3 ms·
You can use [1] from Intel to successfully intercept all syscalls from a given library, by default libc only. This library actually works by disassembling libc
by en4bz 8y ago
You can use [1] from Intel to successfully intercept all syscalls from a given library, by default libc only. This library actually works by disassembling libc and replacing all `syscall` instructions with a jump to a global intercept function that you can write yourself. Incidentally it's also an LD_PRELOADed library.
[1] https://github.com/pmem/syscall_intercept https://github.com/pmem/syscall_intercept
- woodruffw 8y agoYep, I give them a shout-out at the bottom of that post -- using capstone to instrument system call sites at runtime is great (if a little crazy). I didn't actually realize it was an Intel project. I wonder how it stacks up against Pin.