each new one
+    _dyld_register_func_for_add_image(loaded);
+    ready = 1;
+}