Trampoline tables

gistfile1.txt

Original case ( without intercepting ):

/------------------------------\
| application                  |
\------------------------------/
    |
    |
/------------------------------\
| libc                         |
|                              |
| syscall    syscall   syscall |
|    |          |         |    |
\----|----------|---------|----/
     |          |         |
     |          |         |  user space/kernel boundary
#### | ######## | ####### | #######
     |          |         |
    Linux


After hotpaching ( without a trampoline table ):

/------------------------------\
| application                  |
\------------------------------/
    |
    |
/------------------------------\
| libc                         |
|                              |
|   jmp        jmp       jmp   |
|    |          |         |    |
|    |   |      |  |      |  | |
\----|---|------|--|------|--|-/
     |   |      |  |      |  |
/----|---|------|--|------|--|-\
|    |   |      |  |      |  | |
|   open |    read |   write | |
|      jmp       jmp       jmp |
|                              |
| intercepting library         |
|                              |
|                              | 
| syscall                      |
|    |                         |
\----|-------------------------/
     |
     |                       user space/kernel boundary
#### | ############################
     |
    Linux


After hotpaching ( with a trampoline table ):

/------------------------------\
| application                  |
\------------------------------/
    |
    |
/------------------------------\
| libc                         |
|                              |
|     /------------------------------\
|    /                         |      \
|   /         /----------------------\ \
|   |         |                |      \ \
| jmp      jmp       jmp -----------\  \ \
|  |        |         |        |     \  \ \
|  |        |         |        |      \  \ \
\--|--------|---------|--------/       \  \ \
   |        |         |                 \  \ \
   |        |         |                 |  | |
/--|--------|---------|--------------\  |  | |
|  |        |         |   trampoline |  |  | |
|  jmp      jmp       jmp table      |  |  | |
|    |        |         |            |  |  | |
|    |        |         |            |  |  | |
\----|--------|---------|------------/  |  | |
     |        |         |               /  / /
     |        |         |              /  / /
/----|--------|---------|------\      /  / /
|    |        |         |      |     /  / /
|  open     write     read     |    /  / /
|      jmp      jmp       jmp------/  / /
|       |        |             |     / /
|       \        \------------------/ /
|        \                     |     /
|         \-------------------------/
|                              |
| intercepting library         |
|                              |
|                              | 
| syscall                      |
|    |                         |
\----|-------------------------/
     |
     |                       user space/kernel boundary
#### | ############################
     |
    Linux