DynamoRIO / DynamoRIO/dynamorio

linux syscall hooks for native_exec, hotp_only, and thin_client

Open
#721 2 comments 0 reactions 0 assignees View on GitHub
Migrated OpSys-Linux Priority-Low Type-Feature
Dominant language
C
Stars
3.2k
Forks
629
Avg merge
2d 18h
Merged PRs (30d)
30

Description

_From [bruen...@google.com](https://code.google.com/u/109494838902877177630/) on April 07, 2012 16:58:51_

this was PR 212012

this case covers implementing -native_exec_syscalls on Linux, needed for
native_exec, hotp_only, and thin_client.

one plan is to hook libc.so and vsyscall. however, some linux apps use
static libc, and even w/ vsyscall sysenter libc has inlined syscalls for
6-arg instances (e.g., mmap2). plus, it's much easier to roll your own
syscalls on linux, so library hooks are much more likely to be bypassed.
being in the kernel is the only surefire solution. also note that the
vsyscall page is not always possible to write to.

note that in addition to monitoring memory ops (for cache consistency) and process creation (for child presence) we also need to watch thread creation if we use any tls (which we now use pretty much everywhere)

perhaps ptrace could help if we don't need debugger interop

_Original issue: http://code.google.com/p/dynamorio/issues/detail?id=721_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.