Skip to content
Advertisement

Tag: system-calls

assembly, how to use mprotect?

I am trying to make self modifying code in Linux. I thought it would works but didn’t. I used nasm on ubuntu 18.04. INT 0x80 return value is -22 0xffffffea I don’t know what is wrong. Answer Run your program under strace, like strace ./a.out to decode system call args and return values. Probably your base address isn’t page-aligned, or

BUG: unable to handle kernel paging request when accessing a custom struct in syscall

Using linux with kernel 4.4.21, I was required to implement a system call which has a custom struct’s pointer among its parameters. These are the files to to edit: I put sys_procmem.c (implementation) in linux-4.4.21/kernel/sys_procmem.c (sys_procmem.o added in that dir’s Makefile): Test: Both were killed miserably. dmesg: This was done inside a 64-bit Ubuntu 14.04 virtual machine. My friends had

More explanation on `statfs64`

According to documentation, the structure fields explanation follows: Does “total file nodes in file system” mean how much existing files we have? Does it include directories and links? What does mean “free file nodes in fs”? What is f_spare? In some Linux forks (for example, in Android) I see that f_spare size is 4, and additional field f_flags is defined.

Understanding read syscall

I’m reading man read manual page and discovered that it was possible to read less then the desired number of bytes passed in as a parameter: It is not an error if this number is smaller than the number of bytes requested; this may happen for example because fewer bytes are actually available right now (maybe because we were close

How can I find all syscalls that have to be whitelisted for seccomp?

I have an existing program that I would like to sandbox using seccomp (v2). How can I find what seccomp rules I need to allow for the program? I’ve tried adding seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(…), 0) for all syscalls printed by strace -xfc a.out, but apparently that wasn’t enough, since I’m still getting “SIGSYS, Bad system call” when I run the

Advertisement