Skip to content

Instantly share code, notes, and snippets.

@hack3ric

hack3ric/README.md

Created May 24, 2023 11:43
Show Gist options
  • Save hack3ric/45685e367c323b2e57cf05dad36e35cc to your computer and use it in GitHub Desktop.
Save hack3ric/45685e367c323b2e57cf05dad36e35cc to your computer and use it in GitHub Desktop.
Download ZIP
Generate syscall info for Lurk
Raw
README.md
  • get-syscalls.py generates syscall informations.
  • syscalls-table-riscv.rs is an example of using get-syscalls.py to generate ones for RISC-V, with manual modifications noted.
Raw
get-syscalls.py
"""
Extracts syscall parameter info from Linux source headers.
Note that there might be missing some syscalls in the final result, or there
may be false positives. Manual check is needed after generation.
"""
import sys
import requests
import re
syscalls = requests.get(
"https://github.com/torvalds/linux/raw/master/include/linux/syscalls.h")
syscalls_regex = re.compile(
r'asmlinkage long sys_([\w\d_]+?)\(([^"]+?)\);', re.MULTILINE)
syscalls_matches = re.findall(syscalls_regex, syscalls.text)
defines = requests.get(
"https://github.com/torvalds/linux/raw/master/include/uapi/asm-generic/unistd.h")
defines_regex = re.compile(r'#define __NR[^_]*_([\w\d_]+) (\d+)')
defines_matches = re.findall(defines_regex, defines.text)
integers = ("int", "long", "uint32_t", "unsigned", "u32", "u64", "size_t", "pid_t", "s32",
"mqd_t", "loff_t", "clockid_t", "timer_t", "umode_t", "uid_t", "gid_t", "key_t",
"aio_context_t", "rwf_t", "qid_t", "__s32", "key_serial_t", "__u32", "off_t")
structs = ("struct", "enum", "union", "cap_user_header_t", "cap_user_data_t")
table = []
for a, b in defines_matches:
for c, d in syscalls_matches:
if c == a:
params = []
for p in d.split(','):
p = p.strip().removeprefix("const").strip()
if '*' not in p and p.startswith(integers):
params.append("INT")
elif '*' in p and p.startswith("char"):
params.append("STR")
elif '*' in p or p.startswith(structs):
params.append("ADDR")
elif p.startswith("void"):
params.append("VOID")
else:
print("UNKNOWN:", p, file=sys.stderr)
params.append("UNKNOWN")
if len(params) == 1 and params[0] == "VOID":
params = []
table.append((b, a, params))
break
else:
table.append((b, a, None))
prev = -999
for num, name, params in table:
num = int(num)
if num - prev > 1:
print(f"// {num}")
if params:
print(f"syscall!({name}, {', '.join(params)}),")
elif params != None:
print(f"syscall!({name}),")
else:
print(f"// TODO: syscall!({name})")
prev = num
Raw
syscalls-table-riscv.rs
// 0
syscall!(io_setup, INT, ADDR),
syscall!(io_destroy, INT),
syscall!(io_submit, INT, INT, ADDR),
syscall!(io_cancel, INT, ADDR, ADDR),
syscall!(io_getevents, INT, INT, INT, ADDR, ADDR),
syscall!(setxattr, STR, STR, ADDR, INT, INT),
syscall!(lsetxattr, STR, STR, ADDR, INT, INT),
syscall!(fsetxattr, INT, STR, ADDR, INT, INT),
syscall!(getxattr, STR, STR, ADDR, INT),
syscall!(lgetxattr, STR, STR, ADDR, INT),
syscall!(fgetxattr, INT, STR, ADDR, INT),
syscall!(listxattr, STR, STR, INT),
syscall!(llistxattr, STR, STR, INT),
syscall!(flistxattr, INT, STR, INT),
syscall!(removexattr, STR, STR),
syscall!(lremovexattr, STR, STR),
syscall!(fremovexattr, INT, STR),
syscall!(getcwd, STR, INT),
syscall!(lookup_dcookie, INT, STR, INT),
syscall!(eventfd2, INT, INT),
syscall!(epoll_create1, INT),
syscall!(epoll_ctl, INT, INT, INT, ADDR),
syscall!(epoll_pwait, INT, ADDR, INT, INT, ADDR, INT),
syscall!(dup, INT),
syscall!(dup3, INT, INT, INT),
syscall!(fcntl, INT, INT, INT),
syscall!(inotify_init1, INT),
syscall!(inotify_add_watch, INT, STR, INT),
syscall!(inotify_rm_watch, INT, INT),
syscall!(ioctl, INT, INT, INT),
syscall!(ioprio_set, INT, INT, INT),
syscall!(ioprio_get, INT, INT),
syscall!(flock, INT, INT),
syscall!(mknodat, INT, STR, INT, INT),
syscall!(mkdirat, INT, STR, INT),
syscall!(unlinkat, INT, STR, INT),
syscall!(symlinkat, STR, INT, STR),
syscall!(linkat, INT, STR, INT, STR, INT),
syscall!(renameat, INT, STR, INT, STR),
syscall!(umount2, STR, INT), // manually added
syscall!(mount, STR, STR, STR, INT, ADDR),
syscall!(pivot_root, STR, STR),
syscall!(nfsservctl, INT, ADDR, ADDR), // manually added
syscall!(statfs, STR, ADDR),
syscall!(fstatfs, INT, ADDR),
syscall!(truncate, STR, INT),
syscall!(ftruncate, INT, INT),
syscall!(fallocate, INT, INT, INT, INT),
syscall!(faccessat, INT, STR, INT),
syscall!(chdir, STR),
syscall!(fchdir, INT),
syscall!(chroot, STR),
syscall!(fchmod, INT, INT),
syscall!(fchmodat, INT, STR, INT),
syscall!(fchownat, INT, STR, INT, INT, INT),
syscall!(fchown, INT, INT, INT),
syscall!(openat, INT, STR, INT, INT),
syscall!(close, INT),
syscall!(vhangup),
syscall!(pipe2, ADDR, INT),
syscall!(quotactl, INT, STR, INT, ADDR),
syscall!(getdents64, INT, ADDR, INT),
syscall!(lseek, INT, INT, INT),
syscall!(read, INT, STR, INT),
syscall!(write, INT, STR, INT),
syscall!(readv, INT, ADDR, INT),
syscall!(writev, INT, ADDR, INT),
syscall!(pread64, INT, STR, INT, INT),
syscall!(pwrite64, INT, STR, INT, INT),
syscall!(preadv, INT, ADDR, INT, INT, INT),
syscall!(pwritev, INT, ADDR, INT, INT, INT),
syscall!(sendfile, INT, INT, ADDR, INT),
syscall!(pselect6, INT, ADDR, ADDR, ADDR, ADDR, ADDR),
syscall!(ppoll, ADDR, INT, ADDR, ADDR, INT),
syscall!(signalfd4, INT, ADDR, INT, INT),
syscall!(vmsplice, INT, ADDR, INT, INT),
syscall!(splice, INT, ADDR, INT, ADDR, INT, INT),
syscall!(tee, INT, INT, INT, INT),
syscall!(readlinkat, INT, STR, STR, INT),
syscall!(fstatat, INT, STR, ADDR, INT), // manually added
syscall!(fstat, INT, ADDR),
syscall!(sync),
syscall!(fsync, INT),
syscall!(fdatasync, INT),
syscall!(sync_file_range2, INT, INT, INT, INT),
syscall!(sync_file_range, INT, INT, INT, INT),
syscall!(timerfd_create, INT, INT),
syscall!(timerfd_settime, INT, INT, ADDR, ADDR),
syscall!(timerfd_gettime, INT, ADDR),
syscall!(utimensat, INT, STR, ADDR, INT),
syscall!(acct, STR),
syscall!(capget, ADDR, ADDR),
syscall!(capset, ADDR, ADDR),
syscall!(personality, INT),
syscall!(exit, INT),
syscall!(exit_group, INT),
syscall!(waitid, INT, INT, ADDR, INT, ADDR),
syscall!(set_tid_address, ADDR),
syscall!(unshare, INT),
syscall!(futex, ADDR, INT, INT, ADDR, ADDR, INT),
syscall!(set_robust_list, ADDR, INT),
syscall!(get_robust_list, INT, ADDR, ADDR),
syscall!(nanosleep, ADDR, ADDR),
syscall!(getitimer, INT, ADDR),
syscall!(setitimer, INT, ADDR, ADDR),
syscall!(kexec_load, INT, INT, ADDR, INT),
syscall!(init_module, ADDR, INT, STR),
syscall!(delete_module, STR, INT),
syscall!(timer_create, INT, ADDR, ADDR),
syscall!(timer_gettime, INT, ADDR),
syscall!(timer_getoverrun, INT),
syscall!(timer_settime, INT, INT, ADDR, ADDR),
syscall!(timer_delete, INT),
syscall!(clock_settime, INT, ADDR),
syscall!(clock_gettime, INT, ADDR),
syscall!(clock_getres, INT, ADDR),
syscall!(clock_nanosleep, INT, INT, ADDR, ADDR),
syscall!(syslog, INT, STR, INT),
syscall!(ptrace, INT, INT, INT, INT),
syscall!(sched_setparam, INT, ADDR),
syscall!(sched_setscheduler, INT, INT, ADDR),
syscall!(sched_getscheduler, INT),
syscall!(sched_getparam, INT, ADDR),
syscall!(sched_setaffinity, INT, INT, ADDR),
syscall!(sched_getaffinity, INT, INT, ADDR),
syscall!(sched_yield),
syscall!(sched_get_priority_max, INT),
syscall!(sched_get_priority_min, INT),
syscall!(sched_rr_get_interval, INT, ADDR),
syscall!(restart_syscall),
syscall!(kill, INT, INT),
syscall!(tkill, INT, INT),
syscall!(tgkill, INT, INT, INT),
syscall!(sigaltstack, ADDR, ADDR),
syscall!(rt_sigsuspend, ADDR, INT),
syscall!(rt_sigaction, INT, ADDR, ADDR, INT),
syscall!(rt_sigprocmask, INT, ADDR, ADDR, INT),
syscall!(rt_sigpending, ADDR, INT),
syscall!(rt_sigtimedwait, ADDR, ADDR, ADDR, INT),
syscall!(rt_sigqueueinfo, INT, INT, ADDR),
syscall!(rt_sigreturn), // manually added
syscall!(setpriority, INT, INT, INT),
syscall!(getpriority, INT, INT),
syscall!(reboot, INT, INT, INT, ADDR),
syscall!(setregid, INT, INT),
syscall!(setgid, INT),
syscall!(setreuid, INT, INT),
syscall!(setuid, INT),
syscall!(setresuid, INT, INT, INT),
syscall!(getresuid, ADDR, ADDR, ADDR),
syscall!(setresgid, INT, INT, INT),
syscall!(getresgid, ADDR, ADDR, ADDR),
syscall!(setfsuid, INT),
syscall!(setfsgid, INT),
syscall!(times, ADDR),
syscall!(setpgid, INT, INT),
syscall!(getpgid, INT),
syscall!(getsid, INT),
syscall!(setsid),
syscall!(getgroups, INT, ADDR),
syscall!(setgroups, INT, ADDR),
syscall!(uname, ADDR),
syscall!(sethostname, STR, INT),
syscall!(setdomainname, STR, INT),
syscall!(getrlimit, INT, ADDR),
syscall!(setrlimit, INT, ADDR),
syscall!(getrusage, INT, ADDR),
syscall!(umask, INT),
syscall!(prctl, INT, INT, INT, INT, INT),
syscall!(getcpu, ADDR, ADDR, ADDR),
syscall!(gettimeofday, ADDR, ADDR),
syscall!(settimeofday, ADDR, ADDR),
syscall!(adjtimex, ADDR),
syscall!(getpid),
syscall!(getppid),
syscall!(getuid),
syscall!(geteuid),
syscall!(getgid),
syscall!(getegid),
syscall!(gettid),
syscall!(sysinfo, ADDR),
syscall!(mq_open, STR, INT, INT, ADDR),
syscall!(mq_unlink, STR),
syscall!(mq_timedsend, INT, STR, INT, INT, ADDR),
syscall!(mq_timedreceive, INT, STR, INT, ADDR, ADDR),
syscall!(mq_notify, INT, ADDR),
syscall!(mq_getsetattr, INT, ADDR, ADDR),
syscall!(msgget, INT, INT),
syscall!(msgctl, INT, INT, ADDR),
syscall!(msgrcv, INT, ADDR, INT, INT, INT),
syscall!(msgsnd, INT, ADDR, INT, INT),
syscall!(semget, INT, INT, INT),
syscall!(semctl, INT, INT, INT, INT),
syscall!(semtimedop, INT, ADDR, INT, ADDR),
syscall!(semop, INT, ADDR, INT),
syscall!(shmget, INT, INT, INT),
syscall!(shmctl, INT, INT, ADDR),
syscall!(shmat, INT, STR, INT),
syscall!(shmdt, STR),
syscall!(socket, INT, INT, INT),
syscall!(socketpair, INT, INT, INT, ADDR),
syscall!(bind, INT, ADDR, INT),
syscall!(listen, INT, INT),
syscall!(accept, INT, ADDR, ADDR),
syscall!(connect, INT, ADDR, INT),
syscall!(getsockname, INT, ADDR, ADDR),
syscall!(getpeername, INT, ADDR, ADDR),
syscall!(sendto, INT, ADDR, INT, INT, ADDR, INT),
syscall!(recvfrom, INT, ADDR, INT, INT, ADDR, ADDR),
syscall!(setsockopt, INT, INT, INT, STR, INT),
syscall!(getsockopt, INT, INT, INT, STR, ADDR),
syscall!(shutdown, INT, INT),
syscall!(sendmsg, INT, ADDR, INT),
syscall!(recvmsg, INT, ADDR, INT),
syscall!(readahead, INT, INT, INT),
syscall!(brk, INT),
syscall!(munmap, INT, INT),
syscall!(mremap, INT, INT, INT, INT, INT),
syscall!(add_key, STR, STR, ADDR, INT, INT),
syscall!(request_key, STR, STR, STR, INT),
syscall!(keyctl, INT, INT, INT, INT, INT),
syscall!(clone, INT, INT, ADDR, INT, ADDR),
syscall!(execve, STR, STR, STR),
syscall!(mmap, ADDR, INT, INT, INT, INT, INT), // manually added
syscall!(fadvise64, INT, INT, INT, INT),
syscall!(swapon, STR, INT),
syscall!(swapoff, STR),
syscall!(mprotect, INT, INT, INT),
syscall!(msync, INT, INT, INT),
syscall!(mlock, INT, INT),
syscall!(munlock, INT, INT),
syscall!(mlockall, INT),
syscall!(munlockall),
syscall!(mincore, INT, INT, ADDR),
syscall!(madvise, INT, INT, INT),
syscall!(remap_file_pages, INT, INT, INT, INT, INT),
syscall!(mbind, INT, INT, INT, ADDR, INT, INT),
syscall!(get_mempolicy, ADDR, ADDR, INT, INT, INT),
syscall!(set_mempolicy, INT, ADDR, INT),
syscall!(migrate_pages, INT, INT, ADDR, ADDR),
syscall!(move_pages, INT, INT, ADDR, ADDR, ADDR, INT),
syscall!(rt_tgsigqueueinfo, INT, INT, INT, ADDR),
syscall!(perf_event_open, ADDR, INT, INT, INT, INT),
syscall!(accept4, INT, ADDR, ADDR, INT),
syscall!(recvmmsg, INT, ADDR, INT, INT, ADDR),
// 260
syscall!(wait4, INT, ADDR, INT, ADDR),
syscall!(prlimit64, INT, INT, ADDR, ADDR),
syscall!(fanotify_init, INT, INT),
syscall!(fanotify_mark, INT, INT, INT, INT, STR),
syscall!(name_to_handle_at, INT, STR, ADDR, INT, INT), // manually added
syscall!(open_by_handle_at, INT, ADDR, INT), // manually added
syscall!(clock_adjtime, INT, ADDR),
syscall!(syncfs, INT),
syscall!(setns, INT, INT),
syscall!(sendmmsg, INT, ADDR, INT, INT),
syscall!(process_vm_readv, INT, ADDR, INT, ADDR, INT, INT),
syscall!(process_vm_writev, INT, ADDR, INT, ADDR, INT, INT),
syscall!(kcmp, INT, INT, INT, INT, INT),
syscall!(finit_module, INT, STR, INT),
syscall!(sched_setattr, INT, ADDR, INT),
syscall!(sched_getattr, INT, ADDR, INT, INT),
syscall!(renameat2, INT, STR, INT, STR, INT),
syscall!(seccomp, INT, INT, ADDR),
syscall!(getrandom, STR, INT, INT),
syscall!(memfd_create, STR, INT),
syscall!(bpf, INT, ADDR, INT),
syscall!(execveat, INT, STR, STR, STR, INT),
syscall!(userfaultfd, INT),
syscall!(membarrier, INT, INT, INT),
syscall!(mlock2, INT, INT, INT),
syscall!(copy_file_range, INT, ADDR, INT, ADDR, INT, INT),
syscall!(preadv2, INT, ADDR, INT, INT, INT, INT),
syscall!(pwritev2, INT, ADDR, INT, INT, INT, INT),
syscall!(pkey_mprotect, INT, INT, INT, INT),
syscall!(pkey_alloc, INT, INT),
syscall!(pkey_free, INT),
syscall!(statx, INT, STR, INT, INT, ADDR),
syscall!(io_pgetevents, INT, INT, INT, ADDR, ADDR, ADDR),
syscall!(rseq, ADDR, INT, INT, INT),
syscall!(kexec_file_load, INT, INT, INT, STR, INT),
// 403
// These time64 syscalls are the same as the original variant on 64-bit systems.
syscall!(clock_gettime64, INT, ADDR), // manually added
syscall!(clock_settime64, INT, ADDR), // manually added
syscall!(clock_adjtime64, INT, ADDR), // manually added
syscall!(clock_getres_time64, INT, ADDR), // manually added
syscall!(clock_nanosleep_time64, INT, INT, ADDR, ADDR), // manually added
syscall!(timer_gettime64, INT, ADDR), // manually added
syscall!(timer_settime64, INT, INT, ADDR, ADDR), // manually added
syscall!(timerfd_gettime64, INT, ADDR), // manually added
syscall!(timerfd_settime64, INT, INT, ADDR, ADDR), // manually added
syscall!(utimensat_time64, INT, STR, ADDR, INT), // manually added
syscall!(pselect6_time64, INT, ADDR, ADDR, ADDR, ADDR, ADDR), // manually added
syscall!(ppoll_time64, ADDR, INT, ADDR, ADDR, INT), // manually added
// 416
syscall!(io_pgetevents_time64, INT, INT, INT, ADDR, ADDR, ADDR), // manually added
syscall!(recvmmsg_time64, INT, ADDR, INT, INT, ADDR), // manually added
syscall!(mq_timedsend_time64, INT, STR, INT, INT, ADDR), // manually added
syscall!(mq_timedreceive_time64, INT, STR, INT, ADDR, ADDR), // manually added
syscall!(semtimedop_time64, INT, ADDR, INT, ADDR), // manually added
syscall!(rt_sigtimedwait_time64, ADDR, ADDR, ADDR, INT), // manually added
syscall!(futex_time64, ADDR, INT, INT, ADDR, ADDR, INT), // manually added
syscall!(sched_rr_get_interval_time64, INT, ADDR), // manually added
syscall!(pidfd_send_signal, INT, INT, ADDR, INT),
syscall!(io_uring_setup, INT, ADDR),
syscall!(io_uring_enter, INT, INT, INT, INT, ADDR, INT),
syscall!(io_uring_register, INT, INT, ADDR, INT),
syscall!(open_tree, INT, STR, INT),
syscall!(move_mount, INT, STR, INT, STR, INT),
syscall!(fsopen, STR, INT),
syscall!(fsconfig, INT, INT, STR, ADDR, INT),
syscall!(fsmount, INT, INT, INT),
syscall!(fspick, INT, STR, INT),
syscall!(pidfd_open, INT, INT),
syscall!(clone3, ADDR, INT),
syscall!(close_range, INT, INT, INT),
syscall!(openat2, INT, STR, ADDR, INT),
syscall!(pidfd_getfd, INT, INT, INT),
syscall!(faccessat2, INT, STR, INT, INT),
syscall!(process_madvise, INT, ADDR, INT, INT, INT),
syscall!(epoll_pwait2, INT, ADDR, INT, ADDR, ADDR, INT),
syscall!(mount_setattr, INT, STR, INT, ADDR, INT),
syscall!(quotactl_fd, INT, INT, INT, ADDR),
syscall!(landlock_create_ruleset, ADDR, INT, INT),
syscall!(landlock_add_rule, INT, ADDR, ADDR, INT),
syscall!(landlock_restrict_self, INT, INT),
syscall!(memfd_secret, INT),
syscall!(process_mrelease, INT, INT),
syscall!(futex_waitv, ADDR, INT, INT, ADDR, INT),
syscall!(set_mempolicy_home_node, INT, INT, INT, INT),
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment