Comments (1)
After studying the bug, I think checking is something else already hooked a sys_call is useless as there are only 2 possibilities:
a) sys_call isn't hooked, in which case just go and hook it
b) sys_call is hooked by something else, in which case we can do:
....b.1) nothing, which defeats the whole purpose of procmon
....b.2) hook it, ignoring the fact that we're hooking an already hooked sys_call,
...........in which case 2 things could happen:
........b.2.1) the thing that hooked the sys_call does nothing at all, stays in memory and plays nice with us, which
.................means that absolutely nothing bad will happen and everything will work.
........b.2.2) the thing that hooked the sys_call unloads itself from memory or plays bad with us, in which case bad
.................things will happen.
So, as soon as the moment in which I'm forced to choose between b.1) and b.2) I choose b.2) as that's what procmon is designed for. And from there on, there's nothing I can do in each case, b.2.1) nor b.2.2).
So, closing as WONTFIX.
from monks.
Related Issues (20)
- Stop sending empty messages to kernel module
- Maybe we're missing messages HOT 8
- Up/down keys are buggy
- Logging to file
- Use kernel thread to handle all the netlink messages HOT 5
- Use stub funcitons for the un/hook process HOT 39
- Procmon-viewer crashes while resizing HOT 2
- Multi-viewer support HOT 1
- Rename procmon to avoid conflicts with MS HOT 10
- Check if syscall table is faked HOT 15
- rmmod procmon.ko BUG? HOT 2
- Anti-rootkit
- Clear 32/86/64 mess HOT 2
- Data get's invalidated HOT 4
- Calculate how many syscalls are faked HOT 13
- Academic project
- Create wiki
- Wrong comments
- I have a question when I run make inside the root folder,'start_color' has not defined,but I already install the curse.h library,why? HOT 9
- Inserting of kernel module fails
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from monks.