6 ms·
Maybe because the author prefers to play with kernel. Other option is create a wrapper library and enforce it's usage with LD_PRELOAD.
by marbu 15y ago
Maybe because the author prefers to play with kernel. Other option is create a wrapper library and enforce it's usage with LD_PRELOAD.
- KonradKlause 15y agoUsing LD_PRELOAD you cannot hook a syscall like open().
- mhansen 15y agoHow does strace hook it?
- waitwhat 15y agoDoesn't pretty much everything call into libc to open() things rather than invoke the syscall directly?
- KonradKlause 15y agoWith LD_PRELOAD you can hook any _function_ call. A syscall is something different. It depends how the syscall wrapper within the libc is coded. Some can be hooked...
- waitwhat 15y agoBut open(3) is a function call, so it can be hooked.
- KonradKlause 15y agoIt's open(2). Yes, here on my x86_64 it can be hooked. But I've seen lots of setups where this was not doable. As I said it depends how the libc's wrapper is written.
- waitwhat 15y agoOn Linux, there's typically both an open(3) and an open(2). The former is implemented by glibc and calls the latter which is implemented by the kernel. So an app calls the open() function. This results in an unresolved symbol which the run-time linker matches up with the open() exported by glibc. glibc then does the open() syscall.
- KonradKlause 15y agoopen(2) is the wrapper within the libc. There is no open(3) on Linux.
- waitwhat 15y agoSection 2 of the unix manual is for syscalls. Section 3 is for C library functions. http://en.wikipedia.org/wiki/Man_page#Manual_sections http://en.wikipedia.org/wiki/Man_page#Manual_sections If libc implements it, then it is by definition in section 3. EDIT: (signing out of this sub-thread)
- KonradKlause 15y agoSorry, you're just wrong. Have you ever called a system call by hand using assembly? Have you ever looked at glibc's source? Habe you ever looked at the kernel's close() syscall?
- calloc 15y agosyscall number 5 you mean?
- exDM69 15y agoNo. Assembly code invokes kernel syscalls by invoking an interrupt or using a syscall opcode. No libc or function calls involved, so LD_PRELOAD can't hook in. You might even have several libc's in your system. You might have a uClibc + Busybox based initrd and a full glibc based root system. Btw. how does LD_PRELOAD act together static binaries?
- waitwhat 15y agoI know apps can invoke kernel syscalls directly, and I'm sure you could name a handful of apps that do this all time. But are you really doing that in your mp3 player?
- marbu 15y agoSince static binaries don't use shared libraries, LD_PRELOAD has no effect - it is the same as with assembly code you mentioned.