Re: How to intercept a sys call.




<phil-news-nospam@xxxxxxxx> wrote in message
news:dojmt611vpl@xxxxxxxxxxxxxxxxxxxx
> On Wed, 21 Dec 2005 13:14:50 -0800 David Schwartz <davids@xxxxxxxxxxxxx>
> wrote:

> | The alternative is to add whatever functionality your module was
> going
> | to provide to the kernel, perhaps in the form of a hook specifically for
> | your module.

> There has to be something equivalent to a system call table that takes the
> syscall index and gets to the proper kernel sys_* function. He just needs
> to track down what that is (not expect us to do it for him).

There is something equivalent to a system call table; however, it is not
safe to modify it. In fact, the kernel developers explicitly state that
doing so is broken, their code doesn't support it, and there are known
scenarios where it can break horribly.

DS


.



Relevant Pages

  • Post-halloween doc updates.
    ... This document explains some of the new functionality to be found in the 2.6 ... Linux kernel, some pitfalls you may encounter, and also points out some new ... Note, that this document is somewhat x86-centric, but most features ... The advanced linux sound architecture got merged into 2.6. ...
    (Linux-Kernel)
  • Re: State Department Developing Cyber Toolkit
    ... >>with either a bugfix or new functionality every week or two. ... the progger in question hard-coded a 16-unit queue. ... > copyright data - each file had one, and if my scripting it right, five ... WTF happened to the Mach kernel that everyone was on about a decade or so? ...
    (alt.computer.security)
  • [PATCH] Restore netstat -M functionality
    ... The primary purpose of this patch is to restore -M functionality of netstat so ... live kernel and false if -M has been specified. ... sctp's PCB routine only works on live kernels, ...
    (freebsd-current)
  • Re: [PATCH 5/9] Make use of permissions, returned by kobj_lookup
    ... but people want to run old distros in containers ... concerned about a few extra calls within the kernel. ... container functionality which is sufficiently well-tested for people to ... That's fine, use the LSM interface, no need to change userspace at all. ...
    (Linux-Kernel)
  • Re: Problem using KeQuerySystemTime
    ... You may have a conflict equivalent to using NTDDK functions in a SCSI ... source component that compiles under NTDDK but exports functionality to my ... >> drivers only run in the kernel. ... Header files and libraries in the DDK ...
    (microsoft.public.development.device.drivers)