Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Syscall table uses hardcoded numbers #15

Open
lpereira opened this issue Jul 17, 2020 · 0 comments
Open

Syscall table uses hardcoded numbers #15

lpereira opened this issue Jul 17, 2020 · 0 comments
Labels
Arch related to the architecture procmon is running on Build related to building procmon enhancement New feature or request

Comments

@lpereira
Copy link

Syscall numbers vary between different architectures, so tables like this won't be portable for arches other than x86_64.

These tables can be built by running a script like this during build time:

echo "#include <sys/syscall.h>" | \
    cpp -dM | \
    grep '^#define __NR_' | \
    sed -r -n -e 's/^\#define[ \t]+__NR_([a-z0-9_]+)[ \t]+([0-9]+)(.*)/ [\2] = "\1",/p'

Which will produce something like:

 [247] = "waitid",
 [75] = "fdatasync",
 [245] = "mq_getsetattr",
 [204] = "sched_getaffinity",
 [42] = "connect",
 [281] = "epoll_pwait",
 [175] = "init_module",
 [176] = "delete_module",
 [258] = "mkdirat",
 [130] = "rt_sigsuspend",
 [257] = "openat",
(...)

(It can be easily tweaked to produce the inverted table, too.)

Calling cpp directly might not be the best thing to do, however, especially if you want to prepare this for cross-compilation. Should be possible to perform this pipeline mostly in CMake, though.

@josalem josalem added Build related to building procmon enhancement New feature or request Arch related to the architecture procmon is running on labels Jul 17, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Arch related to the architecture procmon is running on Build related to building procmon enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants