3 ms·
> it uses ptrace to catch syscalls like clock_gettime or gettimeofday and overwrite the kernel response with a fake time I would love to hear more
by Bromskloss 9y ago
> it uses ptrace to catch
syscalls like clock_gettime or
gettimeofday and overwrite the kernel
response with a fake time
I would love to hear more about how this works, or get pointers to where one can learn about doing that kind of thing.
- ant6n 9y agoI'd start with this tutorial on how to write a debugger using ptrace, it's not too difficult to go to spoofing syscalls from there: https://eli.thegreenplace.net/2011/01/23/how-debuggers-work-part-1 https://eli.thegreenplace.net/2011/01/23/how-debuggers-work-...