ASC-Hook: fast and transparent system call hook for Arm
Yang Shen (National University of Defense Technology), Min Xie (National University of Defense Technology), Wenzhe Zhang (National University of Defense Technology), and Tao Wu (Changsha University of Science, Technology)

TL;DR
ASC-Hook is a highly efficient and comprehensive system call interception framework for ARM, significantly reducing overhead and ensuring thorough monitoring through innovative binary rewriting techniques.
Contribution
The paper introduces ASC-Hook, a novel binary rewriting framework that overcomes ARM-specific challenges to enable fast, complete, and transparent system call interception.
Findings
Reduces interception overhead to at least 1/29 of existing tools.
Achieves an average performance loss of 3.7% in system call-intensive applications.
Provides a comprehensive interception strategy tailored for ARM architecture.
Abstract
Intercepting system calls is crucial for tools that aim to modify or monitor application behavior. However, existing system call interception tools on the ARM platform still suffer from limitations in terms of performance and completeness. This paper presents an efficient and comprehensive binary rewriting framework, ASC-Hook, specifically designed for intercepting system calls on the ARM platform. ASC-Hook addresses two key challenges on the ARM architecture: the misalignment of the target address caused by directly replacing the SVC instruction with br x8, and the return to the original control flow after system call interception. This is achieved through a hybrid replacement strategy and our specially designed trampoline mechanism. By implementing multiple completeness strategies specifically for system calls, we ensured comprehensive and thorough interception. Experimental results…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
