lorenz.stechauner/BSc-Thesis
1
0
Fork 0
Code Activity

thesis: Almost complete first section

Browse Source
This commit is contained in:
Lorenz Stechauner
2025-07-08 20:12:43 +02:00
parent d1d9f601c9
commit ac96d571cd
6 changed files with 152 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

103
thesis/src/02.intercept.tex
View File

@@ -7,10 +7,95 @@ Lorem Ipsum.
Lorem Ipsum.
\subsection{\texttt{ptrace} System Call}\label{subsec:ptrace}
The first thing that pops up when researching on how to intercept system calls in Linux is the \texttt{ptrace} (``process trace'') system call.
This system call allows one process to observe and control the execution of another process (including memory and registers).
The control is handed from the traced process to the tracing process each time any signal is delivered.
\cite{ptrace.2}
To make use of this system call, a corresponding command already exists.
See~\ref{subsec:strace}.
\subsection{\texttt{strace} Command}\label{subsec:strace}
The \texttt{strace} (``system call/signal trace'') command may be used to run a specified command and to thereby intercept and record the system calls which are made.
Each system call is recorded as a line and either written to the standard error output or a specified file.
\cite{strace.1}
Listings \ref{lst:main.c} and \ref{lst:strace} give a simple example of what this output looks like.
It is clearly visible that only (``pure'') system calls are recorded, and calls to library functions (like \texttt{malloc} or \texttt{free}) do not appear.
Also note that, arguments to the calls are displayed in a ``pretty'' way.
For example, strings arguments would be simple pointers, but \texttt{strace} displays them as C-like strings.
\begin{listing}[htbp]
\begin{minted}[linenos]{c}
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
int main(const int argc, char *const argv[]) {
char *str = malloc(10);
strcpy(str, "Abc123");
printf("Hello World!\nString: %s\n", str);
free(str);
}
\end{minted}
\caption{Contents of \texttt{main.c}.}
\label{lst:main.c}
\end{listing}
\begin{listing}[htbp]
\begin{minted}{text}
execve("./main", ["./main"], 0x7ffd63b32bb0 /* 71 vars */) = 0
[-- 32 lines omitted --]
write(1, "Hello World!\n", 13) = 13
write(1, "String: Abc123\n", 15) = 15
exit_group(0) = ?
+++ exited with 0 +++
\end{minted}
\caption{Output of \texttt{strace ./main}.}
\label{lst:strace}
\end{listing}
This approach works great for debugging and other use-cases,
but only intercepting system calls does not statisfy the requirements for this work.
\subsection{\texttt{ltrace} Command}\label{subsec:ltrace}
The \texttt{ltrace} (``library call trace'') command may be used to trace dynamic library calls instead of system calls.
It works similarly to \texttt{strace} (see \ref{subsec:strace}).
\cite{ltrace.1}
Listings \ref{lst:main.c} and \ref{lst:ltrace} illustrate what the output of \texttt{ltrace} looks like.
In contrast to the output of \texttt{strace} now only ``real'' calls to library functions are included in the output.
Therefore, a lot less ``noise'' is generated (see omitted lines in listing \ref{lst:strace}).
Again, the function arguments are displayed in a ``pretty'' way.
This command uses so-called prototype functions~\cite{ltrace.conf.5} to format function arguments.
\begin{listing}[htbp]
\begin{minted}{text}
malloc(10) = 0x55624164b2a0
printf("Hello World!\nString: %s\n", "Abc123") = 28
free(0x55624164b2a0) = <void>
+++ exited (status 0) +++
\end{minted}
\caption{Output of \texttt{ltrace ./main}.}
\label{lst:ltrace}
\end{listing}
This method fits the requirements for this work a lot better than \texttt{strace} (see~\ref{subsec:strace}),
but it is not very flexible and offers no means to modify the intercepted function calls.
\subsection{Wrapper Functions in gcc}\label{subsec:wrapper-functions}
Another method for overriding functions is to tell the compiler directly, which functions should be overridden.
A different approach to intercepting function calls is to tell the compiler directly, which functions should be intercepted.
The compiler, and the linker respectively, then directly link calls to the specified functions to wrapper functions.
(See \ref{subsec:preloading} for more details.)
The default linker \texttt{ld} includes such a feature.
See the OPTIONS section in the ld(1) Linux manual page~\cite{ld.1}:
@@ -47,7 +132,7 @@ See the OPTIONS section in the gcc(1) Linux manual page~\cite{gcc.1}:
This means, by specifying \texttt{-Wl,-{}-wrap=\textit{symbol}} when compiling using gcc,
all calls from the currently compiled program to \texttt{\textit{symbol}} are redirected to \texttt{\_\_wrap\_\textit{symbol}}.
To call the real function inside the wrapper, \texttt{\_\_real\_\textit{symbol}} may be used.
The listings \ref{lst:wrap.c} and \ref{lst:wrap} try to illustrate this by overriding the \texttt{malloc} function of the C standard library.
Listings \ref{lst:wrap.c} and \ref{lst:wrap} try to illustrate this by overriding the \texttt{malloc} function of the C standard library.
\begin{listing}[htbp]
\begin{minted}[linenos]{c}
@@ -111,7 +196,7 @@ See the ENVIRONMENT section in the ld.so(8) Linux manual page~\cite{ld.so.8}:
\end{quote}
This means, by setting the environment variable \texttt{LD\_PRELOAD}, it is possible to override specific functions.
The listings \ref{lst:preload.c} and \ref{lst:preload} try to illustrate this by overriding the \texttt{malloc} function of the C standard library.
Listings \ref{lst:preload.c} and \ref{lst:preload} try to illustrate this by overriding the \texttt{malloc} function of the C standard library.
\begin{listing}[htbp]
\begin{minted}[linenos]{c}
@@ -153,18 +238,6 @@ By using this method, it is possible to override, and therefore wrap, any functi
Although, one has to be aware that not only function calls inside the targeted binary, but also calls inside other libraries (e.g., to \texttt{malloc}) are redirected to the overriding function.
\subsection{Kernel Module}\label{subsec:kernel-module}
Lorem Ipsum.
\subsection{Emulation}\label{subsec:emulation}
Lorem Ipsum.
\subsection{Modifying the Kernel}\label{subsec:modifiying-kernel}
Lorem Ipsum.
\subsection{Conclusion}\label{subsec:conclusion}
Lorem Ipsum.