#variant #mem #remote #read #interceptor

interceptor-rs

Interceptor is a lib based on ptrace that intercepts and modifies Linux system calls

1 unstable release

0.1.0 Mar 28, 2023

MIT license

35KB
761 lines

interceptor

Interceptor is a lib based on ptrace that intercepts and modifies Linux system calls. It currently only supports x86_64 architecture.

Usage

Write a function whose signature is same as a syscall, and mark it as #[syscall], and you are done.

#[syscall]
fn openat(dfd: i32, mut filename: *const c_char, flags: i32, mode: i32) -> i32 {
    // do something before syscall, logging, changing arguments, etc.

    let ret = real!(dfd, filename, flags, mode);

    // do something after syscall, modifing return value..
}

See more detail in examples

Extra Info

Memory in target

We use "LD_PRELOAD" trick to insert a so into target process to malloc extra memory needed when modified a pointer argument which has larger length.

Remove dependency libgcc_s.so.1

Some glibc released without libgcc_s.so.1, we removed this dependency using link script "linker_without_libgcc.wrap".

special handling of parameter "*const *const c_char"

This parameter is used in syscall like execve's const char *const argv[].

We treat *const *const c_char as *const c_char for convenience. That's say, original pointer to pointer has been converted to pointer's content after content. For example:

original

this ptr's address is inside target process, can not be used directly.

ptr (*const *const c_char) ptr to ptr (*const c_char) content
0x12345678 0x11111111 "aaaa\0"
0x22222222 "bbbb\0"
0x33333333 "cccc\0"
0x44444444 "\0"

after converted

memory is reallocated in interceptor instance, so address changed.

ptr (*const c_char) content
0x87654321 "aaaa\0bbbb\0cccc\0\0"

usage

you can use helper function read_ptr_to_ptr to read content from converted ptr. and use write_ptr_to_ptr to write back.

Dependencies

~4–10MB
~92K SLoC