Struct SpoofedSyscall 

pub struct SpoofedSyscall { /* private fields */ }

spoofed syscall invoker

wraps a syscall with return address spoofing to evade call stack analysis

Implementations

impl SpoofedSyscall

pub fn new(name: &str) -> Result<Self>

create spoofed syscall from name with default config

pub fn with_config(name: &str, config: SpoofConfig) -> Result<Self>

create spoofed syscall with custom configuration

pub fn from_entry_with_config( entry: &SyscallEntry, config: SpoofConfig, ) -> Result<Self>

create from syscall entry with config

pub fn from_entry(entry: &SyscallEntry) -> Result<Self>

create from syscall entry with default config

pub fn ssn(&self) -> u16

get syscall number

pub fn name(&self) -> &str

get syscall name

pub fn mode(&self) -> SpoofMode

get the spoofing mode

pub fn gadget_addr(&self) -> Option<usize>

get gadget address (if using gadget mode)

impl SpoofedSyscall

pub unsafe fn call0(&self) -> i32

invoke spoofed syscall with 0 arguments

Safety

caller must ensure the syscall is appropriate to call with 0 args

pub unsafe fn call1(&self, arg1: usize) -> i32

invoke spoofed syscall with 1 argument

Safety

caller must ensure args are valid for this syscall

pub unsafe fn call2(&self, arg1: usize, arg2: usize) -> i32

invoke spoofed syscall with 2 arguments

Safety

caller must ensure args are valid for this syscall

pub unsafe fn call3(&self, arg1: usize, arg2: usize, arg3: usize) -> i32

invoke spoofed syscall with 3 arguments

Safety

caller must ensure args are valid for this syscall

pub unsafe fn call4( &self, arg1: usize, arg2: usize, arg3: usize, arg4: usize, ) -> i32

invoke spoofed syscall with 4 arguments

Safety

caller must ensure args are valid for this syscall

pub unsafe fn call5( &self, arg1: usize, arg2: usize, arg3: usize, arg4: usize, arg5: usize, ) -> i32

invoke spoofed syscall with 5 arguments

Safety

caller must ensure args are valid for this syscall

pub unsafe fn call6( &self, arg1: usize, arg2: usize, arg3: usize, arg4: usize, arg5: usize, arg6: usize, ) -> i32

invoke spoofed syscall with 6 arguments

Safety

caller must ensure args are valid for this syscall

pub unsafe fn call_many(&self, args: &[usize]) -> i32

invoke with variable arguments

Safety

caller must ensure args are valid for this syscall