Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
benefits and drawbacks of syscall hooks/netdev0...
Search
Hajime Tazaki
July 19, 2024
Technology
0
220
benefits and drawbacks of syscall hooks/netdev0x18-zpoline
https://netdevconf.info/0x18/sessions/talk/benefits-and-drawbacks-of-syscall-hooks.html
Hajime Tazaki
July 19, 2024
Tweet
Share
More Decks by Hajime Tazaki
See All by Hajime Tazaki
kernel offload with complete host kernel functionalities/netdev0x17-kernel-offload
thehajime
0
210
ライブラリOSを利用したコンテナランタイムの設計と実装/stairlab-seminar-23-ukontainer
thehajime
0
160
How to Design a Library OS for Practical Containers?/vee21-ukontainer
thehajime
0
720
containerd port to darwin - Toward Running Linux containers on macOS/fosdem21-darwin-containerd-ctr-devroom
thehajime
0
1.5k
Linux Container with Alternate Linux Kernel (Library)/container-runtime-meetup-202008-lkl
thehajime
2
1.9k
Linux Kernel Library - A Library Version of Linux Kernel/lkl-fosdem2020-uk-devroom
thehajime
0
1.1k
Is reimplementation of network stack a good idea or not? - Linux netdev 0x13 #netdevconf /linux-netdev-0x13-lkl
thehajime
1
330
Linux rumpkernel - ABC2018 (AsiaBSDCon 2018)
thehajime
0
2.1k
Network stack personality in Android phone - netdev 2.2
thehajime
0
1.2k
Other Decks in Technology
See All in Technology
SCONE - 動画配信の帯域を最適化する新プロトコル
kazuho
1
380
What's new in OpenShift 4.20
redhatlivestreaming
0
280
混合雲環境整合異質工作流程工具運行關鍵業務 Job 的經驗分享
yaosiang
0
190
AI時代、“平均値”ではいられない
uhyo
8
2.6k
可観測性は開発環境から、開発環境にもオブザーバビリティ導入のススメ
layerx
PRO
2
660
AIとともに歩んでいくデザイナーの役割の変化
lycorptech_jp
PRO
0
890
MCP ✖️ Apps SDKを触ってみた
hisuzuya
0
370
IoTLT@ストラタシスジャパン_20251021
norioikedo
0
140
re:Inventに行くまでにやっておきたいこと
nagisa53
0
300
Azureコストと向き合った、4年半のリアル / Four and a half years of dealing with Azure costs
aeonpeople
1
300
QA業務を変える(!?)AIを併用した不具合分析の実践
ma2ri
0
150
ハノーファーメッセ2025で見た生成AI活用ユースケース.pdf
hamadakoji
1
480
Featured
See All Featured
How to Create Impact in a Changing Tech Landscape [PerfNow 2023]
tammyeverts
55
3k
Automating Front-end Workflow
addyosmani
1371
200k
Faster Mobile Websites
deanohume
310
31k
I Don’t Have Time: Getting Over the Fear to Launch Your Podcast
jcasabona
34
2.5k
Optimising Largest Contentful Paint
csswizardry
37
3.5k
Code Review Best Practice
trishagee
72
19k
The MySQL Ecosystem @ GitHub 2015
samlambert
251
13k
What’s in a name? Adding method to the madness
productmarketing
PRO
24
3.7k
Visualizing Your Data: Incorporating Mongo into Loggly Infrastructure
mongodb
48
9.7k
The Cult of Friendly URLs
andyhume
79
6.6k
Designing for Performance
lara
610
69k
StorybookのUI Testing Handbookを読んだ
zakiyama
31
6.2k
Transcript
benefits and drawbacks of syscall benefits and drawbacks of syscall
hooks hooks 1
introduction introduction 2
what is syscall and why syscall hook ? what is
syscall and why syscall hook ? 3
recap: how syscall works ? recap: how syscall works ?
4
change the behavior of syscall ? change the behavior of
syscall ? 5
change the behavior of syscall ? change the behavior of
syscall ? 5
variants variants 6
ptrace ptrace 7
SUD (syscall user dispatch) SUD (syscall user dispatch) 8
LD_PRELOAD LD_PRELOAD 9
binary rewriting binary rewriting syscall/sysenter 10
binary rewriting (cont'd) binary rewriting (cont'd) syscall jmp 0xdeadbeef syscall
0f 05 jmp 0xdeafbeef e9 de ad be af mov sysno %rax; syscall callq ${addr of handler} 11
summary of existing syscall hooks summary of existing syscall hooks
12
%rax zpoline zpoline syscall callq *%rax 13
zpoline: how it works zpoline: how it works callq *%rax
syscall nop nop callq *%rax %rax $ echo 0 > "/proc/sys/vm/mmap_min_addr" 14
zpoline: how it behaves zpoline: how it behaves 15
zpoline how it behaves (cont'd) zpoline how it behaves (cont'd)
16
zpoline: benefits zpoline: benefits 17
There ain't no such things as a free lunch There
ain't no such things as a free lunch. . 18
pitfalls of syscall hooks pitfalls of syscall hooks 19
handling two universes in partial hooks handling two universes in
partial hooks int hooked_select(pollfds[], nfds_t, int) { int host_fd = host_poll(); int user_fd = user_poll(); return (merge {host,user}_fd) } 20
Summary Summary 21
Backups Backups 22
How zpoline is started ? How zpoline is started ?
syscall callq *%rax main() 23
libc replacement libc replacement 24
platform support platform support 25
null access termination null access termination mprotect(2) 26
References References 27