zpoline: a system call hook mechanism based on binary rewriting
summary
zpoline implements a syscall hook by binary rewriting: it replaces two-byte syscall/sysenter with callq %rax and places a trampoline at address 0 that dispatches based on the syscall number so no surrounding instructions are overwritten. It uses XOM via mprotect and a bitmap caller-check to stop invalid fallthroughs. It runs on Linux FreeBSD NetBSD and DragonFly BSD and reports 28.1–761× lower overhead than prior exhaustive safe hooks and only 5.2% reduction* for Redis and a user-space network stack.
AI-written summary · about
chapters (6)
- 0:00zpoline introduction
- 4:21Existing hook limits
- 6:10Binary rewriting approach
- 9:21Null access handling
- 11:47Performance benchmarks
- 13:10Summary
related talks
21mASC-Hook: Efficient System Call Interception for ARM
49mXOM-switch: Hiding Your Code from Advanced Code Reuse Attacks In One Shot
26mReinventing Seccomp for Fun and Profiles
22mPrivbox: Faster System Calls Through Sandboxed Privileged Execution
34mXOM-switch: Hiding Your Code from Advanced Code Reuse Attacks In One Shot
11mQEMU-Native Hooking Bridge for Binary Fuzzing
39mRusty Swapping: Rewriting a Zswap Backend in Rust
37mThe history of a linux kernel design flaw