Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
benefits and drawbacks of syscall hooks/netdev0...
Search
Hajime Tazaki
July 19, 2024
Technology
0
220
benefits and drawbacks of syscall hooks/netdev0x18-zpoline
https://netdevconf.info/0x18/sessions/talk/benefits-and-drawbacks-of-syscall-hooks.html
Hajime Tazaki
July 19, 2024
Tweet
Share
More Decks by Hajime Tazaki
See All by Hajime Tazaki
kernel offload with complete host kernel functionalities/netdev0x17-kernel-offload
thehajime
0
210
ライブラリOSを利用したコンテナランタイムの設計と実装/stairlab-seminar-23-ukontainer
thehajime
0
160
How to Design a Library OS for Practical Containers?/vee21-ukontainer
thehajime
0
700
containerd port to darwin - Toward Running Linux containers on macOS/fosdem21-darwin-containerd-ctr-devroom
thehajime
0
1.5k
Linux Container with Alternate Linux Kernel (Library)/container-runtime-meetup-202008-lkl
thehajime
2
1.9k
Linux Kernel Library - A Library Version of Linux Kernel/lkl-fosdem2020-uk-devroom
thehajime
0
1.1k
Is reimplementation of network stack a good idea or not? - Linux netdev 0x13 #netdevconf /linux-netdev-0x13-lkl
thehajime
1
330
Linux rumpkernel - ABC2018 (AsiaBSDCon 2018)
thehajime
0
2.1k
Network stack personality in Android phone - netdev 2.2
thehajime
0
1.2k
Other Decks in Technology
See All in Technology
Snowflakeの生成AI機能を活用したデータ分析アプリの作成 〜Cortex AnalystとCortex Searchの活用とStreamlitアプリでの利用〜
nayuts
0
120
【 LLMエンジニアがヒューマノイド開発に挑んでみた 】 - 第104回 Machine Learning 15minutes! Hybrid
soneo1127
0
230
Oracle Cloud Infrastructure:2025年8月度サービス・アップデート
oracle4engineer
PRO
0
160
Figma + Storybook + PlaywrightのMCPを使ったフロントエンド開発
yug1224
10
3.5k
AI時代にPdMとPMMはどう連携すべきか / PdM–PMM-collaboration-in-AI-era
rakus_dev
0
240
ソフトウェア エンジニアとしての 姿勢と心構え
recruitengineers
PRO
25
12k
20250903_1つのAWSアカウントに複数システムがある環境におけるアクセス制御をABACで実現.pdf
yhana
1
130
DuckDB-Wasmを使って ブラウザ上でRDBMSを動かす
hacusk
1
140
異業種出身エンジニアが気づいた、転向して十数年経っても変わらない自分の武器とは
macnekoayu
0
250
ヘブンバーンズレッドにおける、世界観を活かしたミニゲーム企画の作り方
gree_tech
PRO
0
410
Grafana Meetup Japan Vol. 6
kaedemalu
1
190
進捗
ydah
2
220
Featured
See All Featured
Side Projects
sachag
455
43k
Product Roadmaps are Hard
iamctodd
PRO
54
11k
How to Create Impact in a Changing Tech Landscape [PerfNow 2023]
tammyeverts
53
2.9k
Improving Core Web Vitals using Speculation Rules API
sergeychernyshev
18
1.1k
I Don’t Have Time: Getting Over the Fear to Launch Your Podcast
jcasabona
33
2.4k
How STYLIGHT went responsive
nonsquared
100
5.8k
Raft: Consensus for Rubyists
vanstee
140
7.1k
Fireside Chat
paigeccino
39
3.6k
Making Projects Easy
brettharned
117
6.4k
The Cost Of JavaScript in 2023
addyosmani
53
8.9k
Understanding Cognitive Biases in Performance Measurement
bluesmoon
29
1.9k
Visualization
eitanlees
147
16k
Transcript
benefits and drawbacks of syscall benefits and drawbacks of syscall
hooks hooks 1
introduction introduction 2
what is syscall and why syscall hook ? what is
syscall and why syscall hook ? 3
recap: how syscall works ? recap: how syscall works ?
4
change the behavior of syscall ? change the behavior of
syscall ? 5
change the behavior of syscall ? change the behavior of
syscall ? 5
variants variants 6
ptrace ptrace 7
SUD (syscall user dispatch) SUD (syscall user dispatch) 8
LD_PRELOAD LD_PRELOAD 9
binary rewriting binary rewriting syscall/sysenter 10
binary rewriting (cont'd) binary rewriting (cont'd) syscall jmp 0xdeadbeef syscall
0f 05 jmp 0xdeafbeef e9 de ad be af mov sysno %rax; syscall callq ${addr of handler} 11
summary of existing syscall hooks summary of existing syscall hooks
12
%rax zpoline zpoline syscall callq *%rax 13
zpoline: how it works zpoline: how it works callq *%rax
syscall nop nop callq *%rax %rax $ echo 0 > "/proc/sys/vm/mmap_min_addr" 14
zpoline: how it behaves zpoline: how it behaves 15
zpoline how it behaves (cont'd) zpoline how it behaves (cont'd)
16
zpoline: benefits zpoline: benefits 17
There ain't no such things as a free lunch There
ain't no such things as a free lunch. . 18
pitfalls of syscall hooks pitfalls of syscall hooks 19
handling two universes in partial hooks handling two universes in
partial hooks int hooked_select(pollfds[], nfds_t, int) { int host_fd = host_poll(); int user_fd = user_poll(); return (merge {host,user}_fd) } 20
Summary Summary 21
Backups Backups 22
How zpoline is started ? How zpoline is started ?
syscall callq *%rax main() 23
libc replacement libc replacement 24
platform support platform support 25
null access termination null access termination mprotect(2) 26
References References 27