Skip to content

refactor: replace kprobe/tracepoint with syscall hook/inline hook#35

Draft
5ec1cff wants to merge 24 commits intomainfrom
atomctx
Draft

refactor: replace kprobe/tracepoint with syscall hook/inline hook#35
5ec1cff wants to merge 24 commits intomainfrom
atomctx

Conversation

@5ec1cff
Copy link
Owner

@5ec1cff 5ec1cff commented Feb 25, 2026

目前,KernelSU 中有多处 hook 依赖 kprobes 和 tracepoint ,然而这些 hook 的回调运行在原子上下文,不便于调用可能睡眠的函数(如 kmalloc(GFP_KERNEL), strncpy_from_user 等),导致部分代码需要移动到 task_work 中执行或者不得不以不安全的方式执行(如多处读用户内存的代码),在代码编写上有诸多不便。我们希望将这些 hook 重构为 syscall hook 或者 inline hook ,以避免 hook 回调处于原子上下文中。

目前状况:

组件 被 hook 函数 原 hook 方式 新 hook 方式 备注
ksud sys_execve kprobes syscall hook 监控 init 和 zygote 进程启动状态以维护启动阶段状态,负责 sepolicy 加载
ksud sys_read kprobes syscall hook 处理 init.rc 注入
ksud sys_fstat kprobes syscall hook 处理 init.rc 注入
ksud input_event kprobes -(不变) 处理安全模式按键事件
syscall_hook_manager syscall_regfunc kprobes -(不变) 维护 syscall tracepoint 状态和进程标记
syscall_hook_manager syscall_unregfunc kprobes -(不变) 维护 syscall tracepoint 状态和进程标记
syscall_hook_manager trace_sys_enter tracepoint inline hook 提供 sucompat, unmount 等功能
supercalls sys_reboot kprobes -(不变) 提供 ksu supercall

@5ec1cff 5ec1cff changed the title Atomctx refactor: replace kprobe/tracepoint with syscall hook/inline hook Feb 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant