Re: intercepting system calls?
Re: intercepting system calls?
- Subject: Re: intercepting system calls?
- From: Kevin Van Vechten <email@hidden>
- Date: Sat, 21 Jan 2006 13:10:13 -0800
If you're not trying to corral a hostile environment, a simple way to
intercept syscalls is to override them at the Libsystem layer.
Define your own functions in a dylib, and then se the
DYLD_INSERT_LIBRARIES and DYLD_FORCE_FLAT_NAMESPACE environment
variables.
See the dyld(1) man page for details on the environment variables.
Here is a sample dylib that overrides some common syscalls:
<http://cvs.opendarwin.org/cgi-bin/cvsweb.cgi/projects/darwinbuild/
darwintrace/>
- Kevin
On Jan 20, 2006, at 9:01 PM, Mike Smith wrote:
On Jan 20, 2006, at 12:02 PM, email@hidden
wrote:
I'd like to catch the system calls that an process is making, so I
can
examine the system call and optionally handle it myself. Under
Linux and
Solaris, I can use ptrace() with the PTRACE_SYSCALL command, which
will
let the process run until it enters or exits a system call.
Is there an equivalent for Darwin? Using a KEXT to patch the
system call
table is really not an option...
PT_SYSCALL is, as you have probably noticed, not implemented for the
Darwin ptrace.
Remember that the binary compatibility layer guarantee made by Mac
OS X
is at the framework boundary, *not* at the syscall layer. Direct
reference
to system calls is avoided wherever possible in user space; they
are in effect
just a convenient way of implementing what the frameworks offer and
can move around quite a bit from version to version.
As such, if you want to interpose and affect the outcome of
application calls
to system services, you should look to the dyld interpositioning
mechanisms.
For the most part you only need to worry about libSystem; other
frameworks
call it to make system calls. You may, however, also need to consider
intercepting Mach IPC depending on exactly what it is that you're
trying to do.
= Mike
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Darwin-dev mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden