Re: System call hooking in 2.6 kernel..

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tue, Nov 11, 2008 at 5:24 AM,  <lech@xxxxxxxxxxxxxxxx> wrote:

>> there is only 4 debug registers available, whereas kprobe allow
>> limitless (almost????) numbers of probe points.
>
> Well yes - but if you want to trace syscalls you can just set the trap for
> the call gate.

yes, of course, since all syscall get executed via int 0x80, or
SYSENTER, so setting breakpoint on these two points in the kernel can
catch all syscall.

-- 
Regards,
Peter Teoh

--
To unsubscribe from this list: send an email with
"unsubscribe kernelnewbies" to ecartis@xxxxxxxxxxxx
Please read the FAQ at http://kernelnewbies.org/FAQ


[Index of Archives]     [Newbies FAQ]     [Linux Kernel Mentors]     [Linux Kernel Development]     [IETF Annouce]     [Git]     [Networking]     [Security]     [Bugtraq]     [Yosemite]     [MIPS Linux]     [ARM Linux]     [Linux RAID]     [Linux SCSI]     [Linux ACPI]
  Powered by Linux