linux-kernel - Re: Portable syscall inspection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20070529123557.GA21684@linux-mips.org>
Date:	Tue, 29 May 2007 13:35:57 +0100
From:	Ralf Baechle <ralf@...ux-mips.org>
To:	Trent Waddington <trent.waddington@...il.com>
Cc:	linux-kernel@...r.kernel.org
Subject: Re: Portable syscall inspection

On Tue, May 29, 2007 at 08:59:37AM +1000, Trent Waddington wrote:

> Someone finally noticed that my program that uses ptrace only works on 
> i386..
> and, by the looks of it, there is no portable way to refer to the
> registers of a
> user_regs_struct when inspecting a system call.

Correct.

> I will probably end up making a header file for each architecture that
> defines where
> in the user_regs_struct things like the syscall number, the return
> value and the first 3 parameters are..

Also consider that some architectures pass parts of the arguments in
registers which on yet others are passed in memory.  Sometimes padding
arguments are needed and many more oddities.  Similar for results.
Inescapably such a program is a perment maintenance nightmare.

> has anyone done this already?  or can otherwise save me a lot of time?

Similar things have been tried before but nothing that would be remotely
sane.

  Ralf
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/