64 lines
4.0 KiB
TeX
64 lines
4.0 KiB
TeX
|
|
\chapter{Related Work}\label{ch:related-work}
|
|
|
|
This chapter gives a rough overview on techniques and methods to intercept or hook system calls and function calls.
|
|
See also Section~\ref{sec:methods-for-intercepting}.
|
|
Many methods have already been discussed there.
|
|
|
|
|
|
\section{Function Call Interception}\label{sec:function-call-interception}
|
|
|
|
All related work regarding function call interception has already been mentioned in the aforementioned Section.
|
|
See \texttt{ltrace} (Subsection~\ref{subsec:ltrace}), wrapper functions (Subsection~\ref{subsec:wrapper-functions}), and \texttt{LD\_PRELOAD} (Subsection~\ref{subsec:preloading}).
|
|
|
|
|
|
\section{System Call Interception}\label{sec:system-call-interception}
|
|
|
|
This section discusses further related work regarding system call interception.
|
|
This excludes techniques already discussed in Section~\ref{sec:methods-for-intercepting},
|
|
like \texttt{ptrace} (Subsection~\ref{subsec:ptrace}), and \texttt{strace} (Subsection~\ref{subsec:strace}).
|
|
Almost all following methods use binary rewriting to replace system calls with other instructions (except SUD, Subsection~\ref{subsec:syscall-user-dispatch}).
|
|
This is one of the reasons why they were not mentioned in Section~\ref{sec:methods-for-intercepting}.
|
|
Another reason is that this work focuses on function call interception rather than system call interception.
|
|
|
|
|
|
\subsection{\texttt{int3} Signaling}\label{subsec:int3-signaling}
|
|
|
|
\texttt{int3} is a one-byte instruction (\texttt{0xcc}) that invokes a software interrupt.
|
|
On Linux, the kernel handles it and raises \texttt{SIGTRAP} to the user-space process that executed \texttt{int3}.
|
|
The \texttt{int3} signaling technique exploits this behavior to hook system calls; it replaces \texttt{syscall}/\texttt{sysenter} with \texttt{int3} and employs the signal handler for \texttt{SIGTRAP} as the hook function.
|
|
Since \texttt{int3} is one byte, it can replace an arbitrary instruction without breaking neighboring instructions.
|
|
This technique is traditionally used in debuggers to implement breakpoints.
|
|
However, signal handling incurs a large overhead because it involves context manipulation by the kernel.
|
|
\cite{zpoline}
|
|
|
|
|
|
\subsection{Syscall User Dispatch (SUD)}\label{subsec:syscall-user-dispatch}
|
|
|
|
Syscall User Dispatch (SUD)~\cite{sud} was added in Linux 5.11, and it offers a way to redirect system calls to arbitrary user-space code.
|
|
For the SUD feature, the kernel implements a hook point at the entry point of system calls.
|
|
A user-space process can activate SUD via the \texttt{prctl} interface.
|
|
When SUD is activated, the hook point raises \texttt{SIGSYS} to the user-space process.
|
|
This mechanism allows a user-space program to leverage the \texttt{SIGSYS} signal handler as the system call hook.
|
|
However, similarly to the \texttt{int3} signaling technique, SUD imposes a significant performance penalty on the user-space program due to the overhead of the signal handling.
|
|
\cite{zpoline}
|
|
|
|
|
|
\subsection{zpoline}\label{subsec:zpoline}
|
|
|
|
zpoline is a system call hook mechanism for x86-64 CPUs.
|
|
Binary rewriting is used to replace (two-byte) \texttt{syscall}/\texttt{sysenter} instructions with a (two-byte) \texttt{callq *\%rax} instruction.
|
|
Because this instruction jumps to \texttt{rax}, where also the syscall number is stored, the trampoline code has to be initialized beginning at virtual address 0.
|
|
zpoline is exhaustive and achieves very low performance reduction (28--761 times less overhead compared to other exhaustive system call hooking techniques).
|
|
\cite{zpoline}
|
|
|
|
|
|
\subsection{DataHook}\label{subsec:datahook}
|
|
|
|
DataHook is a system call hooking technique for 32-bit programs based on glibc running on x86 or x86-64 machines.
|
|
It relies on glibc's way of performing system calls, namely a \texttt{call *\%gs:0x10} instruction to call the \texttt{\_\_kernel\_vsyscall} function.
|
|
The content of \texttt{gs:0x10} is backed up and modified to jump to a given hook function.
|
|
DataHook is only exhaustive when used on glibc-based programs.
|
|
It achieves a very low performance reduction (5--1429 times less overhead compared to existing hooking techniques).
|
|
\cite{datahook}
|