为什么某些Linux x86_64系统调用需要存根？

Question

If one tries to hook certain syscalls via sys_call_table -hooking, eg sys_execve this will fail, because they are indirectly called by a stub. For sys_execve this is stub_execve (compare assembly code on LXR ).

But what are these stubs good for? Why do only certain system calls like execve(2) and fork(2) require a stub and how is this connected to x86_64? Is there a workaround to hook stubbed syscalls (in a Loadable Kernel Module)?

Answer 1

From here , it says:

"Certain special system calls that need to save a complete full stack frame."

And I think execve is just one of these special system calls.

From the code of stub_execve , If you want to hook it, at least you can try:
(1) Get to understand the meaning of those assembly code and do it by yourself, then you can call your own function in your own assembly code.
(2) From the middle of the assembly code, it has a call sys_execve , you can replace the address of sys_execve to your own hook function.