System Call Modules

System call modules are simply KLDs that install a system call. In operating systems, a system call, also known as a system service request, is the mechanism an application uses to request service from the operating system's kernel.


In Chapter 2, Chapter 3, and Chapter 6, you'll be writing rootkits that either hack the existing system calls or install new ones. Thus, this section serves as a primer.

There are three items that are unique to each system call module: the system call function, the sysent structure, and the offset value.

The System Call Function

The system call function implements the system call. Its function prototype is defined in the <sys/sysent.h> header as:

 typedef int sy_call_t(struct thread *, void *);  ...

Get Designing BSD Rootkits now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.