trampoline introduction
source link: http://hushi55.github.io/2021/05/19/trampoline-introduction
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
trampoline introduction
2021-05-19
trampoline 在接触 ebpf 技术后，我们会经常遇到的一个技术术语，对于这个技术， 我在网上查找了一些技术资料，尝试介绍这个技术，如果不对，欢迎斧正。
Changing the Control Flow in the System Call Handler
到目前为止，我们找到两个合适到为止来劫持系统的控制。 它们都出现在 kernel 2.6 版本中，因此有着非常好的可移植性和可用性。
我们将通过无条件跳入 trampoline 来重写代码的选定部分。 trampoline 有几个工作。
- 首先得保持栈，确保可以方便的访问系统调用的结果。
- 随后，trampoline 会调用 hijack() 函数，这个会修改系统调用的结果(例如：ls 命令删除隐藏目录的记录)
- 当 hijack() 执行完毕，返回 trampoline，需要恢复系统的状态到调用之前
- 补偿在进入 trampoline 后的指令
- 替换的指令长度应该等于被替换的指令长度
- 在 trampoline 中需要 push 参数到 hijack
- hijack 函数调用完毕后需要清理 push 到参数
- 补偿执行被替换到指令
- 恢复跳转到被替换指令之后
Recommend
-
144
PowerShell Pipeline Introduction to SQL Server Management Objects with...
-
142
Open-Source Deep-Learning Software for Java and Scala on Hadoop and Spark
-
149
intro_ds_algo_py This repo contains programs from my upcoming book (to be published at the end of the year) - Introduction to Data Structures and Algorithms in Python. The language of the book is Bangla (aka Bengali), but someday I may al...
-
317
-
10
JavaScript玩转Clojure大法之 - Trampoline JavaScript玩转Clojure大法之 - Trampoline Table of Contents 📣 不要再找了, 弹幕功能已关闭 在函数式编程中...
-
8
trampoline execution context with scala Futures 5 minute read 10 February 2016 Disclaimer: I am continually learning, and this post refl...
-
35
Notification trampoline restrictions-Android12Did you ever notice?Sometimes tapping a notification 🔔 and nothing happens for a couple of minutes, then it suddenly pops up? 😬
-
3
Bouncing into space — The trampoline is now international: NASA and Roscosmos agree to seat swap No funds will be exchanged as part of the agreement.
-
3
JavaScript玩转Clojure大法之 - Trampoline JavaScript玩转Clojure大法之 - Trampoline Table of Contents
-
6
About Joyk
Aggregate valuable and interesting links.
Joyk means Joy of geeK