Instrumenting syscall by static binary rewriting

Question

(The problem is updated... as the investigation goes deep)

My goal is to intercept all syscalls originated from a shared object file. The requirement is not to modify the kernel code (e.g. can not overwrite the syscall table).

I am considering static binary rewriting technique (specifically, dyninst) to do the job. However, dyninst can only specify instrumentation points by function name. While it is possible to exhaust all syscall functions, can dyninst or one of other static binary rewriting tools allow user to instrument at instruction level. That is, use syscall instruction as instrumentation point.

(I do prefer static instrumentation over the dynamic one, since I need to instrumen one specific shared object.)

Answer 1

PIN_AddSyscallEntryFunction and PIN_AddSyscallExitFunction should do the trick. Link to the Documentation.

Snippet using theses APIs : (credits to Jurriaan Bremer)

#include <stdio.h>
#include "pin.H"

void syscall_entry(THREADID thread_id, CONTEXT *ctx,
    SYSCALL_STANDARD std, void *v)
{
    printf("system-call: %d, arguments:",
        PIN_GetSyscallNumber(ctx, std));
    for (int i = 0; i < 4; i++) {
        ADDRINT value = PIN_GetSyscallArgument(ctx, std, i);
        printf("  %d 0x%08x", value, value);
    }
}

void syscall_exit(THREADID thread_id, CONTEXT *ctx,
    SYSCALL_STANDARD std, void *v)
{
    ADDRINT return_value = PIN_GetSyscallReturn(ctx, std);
    printf(", return-value: %d 0x%08x\n", return_value,
        return_value);
}

int main(int argc, char *argv[])
{
    if(PIN_Init(argc, argv)) {
        printf("Usage: %s <binary> [arguments]\n");
        return 0;
    }

    PIN_AddSyscallEntryFunction(&syscall_entry, NULL);
    PIN_AddSyscallExitFunction(&syscall_exit, NULL);

    PIN_StartProgram();
    return 0;
}