ASC-Hook: Efficient System Call Interception for ARM
summary
Binary-rewriting framework that intercepts ARM SVCs by replacing the SVC plus its preceding MOV/ADRP and redirecting to a per-SVC trampoline; uses a hybrid replacement strategy and a three-level trampoline hierarchy to preserve return addresses and avoid unaligned jumps. Falls back to BRK/illegal-instruction signal handling for rare corner cases. Implementation supports thousands of trampolines (≈3.8k limit before ADRP fallback), cuts interception overhead to as low as 1/29 of existing methods, and shows an average runtime loss of about 3.8% on syscall-heavy workloads; limitations include pre-startup rewriting and vDSO/Windows/Mac restrictions.
AI-written summary · about
chapters (12)
- 0:00ASC-Hook for ARM
- 0:43System call interception challenges
- 2:32ARM interception observations
- 4:15ASC-Hook replacement strategy
- 6:23Trampoline for return address
- 8:31Signal-based edge cases
- 10:20Experimental setup and performance
- 11:44Throughput and benchmarks impact
- 12:46Transfer size vs performance
- 13:48Limitations and constraints
- 15:34Conclusion
- 16:19Q&A on LD_PRELOAD
related talks
32mRISC-V ftrace: working with preemption
48mCapturing 0Day Exploits With Perfectly Placed Hardware Traps
24mTriaging Crashed With Backward Taint Analysis For Arm Architecture
14mzpoline: a system call hook mechanism based on binary rewriting
20mJumpSwitches: Restoring the Performance of Indirect Branches In the Era of Spectre
41mUsing Microarchitectural Design to Break KASLR and More
57mreturn-to-csu: A New Method to Bypass 64-bit Linux ASLR
27mTuning in-kernel routines on RISC-V