Method and system for identifying and replacing system calls
One embodiment of the system disclosed herein facilitates identifying a system call in an application and replacing the identified system call with a customized function call. During operation, the system executes an executable file of the application, wherein the executable file has been modified to execute a hooking and injection manager at run time. Prior to executing the system call, the system executes the hooking and injection manager. While executing the hooking and injection manager, the system determines, from a symbol table, a symbol table index value corresponding to a symbol associated with the system call. The system further determines an import table entry storing a pointer to the system call based on the symbol table index value, and changes the pointer in the import table entry so that the pointer indicates an address of the customized function call.
1. A method for facilitating identifying a system call in an application and replacing the identified system call with a customized function call, comprising:
upon a launch of the application, loading a hooking and injection manager into a process of the application prior to loading any modules in the application that make system calls;
executing an executable file of the application, wherein the executable file has been modified to execute the hooking and injection manager at run time of the application, the hooking and injection manager including an interposition library configured to replace references to a system call with a respective reference to a customized function; and prior to the application making the system call:
determining, from a symbol table, symbol table index values corresponding to one or more symbols associated with each system call in the application;
determining, from an import table, an import table entry storing pointers to each respective system call based on corresponding symbol table index values;
if the import table is a lazy symbol table, searching through a load command section of an application object file for at least one load command for a pointer holding an address of an indirect table and the lazy symbol table, wherein the address of the indirect table is stored in a _lazy_symbol section in the load command section and is associated with an S_RESERVED1 field in the _lazy_symbol_section in the load command section, and waiting until a respective system function call is called to change the pointers to each respective system call in the lazy symbol table so that the pointers to each respective system call are updated to indicate an address of the respective customized function call; and
if the import table is a non-lazy symbol table, searching through the load command section of the application object file for at least one load command for a pointer holding an address of the indirect table and the non-lazy symbol table, wherein the address of the indirect table is stored in a _non_lazy_symbol section in the load command section and is associated with an S_RESERVED1 field in the _non_lazy_symbol_section in the load command section, and changing, prior to the application making the respective system call, the respective pointer to the respective system call in the non-lazy symbol table so that the respective pointer to the respective system call is updated to indicate the address of the respective customized function call.
2. The method of claim 1 , further comprising searching the executable file for a load command which indicates a location for a pointer to the import table.
3. The method of claim 1 , wherein the hooking and injection manager includes an interposition function which accepts as input a function name and an address for each customized function call.
4. The method of claim 1 , further comprising examining a load command to determine a size and location of the symbol table.
5. The method of claim 1 , wherein the executable file is a Mach-o file.
6. The method of claim 1 , wherein determining the import table entries storing the pointers to each of the system calls based on the symbol table index values comprises searching an indirect table for the import table entries that corresponds to the symbol table index values.
7. The method of claim 1 , wherein the hooking and injection manager is included in the executable file by a prior re-linking process.
8. The method of claim 1 , further comprising loading the hooking and injection manager by executing a load command added to the executable file.
9. The method of claim 1 , wherein the import table comprises a mapping from an index associated with a function symbol to an address for a function associated with the function symbol, and wherein the lazy symbol table includes only system calls that are called by the function symbol.
10. A non-transitory computer-readable storage medium storing instructions which, when executed by a processor, cause the processor to perform a method for facilitating identifying a system call in an application and replacing the identified system call with a customized function call, the method comprising:
upon a launch of the application, loading a hooking and injection manager into a process of the application prior to loading any modules in the application that make system calls;
executing an executable file of the application, wherein the executable file has been modified to execute the hooking and injection manager at run time of the application; and
prior to the application making a system call:
determining, from a symbol table, symbol table index values corresponding to one or more symbols associated with each system call in the application;
determining, from an import table, an import table entry storing pointers to each respective system call based on corresponding symbol table index values;
if the import table is a lazy symbol table, searching through a load command section of an application object file for at least one load command for a pointer holding an address of an indirect table and the lazy symbol table, wherein the address of the indirect table is stored in a _lazy_symbol section in the load command section and is associated with an S_RESERVED1 field in the _lazy_symbol_section in the load command section, and waiting until a respective system function call is called to change the pointers to each respective system call in the lazy symbol table so that the pointers to each respective system call are updated to indicate an address of the respective customized function call; and
if the import table is a non-lazy symbol table, searching through the load command section of the application object file for at least one load command for a pointer holding an address of the indirect table and the non-lazy symbol table, wherein the address of the indirect table is stored in a _non_lazy_symbol section in the load command section and is associated with an S_RESERVED1 field in the _non_lazy_symbol_section in the load command section, and changing, prior to the application making the respective system call, the respective pointer to the respective system call in the non-lazy symbol table so that the respective pointer to the respective system call is updated to indicate the address of the respective customized function call.
11. The storage medium of claim 10 , wherein the method further comprises searching the executable file for a load command which indicates a location for a pointer to the import table.
12. The storage medium of claim 10 , wherein the hooking and injection manager includes an interposition function which accepts as input a function name and an address for each customized function call.
13. The storage medium of claim 10 , wherein the method further comprises examining a load command to determine a size and location of the symbol table.
14. The storage medium of claim 10 , wherein the executable file is a Mach-o file.
15. The storage medium of claim 10 , wherein determining the import table entry storing the pointers to the system calls based on the symbol table index values comprises searching an indirect table for the import table entries that corresponds to the symbol table index values.
16. The storage medium of claim 10 , wherein the hooking and injection manager is included in the executable file by a prior re-linking process.
17. The storage medium of claim 10 , wherein the method further compromises:
loading the hooking and injection manager by executing a load command added to the executable file.
18. A computing system for facilitating identifying a system call in an application and replacing the identified system call with a customized function call, the system comprising:
one or more processors, and
a storage device coupled to the one or more processors storing instructions that, when executed by the one or more processors, cause the one or more processors to perform a method, the method comprising:
upon a launch of the application, loading a hooking and injection manager into a process of the application prior to loading any modules in the application that make system calls;
executing an executable file of the application, wherein the executable file has been modified to execute the hooking and injection manager at run time of the application; and
prior to the application making a system call:
determining, from a symbol table, symbol table index values corresponding to one or more symbols associated with each system call in the application;
determining, from an import table, an import table entry storing pointers to each respective system call based on corresponding symbol table index values;
if the import table is a lazy symbol table, searching through a load command section of an application object file for at least one load command for a pointer holding an address of an indirect table and the lazy symbol table, wherein the address of the indirect table is stored in a _lazy_symbol section in the load command section and is associated with an S_RESERVED1 field in the _lazy_symbol_section in the load command section, and waiting until a respective system function call is called to change the pointers to each respective system call in the lazy symbol table so that the pointers to each respective system call are updated to indicate an address of the respective customized function call; and
if the import table is a non-lazy symbol table, searching through the load command section of the application object file for at least one load command for a pointer holding an address of the indirect table and the non-lazy symbol table, wherein the address of the indirect table is stored in a _non_lazy_symbol section in the load command section and is associated with an S_RESERVED1 field in the _non_lazy_symbol_section in the load command section, and changing, prior to the application making the respective system call, the respective pointer to the respective system call in the non-lazy symbol table so that the respective pointer to the respective system call is updated to indicate the address of the respective customized function call.
19. The computing system of claim 18 , wherein the system further comprises searching the executable file for a load command which indicates a location for a pointer to the import table.
20. The computing system of claim 18 , wherein the hooking and injection manager includes an interposition function which accepts as input a function name and an address for each customized function call.
21. The computing system of claim 18 , wherein the hooking and injection manager is included in the executable file by a prior re-linking process.