Skip to content

Interruptor 1.0.8
Compare
Choose a tag to compare
@FrenchYeti FrenchYeti released this 29 Nov 21:34
· 25 commits to main since this release
v1.0.8
298738b

Annoucements

Important : InterruptorAPI to define syscalls/modules excluded/included has been changed. This page ll be updated ASAP

Interruptor API has now a website

Interruptor is now available as NPM package : @reversense/interruptor

News

Interruptor is now a bit more multiplatform than the time, and support tracing for followings combinations :

  • linux / arm64
  • linux / arm
  • linux / x64

Add aarch32 supports and extend the parsing of syscall args for x64.

🔥 Improvements :

  • Move entire project from CommonJS to ESM to allow it to be directly used by frida (frida-compile not still required)
  • Improve typing (type for everything including syscall signature)
  • Improve ErrorCode parsing for arm64
  • Add aarch32 support for Linux syscalls tracing
  • Improve x64 support for Linux syscalls tracing
  • Fix bugs inside argument parsing
  • Improve reliability

✅ Supported:

  • linux : x64 / aarch64 / aarch32
  • Close to 100% of coverage for Flag/Bitmap textual decomposition
  • Add a way to define structures for complex arguments, to parse and dump it
  • Internals : add a callback to execute code only when the device is virtual
  • Parsing of syscall args (near of 100% for primitive types) : ORed flags, mode, descriptors, ..
  • Start to retrieve name of error code
  • More than 1200 constants from Kernel supported
  • Implement all descriptors : fd, dfd, wd, sockfd, msqd, ..
  • API to use constant from Kernel API inside hooks, including error code
  • Follow Threads
  • Module filtering by name, by regexp, by properties
  • System call filtering by name, by regexp, by properties
  • Thread coloring
  • Android/Arm64 syscalls according to AOSP
  • Include deprecated syscalls/flags from linux kernel 2.x -> 5.x
  • SVC hooking
  • Dynamic loading
  • Callback function when start() happens

📆 Partially supported:

* socket, ...
* Signals
* Error code retrieving / returned value parsing
* Contextual args hint : exploring cmd/opts as in prctl()
* Coverage

🛰️ Not supported:

* MacOS
* windows
* HVC, SMC, ...
* follow fork
Assets 5
Loading