System calls differ from regular function calls by using the CPU’s privileged syscall instruction, indirect indexing via registers, and a mode switch from user to kernel space, allowing the OS to control which kernel functions applications can invoke, while ordinary calls use direct addresses and stay in user mode.
This article explores Linux system call hooking by first reviewing syscall fundamentals, then detailing various Hook techniques—including function pointer replacement, LD_PRELOAD, and kernel modules—accompanied by C/C++ examples, and demonstrates practical applications in security monitoring, performance optimization, and debugging across real-world scenarios.
This article explains how system calls differ from regular function calls, demonstrates a simple x86_64 hello‑world program that uses the syscall instruction, and details how Linux maps syscall numbers to kernel functions via the MSR LSTAR register.
This article explains how the fork() system call creates a duplicate process in Linux, walks through a simple code experiment, details the kernel steps—including task_struct creation, PID allocation, copy-on-write memory handling, and resource inheritance—and highlights common use cases, optimizations, and pitfalls.
This article explains the concepts and implementation of Linux system‑call hooking, covering both user‑space techniques like LD_PRELOAD and kernel‑space methods such as inline patches and kprobes, and shows how to monitor, filter, and secure calls without breaking normal program flow.
This article demystifies memory I/O by exploring its hardware foundations, the interaction between CPU and memory controllers, the role of user and kernel spaces, timing parameters, cache hierarchies, and practical optimization strategies for databases, file systems, and server applications.
A nostalgic narrative explains how low‑level hardware control led to the invention of system calls, kernel/user modes, and ultimately the operating system concept, illustrating the transition from direct hardware manipulation to abstracted library functions.
In the 1950s programmers wrote directly to hardware, but the fragility of hard‑coded memory and I/O led to the invention of a privileged “expert” kernel mode and a restricted “novice” user mode, with a special instruction to switch, forming the basis of modern system calls and operating system protection.
This article explains the inner workings of the classic strace command by building a minimal tracer in C, detailing how ptrace attaches to a target process, sets up syscall tracing, waits for signals, reads the ORIG_RAX register, and prints system call names, while also exposing the relevant Linux kernel source.
This article provides a comprehensive analysis of the Linux kernel's task_struct data structure, detailing its members such as task IDs, parent‑child relationships, state flags, credentials, scheduling information, signal handling, memory and file management, kernel stack layout, and its role in process creation via system calls like fork.
This article provides a comprehensive overview of how Linux kernel system calls are implemented on the x86-64 architecture, covering the conceptual differences from regular function calls, register conventions, initialization processes, syscall tables, and practical assembly examples such as write and getpid.
This article explains the Linux poll() system call, detailing its pollfd structure, event flags, parameters like nfds and timeout, return values, and step‑by‑step operation flow for reading and writing data, highlighting differences from select and its advantages on 32‑bit systems.
This article explains the concept of system calls, how they provide a privileged interface between user programs and the kernel, distinguishes them from APIs and library functions, and describes their role in Linux operating‑system architecture and application development.
This article explains Linux memory mapping (mmap), covering its purpose, API parameters, different mapping types, internal kernel implementation, page‑fault handling, copy‑on‑write semantics, practical use cases, and includes a complete Objective‑C example demonstrating file mapping and manipulation.
Researchers from Shanghai Jiao Tong University, Ant Security Light-Year Lab, and Zhejiang University present HODOR, a system that reduces the attack surface of Node.js applications by generating fine-grained system‑call allowlists using Seccomp, achieving an average 80% reduction in exploit surface with negligible runtime overhead.
This article explains what Linux system calls are, how they are implemented—including parameter preparation, mode switching, execution, and return—and lists common file, process, network, and device calls, highlighting their role in enabling applications to access kernel services.
The article explains the traditional Linux read/write system‑call I/O path, detailing the multiple CPU and DMA copies, context switches, page‑cache mechanisms, and advanced techniques such as zero‑copy, multiplexing, and direct I/O for performance optimization.
This article investigates Linux's handling of files that are in use—whether opened for reading, running as executables, or loaded as shared libraries—by experimenting with deletion, replacement, and modification, revealing how the kernel preserves file contents via inode references until all processes release them.
This guide explains what a Linux driver is, classifies character, block and network devices, walks through the open() system call flow from user space to the kernel’s VFS and driver list, and shows how to write, compile, and load a simple character device driver module.
This article explains how Linux traditional read/write system calls work, detailing the CPU, DMA copies and context switches involved, and then explores high‑performance I/O techniques such as zero‑copy, multiplexing and PageCache, together with the Linux I/O stack and buffering layers.
The article explains Linux’s traditional system‑call I/O path, detailing how read() and write() trigger multiple CPU and DMA copies and context switches, describes read and write workflows, explores network and disk I/O, examines the Linux I/O stack, page cache, buffering strategies, zero‑copy, mmap and Direct I/O, and discusses performance trade‑offs.
This article explains the Linux exec command, its syntax and options, provides practical examples, and expands on how exec replaces a process without creating a new PID, offering deeper insight into process management and system calls.
This article explains the structure and operation of Linux timerfd, covering its representation in /proc, the timerfd_create/settime/gettime system calls, internal kernel structures, and how timerfd integrates with epoll for event-driven programming.
This article explains core operating‑system concepts such as processes, threads, their control blocks and contexts, details how CPU, process, and thread context switches and system calls work on Linux, and shows how to analyze them with vmstat, pidstat, and sysbench for performance tuning.
The Linux community announced the first release candidate of the 5.14 kernel, featuring contributions from about 1,650 developers, over 13,000 commits, new memfd_secret system call, extensive driver and architecture updates, and numerous core subsystem enhancements.
This article explains Go's MPG scheduling model, detailing how Goroutine, M, and P interact during blocking, asynchronous and synchronous system calls, the role of the netpoller, and the sysmon coroutine that enables preemptive scheduling and runtime monitoring.
The PHP chroot() function changes the current process's root directory to a specified path, works only on supported systems in CLI/CGI/embedded SAPI with root privileges, returns TRUE on success or FALSE on failure, and is illustrated with a simple example.
From the moment a user types a command in the shell to the final exit of the program, this article walks through Linux’s execution pipeline—including shell command parsing, fork, execve, kernel loading via load_elf_binary, the dynamic linker’s role, and the glibc startup sequence—illustrated with detailed diagrams and code snippets.
An in‑depth look at the core differences between Linux and Windows kernels, covering kernel fundamentals, user‑ versus kernel‑space, system calls, Linux’s monolithic design with multitasking, SMP and ELF format, and Windows NT’s hybrid architecture with the PE executable format.
This article explains the concepts of kernel space and user space in a 32‑bit OS, why they are separated, the distinction between kernel mode and user mode, how processes transition between them, and the overall Linux system structure.
The article explains PHP’s chgrp function, which changes a file’s group ownership, outlines its syntax, required parameters, permission restrictions, return values, and provides a complete PHP example demonstrating how to modify a file’s group and display the result.
This article explains why operating system and driver defects cause system hangs and reboots, introduces the methodology of memory dump analysis—including deadlock and exception techniques—and walks through a real Linux kernel panic case to illustrate how to trace, diagnose, and remediate such crashes.
Linux system calls provide the interface between user programs and the kernel, and this article explains the three implementation methods—software interrupts, fast syscall instructions (SYSENTER/SYSCALL), and the virtual dynamic shared object (vDSO)—detailing their operation, performance impact, and relevant assembly code examples.
This article explains what an IDT is, how it is initialized, the structure of interrupt descriptor entries and gates, the implementation of traditional system calls via int 0x80, and the setup and handling of hardware interrupts in the Linux kernel.
This article explains Linux’s virtual address space, the mmap system call, its prototype and typical applications—including shared file mapping, inter‑process communication, and file I/O optimization—while illustrating concepts with diagrams and code examples, and discusses alignment, copy‑on‑write, and memory swapping considerations.
This article explains three ways to perform Linux system calls—using glibc wrapper functions, the low‑level syscall interface, and inline assembly with the int 0x80 instruction—illustrating each method with a chmod example, error handling, and code snippets.
This article explains how the Linux init process (pid 1) transitions from kernel mode to user mode using kernel_execve and the int 0x80 system call, detailing the register changes, assembly flow, and verification experiment that reveal the privilege level switch.
This article explains how the Linux init process (pid 1) transitions from kernel mode to user mode, detailing the role of kernel_thread, run_init_process, kernel_execve, the int 0x80 system call, register changes, and a practical experiment confirming the __USER_CS value.
This article explains the Linux mmap system call, its usage, flags, error handling, related calls like munmap and msync, two shared‑memory techniques, and the underlying virtual‑address and vm_area_struct mechanisms that enable memory mapping.
