Jonas L

DTRACE- SYSCALL HOOKS- whats the fuzz about? Some people tell me they get confused when they read my ramblings about dtrace. That is understandable - I will try to explain so its understandable for more people:

The security model of your computer is at its core seperated by ring 0 and usermode. At ring 0 is the kernel and your drivers. They run unconstrained- they can ask the hardware to do X and Y.

Everything else runs in usermode- and they need to ask ring0 to do stuff on their behalf. One mechanism for that is syscalls- a predefined list of operations that causes control flow to switch into ring0 - kernel validates the arguments and execute the matching operation.

You can see a list of syscalls at https://j00ru.vexillium.org/syscalls/nt/32/  As syscalls are a pathway for less privileged code to influence code executing at the highest privilege it is interesting for security researchers.

The same factors also make it interesting for rootkits(term describing malware executing in ring 0).

If you redirect the address where the system jumps to execute a given syscall you get perfect conditions to rewrite input/output then call oroginal address. That enables perfect hiding of code that execute on the system.

When you are in ring0 you can overwrite the address of the handler, this has been abused alot by malware.

So MS created patchguard, a system that periodically verifies the address have not been from their original content at boot. If tampering is detected- it will halt the system with a BSOD.