Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
benefits and drawbacks of syscall hooks/netdev0...
Search
Hajime Tazaki
July 19, 2024
Technology
0
220
benefits and drawbacks of syscall hooks/netdev0x18-zpoline
https://netdevconf.info/0x18/sessions/talk/benefits-and-drawbacks-of-syscall-hooks.html
Hajime Tazaki
July 19, 2024
Tweet
Share
More Decks by Hajime Tazaki
See All by Hajime Tazaki
kernel offload with complete host kernel functionalities/netdev0x17-kernel-offload
thehajime
0
210
ライブラリOSを利用したコンテナランタイムの設計と実装/stairlab-seminar-23-ukontainer
thehajime
0
160
How to Design a Library OS for Practical Containers?/vee21-ukontainer
thehajime
0
720
containerd port to darwin - Toward Running Linux containers on macOS/fosdem21-darwin-containerd-ctr-devroom
thehajime
0
1.5k
Linux Container with Alternate Linux Kernel (Library)/container-runtime-meetup-202008-lkl
thehajime
2
1.9k
Linux Kernel Library - A Library Version of Linux Kernel/lkl-fosdem2020-uk-devroom
thehajime
0
1.1k
Is reimplementation of network stack a good idea or not? - Linux netdev 0x13 #netdevconf /linux-netdev-0x13-lkl
thehajime
1
330
Linux rumpkernel - ABC2018 (AsiaBSDCon 2018)
thehajime
0
2.1k
Network stack personality in Android phone - netdev 2.2
thehajime
0
1.2k
Other Decks in Technology
See All in Technology
ハノーファーメッセ2025で見た生成AI活用ユースケース.pdf
hamadakoji
1
500
20251027_findyさん_音声エージェントLT
almondo_event
2
480
AWS DMS で SQL Server を移行してみた/aws-dms-sql-server-migration
emiki
0
250
現場の壁を乗り越えて、 「計装注入」が拓く オブザーバビリティ / Beyond the Field Barriers: Instrumentation Injection and the Future of Observability
aoto
PRO
1
670
頭部ふわふわ浄酔器
uyupun
0
230
ソースを読む時の思考プロセスの例-MkDocs
sat
PRO
1
320
ViteとTypeScriptのProject Referencesで 大規模モノレポのUIカタログのリリースサイクルを高速化する
shuta13
3
220
20251029_Cursor Meetup Tokyo #02_MK_「あなたのAI、私のシェル」 - プロンプトインジェクションによるエージェントのハイジャック
mk0721
PRO
5
1.8k
CLIPでマルチモーダル画像検索 →とても良い
wm3
0
420
AI時代の発信活動 ~技術者として認知してもらうための発信法~ / 20251028 Masaki Okuda
shift_evolve
PRO
1
120
OTEPsで知るOpenTelemetryの未来 / Observability Conference Tokyo 2025
arthur1
0
310
Amazon Athena で JSON・Parquet・Iceberg のデータを検索し、性能を比較してみた
shigeruoda
1
160
Featured
See All Featured
Automating Front-end Workflow
addyosmani
1371
200k
Evolution of real-time – Irina Nazarova, EuRuKo, 2024
irinanazarova
9
1k
Become a Pro
speakerdeck
PRO
29
5.6k
JavaScript: Past, Present, and Future - NDC Porto 2020
reverentgeek
52
5.7k
Put a Button on it: Removing Barriers to Going Fast.
kastner
60
4k
Docker and Python
trallard
46
3.6k
GitHub's CSS Performance
jonrohan
1032
470k
Helping Users Find Their Own Way: Creating Modern Search Experiences
danielanewman
30
2.9k
The Straight Up "How To Draw Better" Workshop
denniskardys
238
140k
Large-scale JavaScript Application Architecture
addyosmani
514
110k
Sharpening the Axe: The Primacy of Toolmaking
bcantrill
46
2.5k
The Art of Delivering Value - GDevCon NA Keynote
reverentgeek
16
1.7k
Transcript
benefits and drawbacks of syscall benefits and drawbacks of syscall
hooks hooks  1
introduction introduction 2
what is syscall and why syscall hook ? what is
syscall and why syscall hook ? 3
recap: how syscall works ? recap: how syscall works ?
4
change the behavior of syscall ? change the behavior of
syscall ? 5
change the behavior of syscall ? change the behavior of
syscall ? 5
variants variants 6
ptrace ptrace 7
SUD (syscall user dispatch) SUD (syscall user dispatch) 8
LD_PRELOAD LD_PRELOAD 9
binary rewriting binary rewriting syscall/sysenter 10
binary rewriting (cont'd) binary rewriting (cont'd) syscall jmp 0xdeadbeef syscall
0f 05 jmp 0xdeafbeef e9 de ad be af mov sysno %rax; syscall callq ${addr of handler} 11
summary of existing syscall hooks summary of existing syscall hooks
12
%rax zpoline zpoline syscall callq *%rax 13
zpoline: how it works zpoline: how it works callq *%rax
syscall nop nop callq *%rax %rax $ echo 0 > "/proc/sys/vm/mmap_min_addr" 14
zpoline: how it behaves zpoline: how it behaves 15
zpoline how it behaves (cont'd) zpoline how it behaves (cont'd)
16
zpoline: benefits zpoline: benefits 17
There ain't no such things as a free lunch There
ain't no such things as a free lunch. . 18
pitfalls of syscall hooks pitfalls of syscall hooks 19
handling two universes in partial hooks handling two universes in
partial hooks int hooked_select(pollfds[], nfds_t, int) { int host_fd = host_poll(); int user_fd = user_poll(); return (merge {host,user}_fd) } 20
Summary Summary 21
Backups Backups 22
How zpoline is started ? How zpoline is started ?
syscall callq *%rax main() 23
libc replacement libc replacement 24
platform support platform support 25
null access termination null access termination mprotect(2) 26
References References 27