syscall_intercept icon indicating copy to clipboard operation
syscall_intercept copied to clipboard

How to place `intercept_hook_point*` pointers on thread local storge and actually use it?

Open hurryman2212 opened this issue 3 years ago • 1 comments

I want to make these hooking function pointers to be placed on thread local storage, in order to selectively disable and enable hooking on individual thread. But change definition of these variables with __attribute((tls_model("initial-exec"))) _Thread_local leads to having uninitialized (NULL) value on child threads. Is it related to the disassembly process? Is there a known way to put instruction address to jump for syscall instruction wrapper?

Also, assigning function address to intercept_hook_point_clone_child seems to not call hooked function at clone() at all with or without __attribute((tls_model("initial-exec"))) _Thread_local. Is it normal behavior?

hurryman2212 avatar Aug 01 '22 08:08 hurryman2212

Hello, hurryman2212, I have the same question as you。Does your question has been solved ? Do you can write your solution if question get answer. Any help will be apreciated !

GzhuFlyer avatar Sep 26 '22 08:09 GzhuFlyer

TLS is reset to zero after clone. You have to set the variables manually every time you create a new thread. The result is that intercept_hook_point_clone_child will never work and intercept_hook_point will only work after you assign it from the new thread.

en4bz avatar Nov 24 '22 01:11 en4bz

TLS is reset to zero after clone. You have to set the variables manually every time you create a new thread. The result is that intercept_hook_point_clone_child will never work and intercept_hook_point will only work after you assign it from the new thread.

Back then, I didn't know about it. So this issue (question) should be closed now. Like he said, intercept_hook_point_clone_child cannot be modified after clone, so if someone wants this, they should implement a 'trampoline' procedure.

hurryman2212 avatar Apr 25 '23 01:04 hurryman2212