Upgrade to Pro — share decks privately, control downloads, hide ads and more …

benefits and drawbacks of syscall hooks/netdev0...

benefits and drawbacks of syscall hooks/netdev0x18-zpoline

Hajime Tazaki

July 19, 2024
Tweet

More Decks by Hajime Tazaki

Other Decks in Technology

Transcript

  1. what is syscall and why syscall hook ? what is

    syscall and why syscall hook ? 3
  2. binary rewriting (cont'd) binary rewriting (cont'd) syscall jmp 0xdeadbeef syscall

    0f 05 jmp 0xdeafbeef e9 de ad be af mov sysno %rax; syscall callq ${addr of handler} 11
  3. zpoline: how it works zpoline: how it works callq *%rax

    syscall nop nop callq *%rax %rax $ echo 0 > "/proc/sys/vm/mmap_min_addr" 14
  4. There ain't no such things as a free lunch There

    ain't no such things as a free lunch. . 18
  5. handling two universes in partial hooks handling two universes in

    partial hooks int hooked_select(pollfds[], nfds_t, int) { int host_fd = host_poll(); int user_fd = user_poll(); return (merge {host,user}_fd) } 20