Kernels lower than 4.6 use assembly stubs to harden the hooking of critical system calls like fork, clone, exec etc. Particularly speaking for execve, the following snippet from Kernel-4.5 shows entry stub of execve:

    call    sys_execve

System call table contains this stub's address and this stub further calls original execve. So, to hook execve in this environment we need to patch call sys_execve in stub with our hooking routine and after doing our desired things call the original execve. This all can be seen in action in execmon, a process execution monitoring utility for linux. I'd tested execmon successfully working in Ubuntu 16.04 with kernel 4.4.

Starting from kernel 4.6, upper scheme for critical calls protection had been changed. Now the stub looks like:

    leaq    \func(%rip), %rax
    jmp     stub_ptregs_64

where \func will expand to sys_execve for execve calls. Again, system call table contains this stub and this stub calls original execve, but now in a more secured manner instead of just doing call sys_execve. This newer stub, stores called function's address in RAX register and jumps to another stub shown below (comments removed):

     cmpq   $.Lentry_SYSCALL_64_after_fastpath_call, (%rsp)
     jne    1f

     popq   %rax
     jmp    entry_SYSCALL64_slow_path

     jmp    *%rax        /* called from C */

Please have a look on this to see comments and other referenced labels in this stub.

I'd tried hard to come up with some logic to overcome this protection and patch original calls with hooking functions, but no success yet. Would someone like to join me and help to get out of it.

  • Can you show us what you tried so far and how/where does it fail? – schaiba Nov 6 '17 at 10:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.