Using SSC Marks
The SSC mark is a combination of two instructions which are used as marks inside binaries. These two instructions are a MOV instruction with immediate operand (the SSC mark ID), and a NOP instruction with two ignored orefixes 64 (the FS prefix) and 67 (the address size prefix). This pattern is recognized by multiple Intel® internal and external tools including Intel® SDE.
The hex byte pattern looks like the following:
unsigned char ssc_marker[] = { 0xbb, 0x00, 0x00, 0x00, 0x00, 0x64, 0x67, 0x90 }
The 4 0x00 bytes denotes the SSC mark ID and can be changed to some user-specified value. Simulators and Intel® SDE know to check this pattern in the instructions execution flow.
If you used 0x44332211 as your maker (big endian), it would show up as the following two instructions in your code.
BB11223344 mov ebx, 0x44332211
646790 nop
The hex sequence at the left shows the immediate in little endian as is the x86 way of storing code. The code at the right is written with big-endian immediate because that is what humans use and what compiler/assembler input uses.
Note
The 0x90 (NOP instruction) has two ignored prefixes, these prefixes are required. There are many ways of encoding the MOV instruction so emulators/simulators should look for the exact byte sequence as shown below.
Here is how to emit this sequence with gnu inline asm. In this case we are starting on big-endian 0x44332211 and ending with 0x55332211. The asm statements need not be in their own functions.
Note
The endian swap; The “.byte” sequences use the little endian sequence.
void marker_start()
{ // use with -control start:ssc:44332211 (note the endian swap!)
asm volatile(".byte 0xbb,0x11,0x22,0x33,0x44,0x64,0x67,0x90" : : : "ebx");
}
void marker_stop()
{ // use with -control stop:ssc:55332211 (note the endian swap!)
asm volatile(".byte 0xbb,0x11,0x22,0x33,0x55,0x64,0x67,0x90" : : : "ebx");
}
Intel® SDE controller supports the SSC alarm with the immediate modifier (as shown in the code block above).
The Histogram Analysis Tool - Mix has special handling for SSC marks and it provides a meta-group for each SSC mark with its own immediate and count.
*scale_4 1070
*scale_8 1152
*memdisp8 30583
*memdisp32 17849
*sscmark-0xa 10
*sscmark-0x64 15
*sscmark-0xaabbccdd 20
ADD 13503
AND 4068
...
You can write the SSC marks in assembly file or use the following inline assembly code (GCC only)
// Emit SSC marks with input mark ID
#define EMIT_SSC_MARK( MARK_ID ) \
__asm__ __volatile__ ( \
"\n\t movl $"#MARK_ID", %%ebx" \
"\n\t .byte 0x64, 0x67, 0x90" \
: : : "%ebx" )