Hacker News new | past | comments | ask | show | jobs | submit login

How is this done?

I think kernels try not to leak the address of system calls at run time, and if they are scattered around in a 64bit address space they are tough to search for. Educate me!




I have no idea, but couldn't you use some part of the software you just compromised that makes syscalls?


There are no syscalls as the fine article explains.


Ah, wait, I mis-read your comment and it's too late to edit mine. Yes, that sounds plausible, and particularly if you have the source code, which you do for many common servers.




Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: