A hooking API allows you to define callbacks on top of the system calls you intercept

[qth1991]

Hi, I can only get “event” and “name” now，How can we get hook ?
This is my

Here is your

[Wenzel]

Did you modified the syscall.hook dict while in the callback ?
Look at the example.

[Wenzel]

Use define_hook:
https://github.com/KVM-VMI/nitro/blob/master/nitro/backends/backend.py#L80

define a callback and pass it to this method.

def callback(syscall, backend):
    ...




    self.nitro.backend.define_hook('NtOpenFile', callback)

[Wenzel]

You can try to remove the definition of the hook, this will intercept all syscalls.
Check if you have NtOpenFile in one of them.

Otherwise you need to investigate by yourself.