{"title":"snaums.de","link":[{"@attributes":{"href":"https:\/\/www.snaums.de\/","rel":"alternate"}},{"@attributes":{"href":"https:\/\/www.snaums.de\/feed\/all.atom.xml","rel":"self"}}],"id":"https:\/\/www.snaums.de\/","updated":"2025-05-03T14:00:00+02:00","entry":[{"title":"Showtime! Chorkonzert aufnehmen.","link":{"@attributes":{"href":"https:\/\/www.snaums.de\/fotografie\/showtime-chorkonzert-aufnehmen.html","rel":"alternate"}},"published":"2025-05-03T14:00:00+02:00","updated":"2025-05-03T14:00:00+02:00","author":{"name":"snaums"},"id":"tag:www.snaums.de,2025-05-03:\/fotografie\/showtime-chorkonzert-aufnehmen.html","summary":"

Ich singe in einem Chor, dem Jungen Chor Hannover (Website<\/a>). Im Sommer 2024 haben wir ein Programm mit dem Titel Showtime in zwei Konzerten aufgeführt in dem wir einige Stücke aus bekannten Musicals dargeboten haben. Natürlich mit glitzerndem Show-Outfit, mit Bühnenbild, Beleuchtung und mit Choreographien. Das ist sehr viel Arbeit \u2026<\/p>","content":"

Ich singe in einem Chor, dem Jungen Chor Hannover (Website<\/a>). Im Sommer 2024 haben wir ein Programm mit dem Titel Showtime in zwei Konzerten aufgeführt in dem wir einige Stücke aus bekannten Musicals dargeboten haben. Natürlich mit glitzerndem Show-Outfit, mit Bühnenbild, Beleuchtung und mit Choreographien. Das ist sehr viel Arbeit für alle Beteiligten gewesen, weshalb auch die Idee aufkam die Konzerte festzuhalten. Deshalb, und keinesfalls weil ich mir das Tanzen-Lernen ersparen wollte, habe ich mir diese Aufgabe angenommen und habe die beiden Konzerte mit Kameras zu begleitet. Ziel war es auch das Konzert dann dem regionalen Bürger*innenfernsehsender h1 (Website<\/a>) zur Verfügung zu stellen. Das Video gibt es auch online:<\/p>\n

Showtime: Ein Hauch von Broadway. (Youtube)<\/a><\/p>\n

In diesem Blogpost will ich einmal darstellen, wie ich vorgegangen bin und was ich für künftige Aufnahmen gelernt habe. Natürlich war ich nicht alleine, sondern wurde von 3 Kameraleuten unterstützt.<\/p>\n

Aufbau<\/h2>\n

Der Konzertraum war eine Aula einer Schule in Hannover, ein relativ breiter Raum mit 2 Blöcken an Stühlen getrennt von einem Gang nach vorn zur Bühne. Es gibt eine feste aber verschiebbare Beleuchtung, die ein Schüler der Schule bedient hat. Das gesamte Programm findet auf der Bühne statt. Der Chor stand zentral, links daneben war eine kleine Band aus einem Pianisten, einem Bassisten und einem Drummer aufgebaut.<\/p>\n

Wir haben 3 Kameras verwendet, konkret Sony Sony PXW-X70, 2 davon standen ganz hinten gerade zur Bühne ausgerichtet (die habe ich K1 und K3 genannt). K2 steht rechts neben dem Publikumsblock, relativ nach zur Bühne. K1 und K2 haben wir eher für Mittelnahaufnahmen verwendet, wo einzelne Personen oder Stimmgruppen im Bild sein sollten. K3 sollte immer den gesamten Chor im Bild halten. K3 hatte ein defektes Einstellrad, musste also sowieso im Automodus verwendet werden. Die Kamera entschied also sowieso über die Belichtung -- trifft sich also eigentlich ganz gut dass die Kamera ein recht statisches Bild liefert. Alle Kameras waren auf Stative montiert und blieben dort über das gesamte Konzert. Die Kamera waren etwas über Kopfhöhe.<\/p>\n

Diese speziellen Kameras haben zwei Aufnahmemodus AVCHD und XAVC. Wir haben bei der Generalprobe herausgefunden dass diese Kameras in XAVC erstmal alle Audioquellen einzeln aufnehmen, mehr Bitrate liefern und nicht in 4GB große Dateien splitten, in AVCHD aber schon. Da wir Techniker sind und auf große Zahlen stehen, wollen wir natürlich maximale Qualität und haben in XAVC aufgenommen. Bei der Generalprobe haben wir uns auch Werte für den Weißabgleich ausgesucht und grobe Werte für die Blenden und Shutterspeed herausgefunden, die wir beim Konzert benutzen könnten.<\/p>\n

Bei diesem Dreh ist der Abstand zum Chor konstant, also macht es Sinn einmal entweder manuell oder automatisch den Fokus zu ziehen und dann zu sperren oder auf manuell umzustellen. Die Kameras können zwar Autofokus, wenn die aber aus irgendeinem Grund den Punkt verlieren und wir dann ständig Fokusbreathing im Material haben ist das eher unschön. Insbesondere die hinteren beiden Kameras haben wir im manuellen Fokus betrieben und nur ganz zum Schluss am Fokusring gedreht.<\/p>\n

Wir haben 3 Mikrofone an die Kameras angeschlossen, 2 davon an K2, die Kabel haben wir an die Stufen der Bühne gelegt. Diese beiden Mikrofone haben wir recht weit rechts und links vor die Bühne gestellt. Die Hoffnung war, dass wir damit einzelne Stimmgruppen gesondert auf die Aufnahmespuren bekommen, das hat halbwegs geklappt. Ein weiteres Mikrofon haben wir in die Mitte, leicht neben dem Chorleiter gestellt und an eine der Kameras hinten angeschlossen. Der Chor selbst nimmt die eigene Konzerte selbst mit einem Zoom-Recorder auf, der etwa in der Mitte des Publikumsblocks stand.<\/p>\n

Der Aufbau hat recht gut funktioniert. K1 und K2 haben sehr verschiedene Bildausschnitte geliefert, besonders bei Moderationen. K1 und K3 haben manchmal zu ähnliche Bilder aufgezeichnet, insbesondere am Ende von Stücken oder beim abschließenden Applaus wenn K1 weit rausgezoomt war.<\/p>\n

Das Equipment hat wie abgemessen in ein Lastenrad von Hannah<\/a> gepasst, das ist ein Lastenrad-Leihdienst vom ADFC. :D<\/p>\n

Hannah Lastenfahrrad voller Kameras und Stative<\/a><\/div><\/div>\n

Bearbeitung<\/h2>\n

Nach den Konzerten hatte ich dann insgesamt etwa 8 Stunden Material: 2 Konzerte, 3 Kameras, jeweils etwas über 1 Stunde Material. Wie bearbeitet man das jetzt?<\/p>\n

Es gibt viele Programme zum Bearbeiten von Videos, ich habe mich für KDEnlive entschieden, ein freier, open-source nicht-linearer Videoeditor. KDEnlive hat die positive Eigenschaft, dass es einerseits quasi alle Formate, die ffmpeg versteht, importieren kann, es kann Proxy-Clips, also heruntergerechnete Clips zur schnelleren Bearbeitung, erzeugen und hat einen Multi-Cam Modus, bei dem man alle Spuren gleichzeitig gezeigt bekommt und durch Zahlentasten aussuchen kann, welcher Feed im fertigen Projekt landen soll.<\/p>\n

Seid nun so schlau und erstellt, anders als ich, ein Projekt mit Stereo Audioausgabe. Ich hatte mich für ein 5.1 Audiosetup entschieden und keine Möglichkeit gefunden das zu ändern wenn das Projekt einmal aufgebaut ist. Fürs Fernsehen reicht Stereo problemlos aus, es sei denn ihr wisst genau was ihr da tut. Jetzt bekam ich aber nur Video mit 5.1 Audio aus dem Programm, was immer etwas komisch klang. Ich habe das dann mit Audacity und ffmpeg gelöst, aber das hatte eine Menge unschöne Nebeneffekte.<\/p>\n

Aber erstmal die Videos importieren. Jetzt kann man überlegen ob man direkt Proxy-Clips anschaltet, damit die Bearbeitung flüssiger abläuft oder ob man den Grobschnitt mit voller Auflösung machen will. Dann sollte der Rechner aber gut genug sein. Ich empfehle euch die Videos gut zu sortieren -- pro Aufnahmetag und am besten auch nach Kamera wenn ihr mehrere Clips habt. Nun kommt der schwierige Teil -- die Videos zu synchronisieren.<\/p>\n

Am einfachsten ist es, wenn wir ein lautes, kurzes Geräusch haben, um die Videos zu synchronisieren -- im Idealfall sowohl im Audio als auch auf der Videospur. Dieses Geräusch, bspw. ein Klatschen, können wir dann benutzen um die Peaks im Audio direkt übereinanderzulegen. Wenn nun das Geräusch genau beim Zusammenschlagen der Hände kommt, haben wir die Videos korrekt synchronisiert. Das habe ich nicht gehabt, also musste ich mir andere Geräusche suchen, und dann die Audiospuren immer wieder einzeln anschalten um zu sehen dass sie wirklich aufsynchronisiert sind. Beim nächsten Mal, werde ich ein Synchronisationsklatschen verwenden.<\/p>\n

Schnitt<\/h3>\n
KDEnlive Projektansicht<\/a><\/div><\/div>\n

Alle drei Clips sollten übereinander liegen, dann kann über Werkzeug -> Multikamera Werkzeug in die Multicam-Anzeige umgeschalten werden. Jetzt sehen wir die drei Videofeeds im Projektmonitor. Drücken wir nun 1, 2 oder 3 schalten wir zwischen den Spuren um. KDEnlive setzt das so um, dass alle anderen Spuren dabei ausgeschnitten werden, seit dem letzten Schnitt. Das ist eine nette Lösung, hat aber den Nachteil, dass ihr sehr viele kleine Clips (zum Glück auf ihren eigenen Spuren) habt. Mit dem Multikamera Werkzeug kann der Grobschnitt recht problemlos gemacht werden. Natürlich machen wir hierbei Fehler oder das Timing stimmt nicht ganz genau. Wir müssen ohnehin noch ein paar mal über das Projekt drübergehen und genauer schneiden oder Belichtung anpassen.<\/p>\n

Beim Grobschnitt habe ich mir mit Hilfslinien Notizen gemacht -- wo beginnt welches Lied, wo ist Moderation, etc. Jetzt kommen 1-2 Durchgänge des genauen Anpassens. Hier geht es darum Cuts richtig auszurichten. Ich habe mich versucht am Takt der Musik auszurichten. Achtet unbedingt darauf die Clips nicht zu verschieben, sondern erst nach vorne\/hinten zu verlängern, und dann zu verkleinern, damit KDEnlive die richtige Videostelle rauskramt.<\/p>\n

Ich habe hier zunächst beide Konzerte angeschaut und grobgeschnitten. Theoretisch wäre es so möglich gewesen ein Lied was bei einem Konzert nicht geklappt hat, durch das vom Anderen auszutasuchen. Davon abgesehen dass das auffällt, habe ich das nicht gemacht, weil am Sonntag quasi alles ohnehin besser war. Außerdem macht das in diesem Setup massenhaft Arbeit, denn auch die Audiospuren wollen sauber eingefügt werden, was nicht immer einfach ist. Am Ende habe ich mich nach dem Grobschnitt für den Sonntag entschieden, und den anderen Drehtag abgeschrieben.<\/p>\n

Audio<\/h3>\n
Audacity Projektansicht<\/a><\/div><\/div>\n

Bislang habe ich mich hauptsächlich mit dem Video beschäftigt. Ich habe mich nach dem Schneiden dafür entschieden die Audiospuren externn in Audacity bearbeiten zu wollen. KDEnlive bietet grundlegende Features um Audio zu bearbeiten, es gibt einen einfachen Mixer und es gibt ein paar Filter und Effekte, aber am Ende habe ich deutlich mehr gemacht. Und durch den Fehler mit dem 5.1 Projekt blieb mir eigentlich auch keine andere Wahl mehr. Um keine Verluste durch Komprimierung zu haben, habe ich die Audiospuren in KDEnlive einzeln nach FLAC exportiert und dann in Audacity importiert. FLAX ist ein Format, was verlustfrei komprimiert, d.h. das Audiosignal bleibt beim Abspeichern vollständig erhalten. Die Audiodateien sollten im Audacity aufeinanderpassen. Hier müssen wir uns aber sicher sein, dass wir nichts am Video mehr schneiden wollen -- sonst haben wir ein riesiges Problem.<\/p>\n

Nun geht es erstmal darum die Mikrofone richtig abzumischen. Wo stand welches Mikrofon, welche Spur ist rechts, welche links? Wir hatten links ein Piano stehen, sodass auch im Audio leicht links das Piano stärker durch kommen sollte, und die linkeren Mikros das Piano lauter aufgenommen haben. Ich habe die Mikros ganz vorn an der Bühne auf 100% links und 100% rechts gestellt, und den Zoom-Recorder auf 40% links\/40% rechts. Das Mikrofon mittig vorn an der Bühne war leider zu stark übersteuert (passt auf eure Mikrofon-Einstellungen auf!), sodass ich das nur für Soli benutzt habe, um die Solist*innen besser aus dem Chor rauszuholen.<\/p>\n

Dann geht es weiter zur Bearbeitung des Audios. Die Moderationen waren bei mir recht leise, die habe ich verstärkt. Geht der Applaus los, bevor die Moderation endet, muss abgewogen werden, ob es wichtiger ist den Satz zu verstärken oder dass der Applaus nicht zu laut wird. Eventuell wurde der Satz ohnehin danach neu angefangen, dann können wir die Moderation vom Applaus auch verschlucken lassen. Dafür waren einige Stücke etwas zu laut, die habe ich verringert. Wichtig war, dass beim abschließenden Mischen keine Stellen übrig bleiben, die Clippen, also aus dem maximalen Bereich herausreichen, dann entstehen unangenehme Kratzgeräusche.<\/p>\n

Zusammenführen<\/h3>\n

Durch meinen kleinen Fehler am Anfang musste ich das Audio nachträglich auf das Video legen. Ich habe im KDEnlive auch nicht genau bei 0 angefangen, also habe ich sowohl im KDEnlive, als auch im Audacity einen Teilbereich markiert und nur den Teilbereich exportiert.<\/p>\n

Dann mithilfe von ffmpeg das exportierte FLAC aus Audacity auf das Video aus KDEnlive gelegt, dabei das originale Audio ersetzt. Das geht relativ schnell (in meinem Fall in 20-facher Geschwindigkeit), weil das Video nicht neu einkodiert werden muss. Wichtig ist dann, genau hinzuschauen ob das Audio synchron ist.<\/p>\n

<\/span>ffmpeg <\/span>-i <\/span>video.mp4 <\/span>-i <\/span>new_audio.flac <\/span>-c:v <\/span>copy <\/span>-map <\/span>0<\/span>:v:0 <\/span>-map <\/span>1<\/span>:a:0 <\/span>c:a <\/span>aac <\/span>-b:a <\/span>320k <\/span>output.mp4<\/code><\/span>\n<\/span><\/pre><\/div>\n
Probeschauen<\/h3>\n
Ganz zum Schluss habe ich mehrfach über das fertige Video drübergeschaut, auch in verschiedenen (ok, 2) Soundsetups und ich habe es auch dem Chor gegeben zum Probeschauen. Hier geht es darum Fehler zu finden. Wo sitzt der Schnitt nicht korrekt. Gibt es Bilder nicht schwarz sind, gibt es welche die zu dunkel\/zu hell sind? Gibt es welche die nicht hübsch sind und ausgetauscht werden könnten? Passen die Überblendungen?<\/p>\n
Learnings<\/h2>\n
Was habe ich am Ende also gelernt?<\/p>\n
Absprachen sind wichtig, besonders bei der Belichtung<\/h3>\n
Wenn man durch das Video durchschaut sieht man dass K1 manchmal etwas zu dunkel ist, die anderen Kameras aber meistens ein relativ gutes Bild liefern. Zugegeben waren die Lichtverhältnisse für die Kameras schwierig, einige Sänger*innen sind sehr hell beleuchtet, einige standen eher im Schatten.<\/p>\n
Gute Absprachen machen hier aber das Leben des Cutters einfacher -- welche Belichtung stellen wir ein, damit halbwegs vergleichbare Bilder rauskommen. Da eine der Kameras nur auf Auto laufen konnte, hätten wir die Belichtungseinstellungen einfach den Kameras überlassen können, dann wären recht vergleichbare Bilder rausgekommen. Haben wir aber nicht. Dann mussten einige Stellen halt nachträglich angehoben werden, was zum Glück nicht so sehr auffällt, aber es ist einfach Arbeit, die man sich sparen könnte. Und dann muss es überall gemacht werden.<\/p>\n
Idealerweise könnte man das per Intercom absprechen, oder man müsste sich die Einstellungen festlegen, was wieder das Potential hat, dass die Einstellungen nicht passen, wenn sich das Licht ändert.<\/p>\n
Video ist kein Foto<\/strong>. Beim Fotografieren belichtet man eher etwas unter \"expose to the right\". Dabei geht es darum, dass im Histogram keine Pixel ganz weiß sind, dann ist die Information in den Details dieser Bildstellen komplett verloren. Schatten holt man meist recht gut aus den RAW-Dateien in der Nachbearbeitung heraus, weil noch recht viel Information auch in dunklen Stellen gespeichert ist (insbesondere bei 14 Bit Aufnahmen), komplett weiß Pixel, also überbelichtete Pixel enthalten aber keine Details mehr, die man retten könnte.<\/p>\n
Video ist aber kein Foto. Außer ihr habt gute Cine-Kameras, werden direkt komprimierte Videos aufgenommen. Wir haben die Kameras auf eine hohe Bitrate eingestellt, aber dennoch ist es komprimiert und auch nicht mit 14 Bit Farbtiefe. Ein paar Stufen kann man sicher hochziehen -- das musste ich am Ende sogar, aber das geht nicht unendlich weit. Deshalb solltet ihr versuchen eher \"mittig\" zu belichten. Dann sind halt ein paar Stellen weiß, das ist meist zu verkraften, mehr jedenfalls als wenn das Bild einfach zu dunkel wird. Insbesondere wenn kein Film gedreht wird, sondern \"nur\" ein Livekonzert fürs Fernsehen aufgenommen wird, macht es mehr Sinn direkt Bilder aufzunehmen die sendbar sind.<\/p>\n
Eure Einstellungen genau betrachten<\/h3>\n
Dass das Mikrofon vorne mittag an der Bühne deutlich zu laut war, ist eindeutig mein Fehler. Hier habe ich vergessen nochmal auf die Audio-Ausschläge zu schauen und nachzukorrigieren. Am Ende ist das hier nicht kritisch gewesen und eventuell sogar ganz gut, so konnten die Solist*innen besser verstärkt werden, aber es hätte problematisch sein können. Plant also genug Back-up ein, dass ihr auch mal was verkacken könnt und dann trotzdem noch ein Video habt.<\/p>\n
Totale sind kein Allheilmittel<\/h3>\n
Vor der Aufnahme habe ich mir die K3 als Backup vorgestellt - die Kamera nimmt sowieso eine Totale auf, da ist alles drauf, falls K1 und K2 mal kein brauchbares Bild liefern. Das stimmt manchmal, aber manchmal auch nicht. Wenn die Kameras zu ähnliche Bilder liefern, ist ein Schneiden von K1 auf K3 eher hässlich. Zu lange auf der Totalen zu bleiben wirkt auch ziemlich langweilig und undynamisch. Hier kann man das sogar noch fast verkraften, weil man dann wenigstens die ganze Choreo sieht.<\/p>\n
Und an einer Stelle stand jemand direkt vor K1 und K3 auf, was natürlich die Shots ruiniert hat. Hätten wir das vermeiden wollen, hätten wir die Kameras höher stellen müssen und ggf. weiter auseinander.<\/p>\n
Fazit<\/h2>\n
Am Ende war das haufenweise Arbeit, auch weil ich beim Aufnehmen mir nicht genug Gedanken gemacht habe oder bestimmte Dinge einfach nicht beherzigt habe. Dennoch ist ein sehr hübsches Video rausgekommen, auf das ich auch sehr stolz bin. Am Ende habe ich knapp 4,5 Monate gebraucht bis das Video fertig war. Das ist nicht mein Vollzeitjob und so bleiben halt nur noch Wochenende an denen man mal Lust darauf hat. Insgesamt eine Zeitspanne die vertretbar ist, zumal wir ja keinen Zeitdruck in der Nachbearbeitung gehabt haben.<\/p>\n
Abschließend danke an meine Kameraleute. Und natürlich an den Chor, der das Experiment mitgemacht hat :D<\/p>","category":[{"@attributes":{"term":"Fotografie"}},{"@attributes":{"term":"chor"}},{"@attributes":{"term":"showtime"}},{"@attributes":{"term":"junger chor hannover"}},{"@attributes":{"term":"aufnehmen"}},{"@attributes":{"term":"tv"}},{"@attributes":{"term":"fernsehen"}},{"@attributes":{"term":"h1"}},{"@attributes":{"term":"hannover"}},{"@attributes":{"term":"kamera"}},{"@attributes":{"term":"video"}},{"@attributes":{"term":"konzert"}}]},{"title":"Catching Native Crashes under JNI with UNIX Signals","link":{"@attributes":{"href":"https:\/\/www.snaums.de\/informatik\/jni-catching-native-crashes-with-unix-signals.html","rel":"alternate"}},"published":"2023-12-31T17:00:00+01:00","updated":"2023-12-31T17:00:00+01:00","author":{"name":"snaums"},"id":"tag:www.snaums.de,2023-12-31:\/informatik\/jni-catching-native-crashes-with-unix-signals.html","summary":"
A while back I've written about the Java Native Interface (JNI) and how to use and abuse it for running native code inside your Java program, either to run legacy code or to have performance critical code run natively. However if your native code crashes, which is not that hard \u2026<\/p>","content":"
A while back I've written about the Java Native Interface (JNI) and how to use and abuse it for running native code inside your Java program, either to run legacy code or to have performance critical code run natively. However if your native code crashes, which is not that hard in C\/C++, then it takes your Java program with it. If your Java program is a server applet running inside a Tomcat process for example, your whole webserver comes crashing down and a world of pain is waiting for you.<\/p>\n
A friend of mine had quite a clever \"solution\" to this problem, at least on Linux. While, we would like to eliminate all sources of crashes forever, this is not possible and unrealistic, we can however make debugging a bit easier. We would like to:<\/p>\n
    \n
  1. catch a crash,<\/li>\n
  2. write a crashdump (or at least backtrace) for easier debugging,<\/li>\n
  3. throw an exception into the Java-world so it can try and shut down gracefully.<\/li>\n<\/ol>\n
    But first we will have to learn a few basics about Linux and Unix. And if you've missed the first JNI-article and are missing a few of the essentials, feel free to read that first.<\/p>\n
    Fundamentals about UNIX signals<\/h2>\n
    Unix signals are a way in the Operating System to transfer data into a process. This is used to stop or pause a process (SIGSTOP), to notify a debugger about changes in the child process (SIGCHILD) or even to kill a process (SIGTERM, SIGKILL). Also the operating system stops a process and sends it a Signal when the process tried to execute an illegal instruction (SIGILL), tried to access invalid memory locations (SIGSEGV) or a bus error occured (SIGBUS). There is even a signal when the terminal changes in size (SIGWINCH).<\/p>\n
    Whenever a process receives such a signal, there is an action associated with it. A process may mask (i.e. disable) a signal, so it will be ignored, when it receives the signal, take the default action (which is to ingore the signal for most of them), or handle the signal itself. Afterall, most signals can just be caught, handled and the program wouldn't necessarily need to abort execution, in some cases aborting is the only reasonable way forward; with SIGTERM it is the only way to go (it cannot be caught).<\/p>\n
    Let's assume a C program like this. We have a main routine, where we set a pointer into some memory, and write to it in a loop.<\/p>\n
    <\/span>#include<\/span> <\/span><stdint.h><\/span><\/code><\/span>\n<\/span>\nint<\/span> <\/span>main<\/span> <\/span>()<\/span> <\/span>{<\/span><\/span>\n    <\/span>uint8_t<\/span>*<\/span> <\/span>ptr<\/span> <\/span>=<\/span> <\/span>(<\/span>void<\/span>*<\/span>)<\/span>0x400000000000<\/span>;<\/span><\/span>\n    <\/span>for<\/span> <\/span>(<\/span> <\/span>int<\/span> <\/span>i<\/span> <\/span>=<\/span> <\/span>0<\/span>;<\/span> <\/span>i<\/span><<\/span>8192<\/span>;<\/span> <\/span>i<\/span>++<\/span> <\/span>)<\/span> <\/span>{<\/span><\/span>\n        <\/span>*<\/span>ptr<\/span> <\/span>=<\/span> <\/span>3<\/span>;<\/span><\/span>\n        <\/span>ptr<\/span>++<\/span>;<\/span><\/span>\n    <\/span>}<\/span><\/span>\n}<\/span><\/span>\n<\/span><\/pre><\/div>\n
    Trying it out, we will receive a SIGSEGV (Segmentation Fault), the exact output could depend on your shell:<\/p>\n
    <\/span>$ <\/span>gcc <\/span>main.c<\/code><\/span>\n$ <\/span>.\/a.out<\/span>\nfish: <\/span>Job <\/span>1<\/span>, <\/span>'.\/a.out'<\/span> <\/span>terminated <\/span>by <\/span>signal <\/span>SIGSEGV <\/span>(<\/span>Segmentation <\/span>Fault)<\/span><\/span>\n<\/span><\/pre><\/div>\n
    Nothing unexpected here. Clearly the 0x4... pointer points into virtual memory, that was not mapped to the process. Writing to it will cause the processor to trap into a page fault handler, where the operating system checks the address. It will look in its internal data structure and map memory to the place, if it sees that there should be something mapped (see lazy paging or the growing stack). If there is nothing mapped, a SIGSEGV signal is sent to the offending process. The default behaviour of SIGSEGV is to abort program execution.<\/p>\n
    But we can overwrite the default action and define our own with [sigaction<\/a>]. If we set a signal handler for the SIGSEGV signal and map new memory into the space we just wanted to access, similar to [advent(2)<\/a>], then we will be able to run our program to completion. This is just an example of what we can do. Trying this in production will<\/strong> break things, and you should never ever just ignore a SIGSEGV. While we are purposely writing into some random memory, most programs will trash the stack, heap or other necessary data, way before jumping into random memory.<\/p>\n
    <\/span>\/\/ Have a look here: https:\/\/osg.tuhh.de\/Advent\/06-sigaction\/<\/span><\/code><\/span>\n#include<\/span> <\/span><stdint.h><\/span><\/span>\n#include<\/span> <\/span><stdlib.h><\/span><\/span>\n#include<\/span> <\/span><stdio.h><\/span><\/span>\n#include<\/span> <\/span><string.h><\/span><\/span>\n<\/span>\n#include<\/span> <\/span><signal.h><\/span><\/span>\n#include<\/span> <\/span><unistd.h><\/span><\/span>\n#include<\/span> <\/span><sys\/types.h><\/span><\/span>\n#include<\/span> <\/span><sys\/mman.h><\/span><\/span>\n<\/span>\n#define PAGE_SIZE 4096<\/span><\/span>\n<\/span>\nvoid<\/span> <\/span>sa_sigsegv<\/span>(<\/span>int<\/span> <\/span>signum<\/span>,<\/span> <\/span>siginfo_t<\/span>*<\/span> <\/span>info<\/span>,<\/span> <\/span>void<\/span>*<\/span> <\/span>context<\/span>)<\/span> <\/span>{<\/span><\/span>\n    <\/span>\/\/ Calculate the page address from the fault address<\/span><\/span>\n    <\/span>\/\/ 0xdeadbeef -> 0xdeadb000<\/span><\/span>\n    <\/span>uintptr_t<\/span> <\/span>addr<\/span> <\/span>=<\/span> <\/span>(<\/span>uintptr_t<\/span>)<\/span>info<\/span>-><\/span>si_addr<\/span>;<\/span><\/span>\n    <\/span>addr<\/span> <\/span>=<\/span> <\/span>addr<\/span> <\/span>&<\/span> <\/span>(<\/span>~<\/span> <\/span>(<\/span>PAGE_SIZE<\/span> <\/span>-<\/span> <\/span>1<\/span>));<\/span><\/span>\n<\/span>\n    <\/span>\/\/ MMAP one page of anonymous private memory to that location.<\/span><\/span>\n    <\/span>\/\/ Afterwards, the program can continue its way to perdition.<\/span><\/span>\n    <\/span>void<\/span> <\/span>*<\/span>ret<\/span> <\/span>=<\/span> <\/span>mmap<\/span>((<\/span>void<\/span>*<\/span>)<\/span>addr<\/span>,<\/span> <\/span>PAGE_SIZE<\/span>,<\/span><\/span>\n                     <\/span>PROT_READ<\/span>|<\/span>PROT_WRITE<\/span>,<\/span><\/span>\n                     <\/span>MAP_PRIVATE<\/span>|<\/span>MAP_ANONYMOUS<\/span>,<\/span><\/span>\n                     <\/span>-1<\/span>,<\/span> <\/span>0<\/span>);<\/span><\/span>\n    <\/span>if<\/span> <\/span>(<\/span>ret<\/span> <\/span>==<\/span> <\/span>MAP_FAILED<\/span>)<\/span> <\/span>{<\/span><\/span>\n        <\/span>perror<\/span>(<\/span>\"mmap\"<\/span>);<\/span><\/span>\n        <\/span>exit<\/span>(<\/span>-1<\/span>);<\/span><\/span>\n    <\/span>}<\/span><\/span>\n}<\/span><\/span>\n<\/span>\nint<\/span> <\/span>main<\/span> <\/span>()<\/span> <\/span>{<\/span><\/span>\n    <\/span>struct<\/span> <\/span>sigaction<\/span> <\/span>sa<\/span>;<\/span><\/span>\n    <\/span>memset<\/span>(<\/span>&<\/span>sa<\/span>,<\/span> <\/span>0<\/span>,<\/span> <\/span>sizeof<\/span>(<\/span>sa<\/span>));<\/span><\/span>\n    <\/span>sa<\/span>.<\/span>sa_flags<\/span>     <\/span>=<\/span> <\/span>SA_SIGINFO<\/span> <\/span>|<\/span> <\/span>SA_RESTART<\/span>;<\/span><\/span>\n    <\/span>sa<\/span>.<\/span>sa_sigaction<\/span> <\/span>=<\/span> <\/span>&<\/span>sa_sigsegv<\/span>;<\/span><\/span>\n    <\/span>sigemptyset<\/span>(<\/span>&<\/span>sa<\/span>.<\/span>sa_mask<\/span>);<\/span><\/span>\n    <\/span>if<\/span> <\/span>(<\/span>sigaction<\/span>(<\/span>SIGSEGV<\/span>,<\/span> <\/span>&<\/span>sa<\/span>,<\/span> <\/span>NULL<\/span>)<\/span> <\/span>!=<\/span> <\/span>0<\/span>)<\/span> <\/span>{<\/span><\/span>\n        <\/span>perror<\/span>(<\/span>\"sigaction\"<\/span>);<\/span><\/span>\n        <\/span>return<\/span> <\/span>-1<\/span>;<\/span><\/span>\n    <\/span>}<\/span><\/span>\n<\/span>\n    <\/span>uint8_t<\/span>*<\/span> <\/span>ptr<\/span> <\/span>=<\/span> <\/span>(<\/span>void<\/span>*<\/span>)<\/span>0x400000000000<\/span>;<\/span><\/span>\n    <\/span>for<\/span> <\/span>(<\/span> <\/span>int<\/span> <\/span>i<\/span> <\/span>=<\/span> <\/span>0<\/span>;<\/span> <\/span>i<\/span><<\/span>8096<\/span>;<\/span> <\/span>i<\/span>++<\/span> <\/span>)<\/span> <\/span>{<\/span><\/span>\n        <\/span>*<\/span>ptr<\/span> <\/span>=<\/span> <\/span>3<\/span>;<\/span><\/span>\n        <\/span>ptr<\/span>++<\/span>;<\/span><\/span>\n    <\/span>}<\/span><\/span>\n}<\/span><\/span>\n<\/span><\/pre><\/div>\n
    A Caveat<\/h3>\n
    Some of you reading this, will scream at the piece of code above. A signal handler can be called by the OS at any time<\/em>, so we have no information about locks that are held or the state of other threads. They could be in the kernel right now, trying to allocate memory or may be altering important global data structures.<\/p>\n
    Make no mistake, we are trying to do something useful in a Unix signal handler, which it is not there for. There are several sources warning developers about doing anything more than setting a global flag (and even that might be racey). Accessing global data is tabu, executing asynchronous calls, that could use locks internally is tabu. Let's just say, everything fun should not be avoided in signal handlers.<\/p>\n
    What we are about to do works for my friend, but it most definitely might not work for you. It is based on undefined behaviour, which might lead to nothing bad hapenning at all, random signals or crashes, subtle behavioural changes or nasal daemons.<\/p>\n
    What we want to achieve<\/h2>\n
    The above example shows a use case for a signal handler (ignoring the quite obvious warnings about signal handlers). Most of the times, SIGSEGV should not be overwritten, or if so only to print some more information (which is still undefined behaviour). Some signals, like SIGSEGV indicate a program error, that cannot be recovered from. When you receive SIGSEGV you cannot be certain, that all the process' memory is intact.<\/p>\n
    However. We want to run a Java-program, that links to native code via the Java Native Interface (JNI). The scenario is, that we have a library of legacy code, that cannot easily be ditched or rewritten in Java, so for the time being we will need to run this unsafe code and shield it, as good as we can, from potentially malicious user input.<\/p>\n
    Unsafe native code can however still crash. In C or C++ it is easy to forget the lifetime of your objects, forget to check a pointer for null or to ensure, that the object you want to call is the object you are trying to call. Java protects you from some of these errors with its type safety approach and garbage collection.<\/p>\n
    But, anyway. Your native code could crash, it could bring down your whole Java process with it. Remember, if we catch a SIGSEGV signal and if we don't handle it (assuming the Java JVM doesn't gracefully ignore it), the whole process is aborted, include everything that runs inside it, if that is a whole Tomcat webserver, it will come down as well. Very ungraceful.<\/p>\n
    So, let's try and catch the crash, gather some information and maybe even let our Java program catch an Exception and shut down somewhat gracefully.<\/p>\n
    Glueing it back together<\/h3>\n
    In my previous article we've set up a thin wrapper glue library, that is actually loaded by the Java VM, converts parameter types and jumps into our native C\/C++ code. Who says we can't use this library to have some fun?<\/p>\n
    Firstly, we will need a signal handler. This is were this mechanism could become quite unstable: the Java Virtual Machine uses signals itself, so overwriting or chaining signal handlers the wrong way can break (future versions) of our Java program, so I wouldn't recommend this approach to use in production. You've been warned.<\/p>\n
    But still, let's write ourselves a signal handler in our glue-library, that gathers a crash log, prints it to stderr and exits:<\/p>\n
    <\/span>void<\/span> <\/span>SignalHandler<\/span>(<\/span> <\/span>int<\/span> <\/span>signum<\/span>,<\/span> <\/span>siginfo_t<\/span>*<\/span> <\/span>si<\/span>,<\/span> <\/span>void<\/span>*<\/span> <\/span>uc<\/span> <\/span>)<\/span> <\/span>{<\/span><\/code><\/span>\n    <\/span>std<\/span>::<\/span>cerr<\/span> <\/span><<<\/span> <\/span>\"Signal \"<\/span> <\/span><<<\/span> <\/span>signum<\/span> <\/span><<<\/span> <\/span>\" (SIG\"<\/span> <\/span><<<\/span> <\/span>sigabbrev_np<\/span>(<\/span>signum<\/span>)<\/span> <\/span><<<\/span> <\/span>\")\"<\/span> <\/span><<<\/span> <\/span>std<\/span>::<\/span>endl<\/span>;<\/span><\/span>\n<\/span>\n    <\/span>void<\/span>**<\/span> <\/span>buffer<\/span> <\/span>=<\/span> <\/span>malloc<\/span>(<\/span>64<\/span> <\/span>*<\/span> <\/span>sizeof<\/span>(<\/span>void<\/span>*<\/span>));<\/span><\/span>\n    <\/span>int<\/span> <\/span>num<\/span> <\/span>=<\/span> <\/span>backtrace<\/span> <\/span>(<\/span> <\/span>buffer<\/span>,<\/span> <\/span>64<\/span> <\/span>);<\/span><\/span>\n    <\/span>backtrace_symbols_fd<\/span> <\/span>(<\/span> <\/span>buffer<\/span>,<\/span> <\/span>num<\/span>,<\/span> <\/span>STDERR_FILENO<\/span> <\/span>);<\/span><\/span>\n    <\/span>abort<\/span>();<\/span><\/span>\n}<\/span><\/span>\n<\/span>\njint<\/span> <\/span>JNI_OnLoad<\/span>(<\/span> <\/span>JavaVM<\/span>*<\/span> <\/span>vm<\/span>,<\/span> <\/span>void<\/span>*<\/span> <\/span>res<\/span> <\/span>)<\/span> <\/span>{<\/span><\/span>\n    <\/span>struct<\/span> <\/span>sigaction<\/span> <\/span>sa<\/span>;<\/span><\/span>\n    <\/span>memset<\/span>(<\/span>&<\/span>sa<\/span>,<\/span> <\/span>0<\/span>,<\/span> <\/span>sizeof<\/span>(<\/span>sa<\/span>));<\/span><\/span>\n    <\/span>sa<\/span>.<\/span>sa_flags<\/span>     <\/span>=<\/span> <\/span>SA_SIGINFO<\/span> <\/span>|<\/span> <\/span>SA_RESTART<\/span>;<\/span><\/span>\n    <\/span>sa<\/span>.<\/span>sa_sigaction<\/span> <\/span>=<\/span> <\/span>&<\/span>SignalHandler<\/span>;<\/span><\/span>\n    <\/span>sigemptyset<\/span>(<\/span>&<\/span>sa<\/span>.<\/span>sa_mask<\/span>);<\/span><\/span>\n    <\/span>if<\/span> <\/span>(<\/span>sigaction<\/span>(<\/span>SIGSEGV<\/span>,<\/span> <\/span>&<\/span>sa<\/span>,<\/span> <\/span>NULL<\/span>)<\/span> <\/span>!=<\/span> <\/span>0<\/span>)<\/span> <\/span>{<\/span><\/span>\n        <\/span>std<\/span>::<\/span>cout<\/span> <\/span><<<\/span> <\/span>\"[FATAL] sigaction failed\"<\/span> <\/span><<<\/span> <\/span>std<\/span>::<\/span>endl<\/span>;<\/span><\/span>\n        <\/span>return<\/span> <\/span>-1<\/span>;<\/span><\/span>\n    <\/span>}<\/span><\/span>\n<\/span>\n    <\/span>return<\/span> <\/span>JNI_VERSION_1_2<\/span>;<\/span><\/span>\n}<\/span><\/span>\n<\/span><\/pre><\/div>\n
    But are we actually registering a signal handler though? If we read a bit more of the JVM docs, we will find [Java: Signal Handling<\/a>] and [Java: Signal Chaining<\/a>]. If we just try to use this piece of code and not bother with anything else, our Java program will crash occasionally, for example when some NullPointer Exceptions would be thrown, or maybe when new objects will be allocated. That's no fun.<\/p>\n
    The JVM uses Unix Signals to detect null pointer accesses and uses those to generate a NullPointer Exception. It also uses Unix Signals to \"automatically\" grow Java stacks. We've just overwritten a used Signal Handler of our JVM, so we're hindering the JVM to do its job.<\/p>\n
    The JVM has a facility to catch Signals, that the JVM doesn't know what to do with: Signal Chaining. If we preload libjsig.so<\/code>, it will overwrite calls like sigaction<\/code>. This way and call to sigaction<\/code> is intercepted, it stores our signal handler internally. If the JVM catched a signal, that it cannot do anything useful with in it own handlers, it will call (chain) our signal handler behind it's own. <\/p>\n
    This behaviour includes some SIGSEGV errors (some are caught by JVM to implement an auto growing stack). This also means, we have no control over the real signal handler, but we can execute code, if signals are caught.<\/p>\n
    To preload libjsig.so<\/code>, so we'll load it before<\/strong> the libc, which would set sigaction<\/code> itself, we need to invoke our program with the LD_PRELOAD (see [ld.so<\/a>]) environment set:<\/p>\n
    <\/span>LD_PRELOAD=\/usr\/lib\/jvm\/java-17-openjdk\/lib\/server\/libjsig.so java -jar jnitest.jar<\/code><\/span>\n<\/span><\/pre><\/div>\n
    Sending a SIGSEGV to the process (or provoking one from native code), will lead to output like this:<\/p>\n
    <\/span>Hello<\/span> <\/span>World<\/span><\/code><\/span>\nSignal<\/span> <\/span>11<\/span> <\/span>(<\/span>SIGSEGV<\/span>)<\/span><\/span>\n\/<\/span>home<\/span>\/<\/span>naums<\/span>\/<\/span>jni<\/span>-<\/span>test<\/span>\/<\/span>build<\/span>\/<\/span>libJniGlue<\/span>.<\/span>so<\/span>(<\/span>SignalHandler<\/span>+<\/span>0xb0<\/span>)[<\/span>0x7f8034f96289<\/span>]<\/span><\/span>\n\/<\/span>usr<\/span>\/<\/span>lib<\/span>\/<\/span>libc<\/span>.<\/span>so<\/span>.<\/span>6<\/span>(<\/span>+<\/span>0x3e710<\/span>)[<\/span>0x7f8035188710<\/span>]<\/span><\/span>\n\/<\/span>home<\/span>\/<\/span>naums<\/span>\/<\/span>jni<\/span>-<\/span>test<\/span>\/<\/span>build<\/span>\/<\/span>libJniNative<\/span>.<\/span>so<\/span>(<\/span>native_hello_world<\/span>+<\/span>0x3f<\/span>)[<\/span>0x7f8034f8c158<\/span>]<\/span><\/span>\n\/<\/span>home<\/span>\/<\/span>naums<\/span>\/<\/span>jni<\/span>-<\/span>test<\/span>\/<\/span>build<\/span>\/<\/span>libJniGlue<\/span>.<\/span>so<\/span>(<\/span>Java_de_snaums_jnitest_java_1hello_1world<\/span>+<\/span>0x15<\/span>)[<\/span>0x7f8034f96394<\/span>]<\/span><\/span>\n[<\/span>0x7f801c74453a<\/span>]<\/span><\/span>\nfish<\/span>:<\/span> <\/span>Job<\/span> <\/span>1<\/span>,<\/span> <\/span>'java -jar jnitest.jar'<\/span> <\/span>terminated<\/span> <\/span>by<\/span> <\/span>signal<\/span> <\/span>SIGABRT<\/span> <\/span>(<\/span>Abbruch<\/span>)<\/span><\/span>\n<\/span><\/pre><\/div>\n
    So now we have a backtrace on stderr. <\/p>\n
    Longjumping back to Java<\/h3>\n
    Nice, we get a backtrace, this should at least help to identify problems and fix them in the native code, if they arise. But our process is still gone.<\/p>\n
    Maybe you've found the functions setjmp<\/code> and longjmp<\/code> before, and maybe you've wondered about what they could be used for. These functions perform a \"nonlocal goto\", which is not that useful of a description if you're new to them. <\/p>\n
    In essence, setjmp<\/code> stores the current processor state, and longjmp<\/code> returns back to it. They will not alter any (global) data, they won't unwind the stack, they will quite literally just jump<\/strong> back, like a goto. setjmp<\/code> in a sense returns two times: once setting the jump, once returning through longjmp<\/code>. One could use it to implement exceptions and their non-local returns (if you don't need stack-unwinding, that is).<\/p>\n
    Let's first see, how we use setjmp<\/code> normally, albeit a bit useless:<\/p>\n
    <\/span>#include<\/span> <\/span><iostream><\/span><\/code><\/span>\n#include<\/span> <\/span><setjmp.h><\/span><\/span>\n<\/span>\nint<\/span> <\/span>main<\/span>()<\/span> <\/span>{<\/span><\/span>\n    <\/span>jmp_buf<\/span> <\/span>buf<\/span>;<\/span><\/span>\n    <\/span>std<\/span>::<\/span>cout<\/span> <\/span><<<\/span> <\/span>\"Starting program\"<\/span> <\/span><<<\/span> <\/span>std<\/span>::<\/span>endl<\/span>;<\/span><\/span>\n<\/span>\n    <\/span>\/\/ first return: rc will be 0<\/span><\/span>\n    <\/span>\/\/ second return: will be 1 (set by longjmp)<\/span><\/span>\n    <\/span>int<\/span> <\/span>rc<\/span> <\/span>=<\/span> <\/span>setjmp<\/span>(<\/span>buf<\/span>);<\/span><\/span>\n<\/span>\n    <\/span>std<\/span>::<\/span>cout<\/span> <\/span><<<\/span> <\/span>\"Starting calculation\"<\/span> <\/span><<<\/span> <\/span>std<\/span>::<\/span>endl<\/span>;<\/span><\/span>\n    <\/span>\/\/ some random maths<\/span><\/span>\n    <\/span>int<\/span> <\/span>c<\/span>;<\/span><\/span>\n    <\/span>int<\/span> <\/span>d<\/span> <\/span>=<\/span> <\/span>c<\/span> <\/span>+<\/span> <\/span>12<\/span>;<\/span><\/span>\n    <\/span>c<\/span> <\/span>=<\/span> <\/span>30<\/span>;<\/span><\/span>\n<\/span>\n    <\/span>std<\/span>::<\/span>cout<\/span> <\/span><<<\/span> <\/span>\"Value of d:\"<\/span> <\/span><<<\/span> <\/span>d<\/span> <\/span><<<\/span> <\/span>std<\/span>::<\/span>endl<\/span>;<\/span><\/span>\n<\/span>\n    <\/span>if<\/span> <\/span>(<\/span> <\/span>rc<\/span> <\/span>==<\/span> <\/span>0<\/span> <\/span>)<\/span> <\/span>{<\/span><\/span>\n        <\/span>longjmp<\/span> <\/span>(<\/span> <\/span>buf<\/span>,<\/span> <\/span>1<\/span> <\/span>);<\/span><\/span>\n    <\/span>}<\/span><\/span>\n<\/span>\n    <\/span>return<\/span> <\/span>0<\/span>;<\/span><\/span>\n}<\/span><\/span>\n<\/span><\/pre><\/div>\n
    <\/span>$ <\/span>g++ <\/span>setjmp.cpp<\/code><\/span>\n$ <\/span>.\/a.out<\/span>\nStarting <\/span>program<\/span>\nStarting <\/span>calculation<\/span>\nValue <\/span>of <\/span>d:32674<\/span>\nStarting <\/span>calculation<\/span>\nValue <\/span>of <\/span>d:42<\/span>\n<\/span><\/pre><\/div>\n
    Ah, hang on. What happened here? We've forgot to initialize c<\/code>, so it is unitialized when we first start. The value of d<\/code> is calculated from c<\/code>. Then we set c<\/code> to 30. On our second pass through (returning a second time from setjmp<\/code>), we use the correct value of c<\/code>. So setjmp<\/code> and longjmp<\/code> cannot be used to turn back time, but rather to jump to more or less arbitrary places in your program more or less safely (a lot safer, than if you were to implement a non-local jump yourself in assembly).<\/p>\n
    Now, we can use it to return control back to our Java program and maybe raise an Exception, so the Java-side could in theory shutdown cleanly. So we extend our glue-library:<\/p>\n
    <\/span>static<\/span> <\/span>jmp_buf<\/span> <\/span>longjmp_buffer<\/span>;<\/span><\/code><\/span>\n<\/span>\nvoid<\/span> <\/span>SignalHandler<\/span>(<\/span> <\/span>int<\/span> <\/span>signum<\/span>,<\/span> <\/span>siginfo_t<\/span>*<\/span> <\/span>si<\/span>,<\/span> <\/span>void<\/span>*<\/span> <\/span>uc<\/span> <\/span>)<\/span> <\/span>{<\/span><\/span>\n    <\/span>std<\/span>::<\/span>cerr<\/span> <\/span><<<\/span> <\/span>\"Signal \"<\/span> <\/span><<<\/span> <\/span>signum<\/span> <\/span><<<\/span> <\/span>\" (SIG\"<\/span> <\/span><<<\/span> <\/span>sigabbrev_np<\/span>(<\/span>signum<\/span>)<\/span> <\/span><<<\/span> <\/span>\")\"<\/span> <\/span><<<\/span> <\/span>std<\/span>::<\/span>endl<\/span>;<\/span><\/span>\n<\/span>\n    <\/span>void<\/span>**<\/span> <\/span>buffer<\/span> <\/span>=<\/span> <\/span>(<\/span>void<\/span>**<\/span>)<\/span> <\/span>malloc<\/span>(<\/span>64<\/span> <\/span>*<\/span> <\/span>sizeof<\/span>(<\/span>void<\/span>*<\/span>));<\/span><\/span>\n    <\/span>int<\/span> <\/span>num<\/span> <\/span>=<\/span> <\/span>backtrace<\/span> <\/span>(<\/span> <\/span>buffer<\/span>,<\/span> <\/span>64<\/span> <\/span>);<\/span><\/span>\n    <\/span>backtrace_symbols_fd<\/span> <\/span>(<\/span> <\/span>buffer<\/span>,<\/span> <\/span>num<\/span>,<\/span> <\/span>STDERR_FILENO<\/span> <\/span>);<\/span><\/span>\n    <\/span>\/\/ here we jump back to the glue-function<\/span><\/span>\n    <\/span>longjmp<\/span>(<\/span> <\/span>longjmp_buffer<\/span>,<\/span> <\/span>1<\/span> <\/span>);<\/span><\/span>\n}<\/span><\/span>\n<\/span>\n\/\/ JNI_OnLoad ...<\/span><\/span>\n<\/span>\n\/\/ we create and throw a NoClassDefFoundError exception<\/span><\/span>\njint<\/span> <\/span>throwException<\/span>(<\/span>JNIEnv<\/span>*<\/span> <\/span>env<\/span>)<\/span> <\/span>{<\/span><\/span>\n    <\/span>jclass<\/span> <\/span>exClass<\/span>;<\/span><\/span>\n    <\/span>char<\/span> <\/span>*<\/span>className<\/span> <\/span>=<\/span> <\/span>\"java\/lang\/NoClassDefFoundError\"<\/span>;<\/span><\/span>\n<\/span>\n    <\/span>exClass<\/span> <\/span>=<\/span> <\/span>env<\/span>-><\/span>FindClass<\/span>(<\/span>className<\/span>);<\/span><\/span>\n    <\/span>if<\/span> <\/span>(<\/span>exClass<\/span> <\/span>==<\/span> <\/span>NULL<\/span>)<\/span> <\/span>{<\/span><\/span>\n        <\/span>std<\/span>::<\/span>cerr<\/span> <\/span><<<\/span> <\/span>\"Could not find NoClassDefFoundError, Aborting\"<\/span> <\/span><<<\/span> <\/span>std<\/span>::<\/span>endl<\/span>;<\/span><\/span>\n        <\/span>abort<\/span>();<\/span><\/span>\n    <\/span>}<\/span><\/span>\n<\/span>\n    <\/span>return<\/span> <\/span>env<\/span>-><\/span>ThrowNew<\/span>(<\/span>exClass<\/span>,<\/span> <\/span>\"A JNI Problen occurred\"<\/span>);<\/span><\/span>\n}<\/span><\/span>\n<\/span>\nvoid<\/span> <\/span>Java_de_snaums_jnitest_java_1hello_1world<\/span> <\/span><\/span>\n    <\/span>(<\/span>JNIEnv<\/span> <\/span>*<\/span> <\/span>env<\/span>,<\/span> <\/span>jclass<\/span> <\/span>cls<\/span>)<\/span> <\/span>{<\/span><\/span>\n        <\/span>\/\/ setting the longjmp. The second time (error case), we'll<\/span><\/span>\n        <\/span>\/\/ raise an exception<\/span><\/span>\n        <\/span>if<\/span> <\/span>(<\/span> <\/span>setjmp<\/span> <\/span>(<\/span> <\/span>longjmp_buffer<\/span> <\/span>)<\/span> <\/span>==<\/span> <\/span>0<\/span> <\/span>)<\/span> <\/span>{<\/span><\/span>\n            <\/span>native_hello_world<\/span>();<\/span><\/span>\n        <\/span>}<\/span> <\/span>else<\/span> <\/span>{<\/span><\/span>\n            <\/span>throwException<\/span>(<\/span> <\/span>env<\/span> <\/span>);<\/span><\/span>\n        <\/span>}<\/span><\/span>\n}<\/span><\/span>\n<\/span>\njint<\/span> <\/span>Java_de_snaums_jnitest_java_1sum<\/span><\/span>\n    <\/span>(<\/span>JNIEnv<\/span> <\/span>*<\/span>env<\/span>,<\/span> <\/span>jclass<\/span> <\/span>cls<\/span>,<\/span> <\/span>jint<\/span> <\/span>first<\/span>,<\/span> <\/span>jint<\/span> <\/span>second<\/span>)<\/span> <\/span>{<\/span><\/span>\n        <\/span>\/\/ setting the longjmp. The second time (error case), we'll<\/span><\/span>\n        <\/span>\/\/ raise an exception<\/span><\/span>\n        <\/span>if<\/span> <\/span>(<\/span> <\/span>setjmp<\/span> <\/span>(<\/span> <\/span>longjmp_buffer<\/span> <\/span>)<\/span> <\/span>==<\/span> <\/span>0<\/span> <\/span>)<\/span> <\/span>{<\/span><\/span>\n            <\/span>return<\/span> <\/span>(<\/span>jint<\/span>)<\/span> <\/span>native_sum<\/span>(<\/span> <\/span>(<\/span>int<\/span>)<\/span>first<\/span>,<\/span> <\/span>(<\/span>int<\/span>)<\/span>second<\/span> <\/span>);<\/span><\/span>\n        <\/span>}<\/span> <\/span>else<\/span> <\/span>{<\/span><\/span>\n            <\/span>throwException<\/span>(<\/span> <\/span>env<\/span> <\/span>);<\/span><\/span>\n        <\/span>}<\/span><\/span>\n}<\/span><\/span>\n<\/span><\/pre><\/div>\n
    So, the output is, if I introduce a write access to nullpointer in native_hello_world<\/code>:<\/p>\n
    <\/span>$ <\/span>java <\/span>-jar <\/span>jnitest.jar<\/code><\/span>\nHello <\/span>World<\/span>\nSignal <\/span>11<\/span> <\/span>(<\/span>SIGSEGV)<\/span><\/span>\n\/home\/naums\/jni-test\/build\/libJniGlue.so(<\/span>SignalHandler+0xb0)[<\/span>0x7fd09b1942d9]<\/span><\/span>\n\/usr\/lib\/libc.so.6(<\/span>+0x3e710)[<\/span>0x7fd09b35a710]<\/span><\/span>\n\/home\/naums\/jni-test\/build\/libJniNative.so(<\/span>native_hello_world+0x3f)[<\/span>0x7fd09b18a158]<\/span><\/span>\n\/home\/naums\/jni-test\/build\/libJniGlue.so(<\/span>Java_de_snaums_jnitest_java_1hello_1world+0x2d)[<\/span>0x7fd09b19448c]<\/span><\/span>\n[<\/span>0x7fd08474453a]<\/span><\/span>\nException <\/span>in<\/span> <\/span>thread <\/span>\"main\"<\/span> <\/span>java.lang.NoClassDefFoundError: <\/span>A <\/span>JNI <\/span>Problen <\/span>occurred<\/span>\n    <\/span>at <\/span>de.snaums.jnitest.java_hello_world(<\/span>Native <\/span>Method)<\/span><\/span>\n    <\/span>at <\/span>de.snaums.fun.main(<\/span>fun.java:10)<\/span><\/span>\n<\/span><\/pre><\/div>\n
    We've thrown NoClassDefFoundError as a placeholder, you might want to lookup a list of predefined Exceptions or create a new Exception class yourself to throw. The only thing missing is to catch this Exception, I leave it as a task for the reader.<\/p>\n
    Oh Stack, my Stack<\/h2>\n
    So we've solved the SIGSEGV problem, right? Right?<\/p>\n
    Yeah, no. We receive a SIGSEGV when we try to write a memory location that does not belong to us, that includes random stray write to anywhere. But, a SIGSEGV would also be raised when your native stack is running out of room. Linux allocates an 8MB stack area (see ulimit<\/code>) for your processes. Your native stack will grow to that size automatically, but can't extend over that limit.<\/p>\n
    So, when we introduce an infinite recursion (in native_hello_world<\/code>) and fill our native stack, we should see a SIGSEGV and handle it in our handler.<\/p>\n
    <\/span>$ <\/span>LD_PRELOAD<\/span>=<\/span>\/usr\/lib\/jvm\/java-17-openjdk\/lib\/server\/libjsig.so  <\/span>java <\/span>-jar <\/span>jnitest.jar<\/code><\/span>\n...<\/span>\nHello <\/span>World<\/span>\nHello <\/span>World<\/span>\nHello <\/span>World<\/span>\nHello <\/span>World<\/span>\nfish: <\/span>Job <\/span>1<\/span>, <\/span>'java -jar jnitest.jar'<\/span> <\/span>terminated <\/span>by <\/span>signal <\/span>SIGSEGV <\/span>(<\/span>Segmentation <\/span>fault)<\/span><\/span>\n<\/span><\/pre><\/div>\n
    Aha! We get a SIGSEGV, but our native signal handler is not called. Well we've exhausted our stack area, so the libc has no room to place the return address and signal information on the stack and call our signal handler. This causes the process to receive a second SIGSEGV while trying to prepare handling the first one. Now the kernel will hard-abort our application.<\/p>\n
    Luckily in UNIX there is a function [sigaltstack<\/a>], with which we can register an alternative stack for signal handlers to use. Then, when a signal is caught the operating system will switch the signal handler to this alternate stack, place the return information on there, and starting our signal handler.<\/p>\n
    Let's try that in a normal C++-Test program:<\/p>\n
    <\/span>#include<\/span> <\/span><signal.h><\/span><\/code><\/span>\n#include<\/span> <\/span><sys\/mman.h><\/span><\/span>\n#include<\/span> <\/span><cstring><\/span><\/span>\n#include<\/span> <\/span><cstdlib><\/span><\/span>\n<\/span>\n#include<\/span> <\/span><iostream><\/span><\/span>\n<\/span>\n\/\/ we could also use SIGSTKSZ<\/span><\/span>\n#define SIGNAL_STACK_SIZE 4096*4<\/span><\/span>\n<\/span>\nvoid<\/span> <\/span>setup_alternate_stack<\/span> <\/span>()<\/span> <\/span>{<\/span><\/span>\n    <\/span>int8_t<\/span> <\/span>*<\/span>mem<\/span> <\/span>=<\/span> <\/span>(<\/span> <\/span>int8_t<\/span> <\/span>*<\/span> <\/span>)<\/span>mmap<\/span>(<\/span> <\/span>NULL<\/span>,<\/span><\/span>\n                                    <\/span>SIGNAL_STACK_SIZE<\/span> <\/span>+<\/span> <\/span>2<\/span> <\/span>*<\/span> <\/span>getpagesize<\/span>(),<\/span><\/span>\n                                    <\/span>PROT_READ<\/span> <\/span>|<\/span> <\/span>PROT_WRITE<\/span>,<\/span> <\/span>MAP_PRIVATE<\/span> <\/span>|<\/span> <\/span>MAP_ANON<\/span>,<\/span><\/span>\n                                    <\/span>-1<\/span>,<\/span> <\/span>0<\/span> <\/span>);<\/span><\/span>\n    <\/span>if<\/span> <\/span>(<\/span> <\/span>mem<\/span> <\/span>==<\/span> <\/span>MAP_FAILED<\/span> <\/span>)<\/span><\/span>\n    <\/span>{<\/span><\/span>\n        <\/span>std<\/span>::<\/span>cout<\/span><<<\/span> <\/span>\"[FATAL] Unable to mmap Signal stack \"<\/span> <\/span><<<\/span> <\/span>std<\/span>::<\/span>endl<\/span>;<\/span><\/span>\n    <\/span>}<\/span><\/span>\n    <\/span>else<\/span><\/span>\n    <\/span>{<\/span><\/span>\n        <\/span>\/\/ We set up 2 Guard pages, one before our stack, one after<\/span><\/span>\n        <\/span>\/\/ so if we write over the end while executing the signal handler<\/span><\/span>\n        <\/span>\/\/ we will be killed (safely)<\/span><\/span>\n        <\/span>mprotect<\/span>(<\/span> <\/span>mem<\/span>,<\/span> <\/span>getpagesize<\/span>(),<\/span> <\/span>PROT_NONE<\/span> <\/span>);<\/span><\/span>\n        <\/span>mprotect<\/span>(<\/span> <\/span>mem<\/span> <\/span>+<\/span> <\/span>getpagesize<\/span>()<\/span> <\/span>+<\/span> <\/span>SIGNAL_STACK_SIZE<\/span>,<\/span> <\/span>getpagesize<\/span>(),<\/span> <\/span>PROT_NONE<\/span> <\/span>);<\/span><\/span>\n<\/span>\n        <\/span>stack_t<\/span> <\/span>ss<\/span>;<\/span><\/span>\n        <\/span>memset<\/span>(<\/span> <\/span>&<\/span>ss<\/span>,<\/span> <\/span>0<\/span>,<\/span> <\/span>sizeof<\/span>(<\/span> <\/span>stack_t<\/span> <\/span>)<\/span> <\/span>);<\/span><\/span>\n        <\/span>ss<\/span>.<\/span>ss_flags<\/span> <\/span>=<\/span> <\/span>0<\/span>;<\/span><\/span>\n        <\/span>ss<\/span>.<\/span>ss_size<\/span> <\/span>=<\/span> <\/span>SIGNAL_STACK_SIZE<\/span>;<\/span><\/span>\n        <\/span>ss<\/span>.<\/span>ss_sp<\/span> <\/span>=<\/span> <\/span>mem<\/span> <\/span>+<\/span> <\/span>getpagesize<\/span>();;<\/span><\/span>\n<\/span>\n        <\/span>stack_t<\/span> <\/span>os<\/span>;<\/span><\/span>\n        <\/span>memset<\/span>(<\/span> <\/span>&<\/span>os<\/span>,<\/span> <\/span>0<\/span>,<\/span> <\/span>sizeof<\/span>(<\/span> <\/span>stack_t<\/span> <\/span>)<\/span> <\/span>);<\/span><\/span>\n        <\/span>int<\/span> <\/span>rc<\/span> <\/span>=<\/span> <\/span>0<\/span>;<\/span><\/span>\n        <\/span>rc<\/span> <\/span>=<\/span> <\/span>sigaltstack<\/span>(<\/span> <\/span>&<\/span>ss<\/span>,<\/span> <\/span>&<\/span>os<\/span> <\/span>);<\/span><\/span>\n        <\/span>if<\/span> <\/span>(<\/span> <\/span>rc<\/span> <\/span>!=<\/span> <\/span>0<\/span> <\/span>)<\/span><\/span>\n        <\/span>{<\/span><\/span>\n            <\/span>std<\/span>::<\/span>cout<\/span> <\/span><<<\/span> <\/span>\"[FATAL] Setting alternate signal stack failed \"<\/span> <\/span><<<\/span> <\/span>std<\/span>::<\/span>endl<\/span>;<\/span><\/span>\n        <\/span>}<\/span><\/span>\n        <\/span>else<\/span><\/span>\n        <\/span>{<\/span><\/span>\n            <\/span>std<\/span>::<\/span>cout<\/span> <\/span><<<\/span> <\/span>\"[INFO ] Set alternate signal stack \"<\/span> <\/span><<<\/span> <\/span>std<\/span>::<\/span>endl<\/span>;<\/span><\/span>\n        <\/span>}<\/span><\/span>\n        <\/span>std<\/span>::<\/span>cout<\/span> <\/span><<<\/span> <\/span>\"Original stack: \"<\/span> <\/span><<<\/span> <\/span>os<\/span>.<\/span>ss_sp<\/span> <\/span><<<\/span> <\/span>\" size \"<\/span> <\/span><<<\/span> <\/span>os<\/span>.<\/span>ss_size<\/span> <\/span><<<\/span> <\/span>\" flags \"<\/span> <\/span><<<\/span> <\/span>os<\/span>.<\/span>ss_flags<\/span> <\/span><<<\/span> <\/span>std<\/span>::<\/span>endl<\/span>;<\/span><\/span>\n    <\/span>}<\/span><\/span>\n}<\/span><\/span>\n<\/span>\nvoid<\/span> <\/span>recurse<\/span>(<\/span>int<\/span> <\/span>b<\/span>)<\/span> <\/span>{<\/span><\/span>\n    <\/span>int<\/span> <\/span>a<\/span> <\/span>=<\/span> <\/span>12<\/span>;<\/span><\/span>\n    <\/span>recurse<\/span>(<\/span>a<\/span>);<\/span><\/span>\n}<\/span><\/span>\n<\/span>\nvoid<\/span> <\/span>SignalHandler<\/span>(<\/span>int<\/span> <\/span>signum<\/span>,<\/span> <\/span>siginfo_t<\/span>*<\/span> <\/span>si<\/span>,<\/span> <\/span>void<\/span>*<\/span> <\/span>ucontext<\/span>)<\/span> <\/span>{<\/span><\/span>\n    <\/span>std<\/span>::<\/span>cout<\/span> <\/span><<<\/span> <\/span>\"Hello from Stack \"<\/span> <\/span><<<\/span> <\/span>&<\/span>signum<\/span> <\/span><<<\/span> <\/span>std<\/span>::<\/span>endl<\/span>;<\/span><\/span>\n    <\/span>abort<\/span>();<\/span><\/span>\n}<\/span><\/span>\n<\/span>\nint<\/span> <\/span>main<\/span>()<\/span> <\/span>{<\/span><\/span>\n    <\/span>setup_alternate_stack<\/span>();<\/span><\/span>\n<\/span>\n    <\/span>struct<\/span> <\/span>sigaction<\/span> <\/span>sa<\/span>;<\/span><\/span>\n    <\/span>memset<\/span>(<\/span>&<\/span>sa<\/span>,<\/span> <\/span>0<\/span>,<\/span> <\/span>sizeof<\/span>(<\/span>sa<\/span>));<\/span><\/span>\n    <\/span>\/\/ SA_ONSTACK is needed for the handler to run on the alternate stack<\/span><\/span>\n    <\/span>sa<\/span>.<\/span>sa_flags<\/span>     <\/span>=<\/span> <\/span>SA_SIGINFO<\/span> <\/span>|<\/span> <\/span>SA_RESTART<\/span> <\/span>|<\/span> <\/span>SA_ONSTACK<\/span>;<\/span><\/span>\n    <\/span>sa<\/span>.<\/span>sa_sigaction<\/span> <\/span>=<\/span> <\/span>&<\/span>SignalHandler<\/span>;<\/span><\/span>\n    <\/span>sigemptyset<\/span>(<\/span>&<\/span>sa<\/span>.<\/span>sa_mask<\/span>);<\/span><\/span>\n    <\/span>if<\/span> <\/span>(<\/span>sigaction<\/span>(<\/span>SIGSEGV<\/span>,<\/span> <\/span>&<\/span>sa<\/span>,<\/span> <\/span>NULL<\/span>)<\/span> <\/span>!=<\/span> <\/span>0<\/span>)<\/span> <\/span>{<\/span><\/span>\n        <\/span>std<\/span>::<\/span>cout<\/span> <\/span><<<\/span> <\/span>\"[FATAL] sigaction failed\"<\/span> <\/span><<<\/span> <\/span>std<\/span>::<\/span>endl<\/span>;<\/span><\/span>\n        <\/span>return<\/span> <\/span>-1<\/span>;<\/span><\/span>\n    <\/span>}<\/span><\/span>\n<\/span>\n    <\/span>recurse<\/span>(<\/span>12<\/span>);<\/span><\/span>\n}<\/span><\/span>\n<\/span><\/pre><\/div>\n
    Yes, this works.<\/p>\n
    <\/span>[<\/span>INFO<\/span> <\/span>]<\/span> <\/span>Set<\/span> <\/span>alternate<\/span> <\/span>signal<\/span> <\/span>stack<\/span><\/code><\/span>\nOriginal<\/span> <\/span>stack<\/span>:<\/span> <\/span>0<\/span> <\/span>size<\/span> <\/span>0<\/span> <\/span>flags<\/span> <\/span>2<\/span><\/span>\nHello<\/span> <\/span>from<\/span> <\/span>Stack<\/span> <\/span>0x7f6f59a7e9ac<\/span><\/span>\nfish<\/span>:<\/span> <\/span>Job<\/span> <\/span>1<\/span>,<\/span> <\/span>'.\/a.out'<\/span> <\/span>terminated<\/span> <\/span>by<\/span> <\/span>signal<\/span> <\/span>SIGABRT<\/span> <\/span>(<\/span>Abbruch<\/span>)<\/span><\/span>\n<\/span><\/pre><\/div>\n
    Now let's try it with Java, adding the alt-stack:<\/p>\n
    <\/span>LD_PRELOAD<\/span>=\/<\/span>usr<\/span>\/<\/span>lib<\/span>\/<\/span>jvm<\/span>\/<\/span>java<\/span>-<\/span>17<\/span>-<\/span>openjdk<\/span>\/<\/span>lib<\/span>\/<\/span>server<\/span>\/<\/span>libjsig<\/span>.<\/span>so<\/span> <\/span>java<\/span> <\/span>-<\/span>jar<\/span> <\/span>jnitest<\/span>.<\/span>jar<\/span><\/code><\/span>\n...<\/span><\/span>\nHello<\/span> <\/span>World<\/span><\/span>\nHello<\/span> <\/span>World<\/span><\/span>\nfish<\/span>:<\/span> <\/span>Job<\/span> <\/span>1<\/span>,<\/span> <\/span>'LD_PRELOAD=\/usr\/lib\/jvm\/java-17…'<\/span> <\/span>terminated<\/span> <\/span>by<\/span> <\/span>signal<\/span> <\/span>SIGSEGV<\/span> <\/span>(<\/span>Adressbereichsfehler<\/span>)<\/span><\/span>\n<\/span><\/pre><\/div>\n
    Hm, funny. It doesn't work.<\/p>\n
    Let's remind ourselves, Java handles (some) signals itself, like SIGSEGV. Java needs to handle some signals itself, so it registers its own signal handlers with the system. Preloading libjsig.so<\/code> will prevent the native code from registering its native handlers with the system, rather the JVM stores them and will chain them after its own handlers.<\/p>\n
    This also means, that the Java signal handlers would run on the alternate stack, if this were successful. Unfortunately it isn't. Look at our pure C++ example from above. We've added a flag to our sigaction<\/code> call: SA_ONSTACK<\/code>. This is necessary, so the Signal Handler will be using our alternate stack. If it is missing, the alternate stack is not used for this signal handler. And this missing flag is our problem here. <\/p>\n
    Unfortunately there is no way for us to overwrite the JVMs signal registrations.<\/p>\n
    Going Bonkers<\/h3>\n
    Or is there?<\/p>\n
    Remember, libjsig<\/code> intercepts sigaction<\/code>, but it cannot intercept the pure systemcall if we manage to call it ourselves. Funnily enough, the libc presents us a \"nice\" wrapper for it, the syscall<\/code> function. Let's use it to call sigaction on the Java SIGSEGV handler and hard-set the SA_ONSTACK<\/code> flag.<\/p>\n
    <\/span>#include<\/span> <\/span><sys\/syscall.h><\/span><\/code><\/span>\n#include<\/span> <\/span><unistd.h><\/span><\/span>\n<\/span>\n\/\/ this is stupid, do never do this in real life<\/span><\/span>\nstruct<\/span> <\/span>sigaction<\/span> <\/span>java_handler<\/span>;<\/span><\/span>\nsyscall<\/span>(<\/span> <\/span>SYS_rt_sigaction<\/span>,<\/span> <\/span>SIGSEGV<\/span>,<\/span> <\/span>nullptr<\/span>,<\/span> <\/span>&<\/span>java_handler<\/span>,<\/span> <\/span>sizeof<\/span>(<\/span> <\/span>sigset_t<\/span> <\/span>)<\/span> <\/span>);<\/span><\/span>\nif<\/span> <\/span>(<\/span> <\/span>java_handler<\/span>.<\/span>sa_handler<\/span> <\/span>!=<\/span> <\/span>SIG_DFL<\/span> <\/span>)<\/span> <\/span>{<\/span><\/span>\n    <\/span>std<\/span>::<\/span>cout<\/span> <\/span><<<\/span> <\/span>\"attempting something very stupid\"<\/span> <\/span><<<\/span> <\/span>std<\/span>::<\/span>endl<\/span>;<\/span><\/span>\n    <\/span>java_handler<\/span>.<\/span>sa_flags<\/span> <\/span>|=<\/span> <\/span>SA_ONSTACK<\/span>;<\/span><\/span>\n    <\/span>syscall<\/span>(<\/span> <\/span>SYS_rt_sigaction<\/span>,<\/span> <\/span>SIGSEGV<\/span>,<\/span> <\/span>&<\/span>java_handler<\/span>,<\/span> <\/span>nullptr<\/span>,<\/span> <\/span>sizeof<\/span>(<\/span> <\/span>sigset_t<\/span> <\/span>)<\/span> <\/span>);<\/span><\/span>\n}<\/span><\/span>\n<\/span><\/pre><\/div>\n
    We call it twice here, first to get the old handler back, so the one that the JVM set, we'll add the SA_ONSTACK<\/code> flag, and set the structure again.<\/p>\n
    Even if we place this code right before the recursion call, we will have no luck, unfortunately.<\/p>\n
    <\/span>...<\/span><\/code><\/span>\nHello<\/span> <\/span>World<\/span><\/span>\nattempting<\/span> <\/span>something<\/span> <\/span>very<\/span> <\/span>stupid<\/span><\/span>\nfish<\/span>:<\/span> <\/span>Job<\/span> <\/span>1<\/span>,<\/span> <\/span>'LD_PRELOAD=\/usr\/lib\/jvm\/java-17…'<\/span> <\/span>terminated<\/span> <\/span>by<\/span> <\/span>signal<\/span> <\/span>SIGSEGV<\/span> <\/span>(<\/span>Adressbereichsfehler<\/span>)<\/span><\/span>\n<\/span><\/pre><\/div>\n
    Somewhere in the JVM it probably resets the handlers or maybe the JVM expects to be on it's normal C stack? I was unable to find out the reason, and more altering of the JVM from the outside would not increase or guarantee coverage. So let's stop here.<\/p>\n
    Conclusion<\/h2>\n
    In this article we've seen that we (sometimes) are able to use signal handlers and signal chaining in native code linked to a Java VM via Java Native Interface (JNI) to handle some errors, report backtraces and maybe even raise exceptions and return to Java. The Java world should then be as short as possible, never allocate more memory, just shut down and maybe restart.<\/p>\n
    Keep in mind, that most of what we've done in our signal handlers is illegal and may introduce security bugs, leak data or both. So while this is a nice technical excersice, it should never be used in production code. Also there are some native bugs, that cannot be reported by this method, so using a solid mechanism to get coredumps externally should be used, to at least find the bugs that crash the legacy code and eliminate them.<\/p>\n
    Image Reference<\/h2>\n
    We've created an oddly looking function, JNI_OnLoad. This function is called by Java, when the library is loaded. It is there to initialize the native library; many C libraries need to call an initializer function for preparing internal data structures before doing anything useful. We use it to register a signal handler. A similar function exists for Unloading a library, see [Java: Invocation API<\/a>];<\/p>\n