DynamoRIO / DynamoRIO/dynamorio
linux syscall hooks for native_exec, hotp_only, and thin_client
- Dominant language
- C
- Stars
- 3.2k
- Forks
- 629
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 30
Description
_From [bruen...@google.com](https://code.google.com/u/109494838902877177630/) on April 07, 2012 16:58:51_
this was PR 212012
this case covers implementing -native_exec_syscalls on Linux, needed for
native_exec, hotp_only, and thin_client.
one plan is to hook libc.so and vsyscall. however, some linux apps use
static libc, and even w/ vsyscall sysenter libc has inlined syscalls for
6-arg instances (e.g., mmap2). plus, it's much easier to roll your own
syscalls on linux, so library hooks are much more likely to be bypassed.
being in the kernel is the only surefire solution. also note that the
vsyscall page is not always possible to write to.
note that in addition to monitoring memory ops (for cache consistency) and process creation (for child presence) we also need to watch thread creation if we use any tls (which we now use pretty much everywhere)
perhaps ptrace could help if we don't need debugger interop
_Original issue: http://code.google.com/p/dynamorio/issues/detail?id=721_
Contributor guide
Assessment
This issue has not been assessed yet.