Lunatik
Lua API · Tracing and scheduling

syscallModule

Accessing kernel system call information.

Retrieves the kernel address of a system call given its number. System call numbers are available as a separate autogenerated table at linux.syscall.numbers. This is particularly useful for kernel probing (see probe) or other low-level kernel interactions.

On architectures with syscall wrappers, arm64 and x86_64 among them, an entry is the wrapper, __arm64_sys_<name> or __x64_sys_<name>, whose only argument is a struct pt_regs *: a probe on it reads that pointer as argument(0), not the system call’s arguments.

The module does not load (ENXIO) where sys_call_table cannot be looked up.

syscall

address (syscall_number) Retrieves the kernel address of a system call.

syscall in detail

address (syscall_number)
Retrieves the kernel address of a system call.

Parameters

  • syscall_number integer system call number (e.g., __NR_openat).

Returns

    lightuserdata the sys_call_table entry for the number, never nil: every number the kernel leaves unassigned holds the wrapper of sys_ni_syscall, so they share one address.

Raises

Error if syscall_number is out of bounds.

Usage

local syscall = require("syscall")
local numbers = require("linux.syscall").numbers
local openat_addr = syscall.address(numbers.openat)