syscall-intercept-rs

A Rust wrapper of pmem/syscall_intercept, a system call intercepting library on x86_64 Linux.

使用方法

安装依赖

sudo apt install cmake libcapstone-dev

将以下行添加到您的 Cargo.toml

[dependencies]
syscall-intercept = "0.1"

定义您的系统调用钩子函数

use syscall_intercept::*;

extern "C" fn hook(
    num: isize,
    a0: isize,
    a1: isize,
    a2: isize,
    a3: isize,
    a4: isize,
    a5: isize,
    result: &mut isize,
) -> InterceptResult {
    ...
}

启用或禁用拦截

unsafe { set_hook_fn(hook) };
unsafe { unset_hook_fn() };

发出未被拦截的系统调用

let ret = unsafe { syscall_no_intercept(libc::SYS_exit as _, 0) };

许可证

MIT 许可证