Kernel Function Patching for System Call Interception
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Intercepting system calls in the LINUX™ operating system is challenging due to indirect methods for reading non-exported kernel symbols, special requirements for overwriting system call vectors, and frequent changes that necessitate repeated porting efforts, leading to interoperability issues among third-party products.
Innovation Solution
Patching operating system kernel functions to point to an agent function, allowing the agent function to be executed when a system call stub invokes the kernel function, thereby intercepting system calls without modifying the system call vector table.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If third-party software intercepts system calls by modifying system call vectors, then system call interception is achieved, but interoperability problems occur and porting efforts are required for each kernel change
Solution Approach 1:
The patent introduces an intermediary mechanism (the agent function with first and second pointers) that mediates between third-party interception software and the operating system kernel. The agent function acts as a universal intermediary that can be called by various system call vectors without requiring direct modification of each vector, thereby enabling reliable interception while maintaining interoperability.
Solution Approach 2:
The agent function is designed with multi-functionality to handle multiple system call vectors through a single unified interface. By using the first pointer to receive calls from different vectors and the second pointer to uniformly redirect to the same agent function, the system achieves universal interception capability that works across different kernel versions and third-party products without requiring separate porting efforts.
2Reliability
If system call vectors are overwritten to intercept calls, then interception is achieved, but the vectors are normally protected as read-only values making modification difficult
Solution Approach 1:
The patent extracts the interception functionality from the protected system call vectors and relocates it to a separate agent function. Instead of modifying the read-only vectors directly, the system creates a copy of the vector entry (first pointer) that can be modified, while the actual interception logic is extracted into the agent function that receives calls through this copy.
Solution Approach 2:
The agent function performs preliminary action by establishing the first pointer to point to itself before the actual system call execution. This preliminary setup allows the protected system call vector to remain unchanged while the agent function prepares the interception mechanism in advance, avoiding the need to modify read-only memory during call execution.
3Productivity
If frequent kernel changes are made, then system call improvements are achieved, but repeated porting efforts are required for third-party software
Solution Approach 1:
The patent segments the system call interception architecture into separate components: the protected system call vectors, the modifiable first pointers, and the agent function. This segmentation allows the kernel to be updated independently without affecting third-party software, as only the first pointers need to be updated to reflect new vector addresses, while the agent function remains unchanged.
Solution Approach 2:
The patent introduces dynamic adaptability through the first pointer mechanism that can automatically adjust to new system call vector addresses after kernel changes. The agent function maintains a dynamic relationship with the kernel symbols through these pointers, allowing it to adapt to kernel version changes without requiring code porting, thereby eliminating time loss from repeated porting efforts.
4Reliability
If direct interception of system calls is implemented, then interception effectiveness is achieved, but indirect methods for reading non-exported kernel symbols create complexity
Solution Approach 1:
The patent uses the first pointer as an intermediary mechanism that simplifies access to non-exported kernel symbols. Instead of directly reading protected kernel symbols which requires complex indirect methods, the system modifies the first pointer to point to the agent function, creating a simpler and more maintainable interface that reduces the complexity of symbol access while maintaining interception effectiveness.
Data Source
AI summary
A method for interposing on operating system calls in a host is provided. The method includes patching an operating system kernel function, the patching comprising adding a first pointer that invokes an agent function, the patching performed by an agent. The method includes executing the agent function, responsive to a system call stub calling the operating system kernel function, which invokes the agent function via the first pointer, wherein at least one action of the method is performed by a processor of a host having an operating system.