3,816 questions
0
votes
0
answers
31
views
Monitor sigprocmask calls with Syscall User Dispatch?
I'm using prctl(PR_SET_SYSCALL_USER_DISPATCH, ...) to enable Syscall User Dispatch with a SIGSYS handler that gets called when the application issues any syscall. The prctl() call also marks the code ...
- 986
0
votes
2
answers
79
views
How to reliably map glibc dynamic symbols (e.g., open@glibc) to kernel syscalls (e.g., openat)?
I am trying to build a mapping between the dynamic symbols in ELF files (from glibc) and the actual kernel syscalls they invoke.
My environment is x86_64 Ubuntu 22.04.
What I've Tried
Parsing man 2 ...
- 1
0
votes
1
answer
47
views
Where Can I See the Mapping Flow Between .dynsym and Kernel System Calls?
I'm struggling to reconcile the difference between the symbols listed in my ELF file's dynamic symbol table (.dynsym) and the system calls observed via strace.
When I perform static analysis using ...
- 1
3
votes
1
answer
116
views
write(2) syscall doesn't work in Minix 3.3.0 i386 assembly program
I'm writing hello-world program for Minix 3.3.0 i386 in assembly. The exit(2) call works (and the exit code is propagated), but the write(2) call doesn't work. What am I doing wrong, and how do I fix ...
- 88.7k
0
votes
0
answers
41
views
What are the correct arguments for NtCreateNamedPipeFile in a POC
I am trying to use NtCreateNamedPipe to create a pipe in the current process but i keep on getting 0xc000000d status code, i tried multiple combinations of the arguments and change the pipe name many ...
- 57
0
votes
1
answer
137
views
System call transition to system call table
When a system call is invoked by a user program, a software interrupt (trap) is raised, control first passes to the fixed location of the interrupt vector (IR) which contains the ISR associated with ...
- 33
1
vote
1
answer
88
views
Randomness instructions vs syscalls [closed]
I've been digging into "true" randomness idea, and I've noticed that modern CPUs support instructions for generating randomness. X64 has RDRAND instruction, while ARM has RNDR (I'm not ...
- 57k
0
votes
0
answers
54
views
DISAS_NORETURNs causing errors while attempting to intercept QEMU syscalls by tweaking the ecall() function
I am trying to modify the ecall behavior in QEMU usermode simulation, so that i can intercept system calls.
The way i intend to do it is by reading states from the CPURISCVState with tcg_gen_ld_tl -- ...
5
votes
1
answer
146
views
Why does syscall on x86-64 load CS and SS selectors if base/limit aren’t used?
On x86-64, the syscall instruction causes a privilege-level change from user mode to kernel mode.
According to the Intel manual (Vol. 2A, SYSCALL—Fast System Call), during execution:
CS is loaded ...
- 197
0
votes
0
answers
107
views
How do I store and use rax output into a register for later use?
I've been given an assignment to store and write out a user-inputted string stored in buffer. My professor said that the number of bytes read is stored in rax after the user inputs the string into ...
- 1
1
vote
1
answer
89
views
futex_wait inside a signal handler
So I am trying to understand if I am missing anything about calling futex_wait inside a signal handler for a SIGSEGV access violation. Ostensibly, it is not on the list of async-signal-safe calls, ...
- 35
0
votes
0
answers
94
views
move_pages() only is effective temporarily in C++
I'm trying to write NUMA-aware codes, and i encountered some unexpected behavior. I decide to use move_pages() to test if i create the correct NUMA placement but the result is very confusing.
for (...
- 11
1
vote
1
answer
65
views
Do child processes inherit pledge() promises made by the parent process?
In BSD, the pledge() syscall can be used to limit the process' access to potentially dangerous resources. Do these limitations apply to child processes that are forked from the parent, or are the ...
- 968
1
vote
0
answers
123
views
RISC-V a1 register assumptions after ecall execution
As explained here it's clear to me that user-space calling conventions don't apply when dealing with kernel-space system call execution, so basically no register is clobbered after an ecall ...
0
votes
2
answers
74
views
What difference between brk() and syscall(SYS_brk,)
man 2 brk says:
int brk(void *addr);
brk() sets the end of the data segment to the value specified by addr ...
On success, brk() returns zero. On error, -1 is returned, and errno is set to ENOMEM.
...
- 373
1
vote
0
answers
65
views
how can I use Quotactl system call of linux to set project quota in ext4 filesystem
I have checked the man7.org to find the answer, and I found that the Q_SETQUOTA subop of quotactl seems to support only user and group quota?
Q_SETQUOTA
Set quota information for user or ...
- 11
3
votes
0
answers
131
views
CreateFileW returns valid-looking handle, but DeviceIoControl fails with "The handle is invalid"
i am working in go. using syscall.SyscallN(), i returned a handle for a volume using the CreateFileW function from the windows api. when i print the error value returned by the syscall, i receive &...
- 101
0
votes
1
answer
119
views
How to move a cursor in assembly x86_64 on linux os
So I am trying to build text editor in assembly and I came to problem of moving cursor on the screen while program is in input or reading mode
I modified termios flags also little bit (turned off ECHO ...
- 39
0
votes
1
answer
232
views
bpf_prog_query(BPF_CGROUP_DEVICE) failed: function not implemented
I am having a nixos system with BPF_SYSCALL disabled with below configurations:
[root@nixos:/sys/fs/cgroup]# zgrep BPF /proc/config.gz
CONFIG_BPF=y
CONFIG_HAVE_EBPF_JIT=y
...
6
votes
1
answer
182
views
How to correctly parse system call execution times from strace output using pipes in C?
I'm working on an operating system programming assignment to understand pipes. M3.md The task involves using regular expressions to extract information from strace output and statistic system call ...
1
vote
1
answer
137
views
Do RISC-V kernel-space calling conventions exist?
RISC-V user-space function calls calling conventions are clear to me. It's also clear that a0-a5 are used to pass arguments to kernel and a7 to store system call number before an ecall. What I can't ...
2
votes
0
answers
56
views
How can I add more storage in assembly (x86) as user is typing input?
I am trying to build some kind of simple text editor and I am trying to get input from user but it is not unlimited, user can only input 10 bytes of memory
section .bss
input resb 10
info ...
- 39
1
vote
1
answer
85
views
How can I find out the length of an inputted string in assembly?
I am trying to build a small text editor (first project in assembly) and I happen to need to find out the length of a string to give person error. This input will be used to open or create files in ...
- 39
3
votes
1
answer
259
views
Is there a way to intercept and modify all syscalls of a specific program?
This might be a weird question, and it may very well be impossible, but is there a way to intercept all syscalls of a specific program? I have full control over the file, which mean I can scan and ...
- 271
1
vote
0
answers
69
views
Can you write a Linux kernel module that reclaims "in use" address space via a new syscall?
Motivation
I'm picturing a hypothetical update process for critical services, that might work like this (using C and POSIX names):
Download the new update binary, to a separate place than current ...
- 968
2
votes
0
answers
234
views
How to crash (and reboot) the linux kernel by changing program counter
For educational purposes, I have to inject fault into a linux kernel. The current setup is:
A system call, which injects the fault. In my case, I'm jumping to some random address that is probably ...
- 96
0
votes
2
answers
136
views
Wait for file input or a signal in Linux
I can wait for one of several network connections using select or epoll. I can wait for a signal using sigwaitinfo, or add a handler to run on receipt of the signal.
How do I wait for either a network ...
- 886
4
votes
1
answer
109
views
O_DIRECT read() fails with Invalid argument when reading from a continuously written file
I have a program that reads from a file using O_DIRECT. The file is being continuously written to by another process. The read loop works fine until it reaches the point where the write is happening. ...
- 101
0
votes
0
answers
50
views
Do I scale my I/O work using threads or processes?
As I know when you write code that is opening a stream to a file there is a call to your OS which returns the stream of that file. However I don't quite understand if I write something in several ...
- 1
1
vote
3
answers
154
views
strace output not showing malloc and free system call in a multi threaded application
I am trying to simulate a memory leak problem with the following code and then investigate the system calls resulting in memory leak.
include <iostream>
#include <thread>
#include <...
- 376
0
votes
0
answers
119
views
How disassembling "Hello world" works? How does it output without the syscall instruction?
I just don't understand a bit how the disassembled code outputs text without using syscall.
Cpp reference looked like this:
//Your First C++ program
#include <iostream>
using ...
0
votes
1
answer
96
views
Can madvise(addr, size, MADV_DONTNEED) cause segfaults?
Is madvise(*, *, MADV_DONTNEED) supposed to be purely advisory? I tried scanning /proc/self/maps and calling madvise(addr, size, MADV_DONTNEED) on the entries:
#include <stdio.h>
#include <...
- 12.7k
1
vote
1
answer
77
views
Can I dup and change the buffer behaviour of the new fd without changing the old one?
I want to create a new FILE* associated with stdout, using setvbuf() to change its buffer behaviour to _IONBF, but I don't want to change the behaviour of stdout, since the other part of the program ...
- 373
0
votes
2
answers
99
views
The `write` syscall in C writes to an unexpected position
I've written a simple C program.
It takes four command line parameters: file name, start position, length and byte value; opens the specified file for writing and, starting at the specified position, ...
- 185
0
votes
0
answers
97
views
Consequences of concurrent fsync on the same fd
What does happen if two threads call fsync on the same entity simultaneously? For example, they want to synchronize the same directory at the same time, when they create new files in it. I have ...
- 203
0
votes
0
answers
37
views
What is the most "empty" Linux system call to benchmark against? [duplicate]
I want to benchmark some performance aspects of a Linux device driver (a loadable module). Specifically, how fast certain code paths are when they are invoked from userspace via system calls.
In ...
- 2,418
0
votes
1
answer
62
views
BPF program attached to `getname` won't get called when calling the `renameat2` syscall
I'm fiddling with a BPF program that needs to attach to the two "getname" functions that are being called from the renameat2 syscall, defined in linux/fs/namei.c as:
SYSCALL_DEFINE5(...
0
votes
2
answers
152
views
NtTerminateThread is returning STATUS_INVALID_HANDLE when terminating self
Hello I am trying to terminate the current thread using NtTerminateThread. I know that the function for the syscall takes 2 arguments which are the thread handle and the exit status but whenever I try ...
- 33
0
votes
2
answers
379
views
Creating a new thread with clone3 causes segfault
I'm experimenting with the Linux clone3() syscall (introduced in Linux 5.3) to create threads without using the standard library. While there are many examples of using the older clone() syscall, I ...
1
vote
0
answers
77
views
Implemented syscall but getting "Function not implemented" error
Trying to implemented syscall in kernel space and wrapper in glibc so I can call from userspace.
When I call the function call in user program it says "Function not implemented".
I have ...
1
vote
0
answers
104
views
Application is leaking event handle after calling syscalls on Windows
I have a go application that calling the Windows Management Infrastructure (MI).
After some amount of time, I notice that the amount of handle is quite high. I inspect the process with the handles ...
- 140
1
vote
0
answers
29
views
Infinite Loop Issue in Assembly [duplicate]
I am working on a simple assembly program that uses a loop to print a message a specific number of times. However, the loop is not terminating as expected and runs indefinitely.
I am new to assembly ...
- 11
2
votes
1
answer
84
views
Invoke function pointer from go. (Windows Management Infrastructure client)
I develop go pure go client for Windows Management Infrastructure (MI). It's the successor of WMI.
While initialization works as indented
package main
import (
"unsafe"
"...
- 140
1
vote
1
answer
447
views
Modifying (stealing) Linux syscalls using kprobe
I am trying to steal the statx syscall on Linux 6.8 and to modify the returning arguments.
However, when attemp to load the module, I got a BUG about NULL pointer deference at line
r = ...
- 215
4
votes
2
answers
141
views
What is a "slow" device in the context of I/O call?
In man 7 signal, it describes certain constraints regarding when the SA_RESTART flag takes effect.
read(2), readv(2), write(2), writev(2), and ioctl(2) calls on "slow" devices. A "...
- 178
1
vote
0
answers
125
views
How to use direct system calls with NtOpenProcess?
I want to develop a trivial toolkit using direct syscalls for some of the native windows API procedures, for example I want to use NtOpenProcess to open a process and display some info related to the ...
- 139
0
votes
0
answers
80
views
Memory fence with std::system_clock::now()
I need to add two memory fences into my codes, in order to prevent my codes from being reordered by either the compiler or CPU.
Like this:
rec.time_stamp0 = std::system_clock::now();
std::...
- 2,165
-1
votes
1
answer
87
views
Why does a system call crashes on second iteration of cycle while succeed on first?
I faced this problem in the below C++ program
#include <bits/stdc++.h>
#include <unistd.h>
#include <sys/wait.h>
using namespace std;
std::vector<std::string> args;
void ...
- 7
0
votes
1
answer
313
views
The child process does not start with syscall(SYS_clone3, …) + CLONE_VM
Hello, everyone.
It is necessary that the calling process and the child process are in the same memory space.
Therefore, I use the CLONE_VM flag.
But the child process does not start.
It looks like ...
- 9
0
votes
0
answers
70
views
Safe utilization of fork() to create multiple children, without data races
I'm writing a small program which uses fork() to create 4 child threads. I am new to working with fork() and want to make certain I am using the most thread-safe approach. The issue I am having does ...
- 1,152