From cf16bbd74ec5d6e1e35993c36d71688ead48b50a Mon Sep 17 00:00:00 2001 From: Akira Moroo Date: Thu, 18 Dec 2025 13:09:49 -0600 Subject: [PATCH 1/2] docs: Add overhead comparison with ASC-Hook Signed-off-by: Akira Moroo --- Documentation/README.md | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/Documentation/README.md b/Documentation/README.md index bea385e..708a519 100644 --- a/Documentation/README.md +++ b/Documentation/README.md @@ -237,7 +237,39 @@ The following table shows the results. svc-hook reduces throughput by 0.9% and 0 Based on the experimental results above, we consider that the system call hooks applied by svc-hook do not significantly negate the performance of hook-applied application programs. +## Overhead Comparision with ASC-Hook + +ASC-Hook[asc-hook] is another binary-rewirting-based system call hook mechanism. It uses a `br x8` primitive for the `svc` instruction replacement. + +### Overhead of Trampoline Execution + +We measure the time to hook the `getpid` system call using ASC-Hook. The experiment setup is exactly same with the experiment mentioned in the section 4.1 in our paper. + +- ASC-Hook: 39 nsec +- svc-hook: 14 nsec +- LD_PRELOAD: 3 nsec + +The time delta with LD_PRELOAD is the pure overhead of going through the trampoline code. +The delta is 36 nsec and 11 nsec for ASC-Hook and svc-hook. As we can see, svc-hook has less overhead compared with ASC-Hook. + +### Performance of Initial Setup + +We also measure the time to finish the execution of the initial setup function which injected by the LD_PRELOAD trick. + +- ASC-Hook: 1890 milisec +- svc-hook: 25 milisec + +The result shows that svc-hook is 75 times faster than ASC-Hook to finish the initial setup. + +We consider that the primary reason of the difference is that ASC-Hook requires disassemble process in nature to find the instructions that assign the system call numbers to the x8 register. On the other hand, svc-hook uses simple binary pattern match to identify target instructions because it only need to find `svc` instructions, + +### Summary + +We consider svc-hook has less overhead compared with ASC-Hook in both trampoline code execution and initial setup. + [sqlite]: https://sqlite.org [postgresql]: https://www.postgresql.org [samba]: https://www.samba.org [sqlite-bench]: https://github.com/ukontainer/sqlite-bench/tree/78e6cdc3d8791c28730f35ba0bd527d34aed2af4 + +[asc-hook]: https://github.com/shinya2001/ASC-Hook From 7a490c89d62e4230271eb13c8c73e697326a8946 Mon Sep 17 00:00:00 2001 From: Akira Moroo Date: Thu, 18 Dec 2025 13:32:46 -0600 Subject: [PATCH 2/2] docs: Add link to our paper Signed-off-by: Akira Moroo --- README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index dc412b1..dfbd9c1 100644 --- a/README.md +++ b/README.md @@ -100,8 +100,9 @@ When the target process executes a system call, it branches to the trampoline, w ## Further Reading -- [My blog post (ja)](https://retrage.github.io/2024/07/31/svc-hook.html/): An initial introduction to svc-hook. +- [svc-hook: hooking system calls on ARM64 by binary rewriting](https://dl.acm.org/doi/10.1145/3721462.3770771): Our paper at ACM/IFIP Middleware 2025. - [Supplemental Documentation](/Documentation/README.md): Supplemental documentation for svc-hook experimental results. +- [My blog post (ja)](https://retrage.github.io/2024/07/31/svc-hook.html/): An initial introduction to svc-hook. ## License