From: Jeff D. <jd...@ka...> - 2001-10-14 01:29:50
|
ad...@do... said: > I never said scan. When an int 80 occurs, check to see if the source > of the call is an unmodified executable page. If so, then modify it > with a faster call, that doesn't require using PTRACE to intercept int > 80 calls. Oh, OK. Except it won't be any faster. The tracing thread has to be there in order to do the first interception of each system call. Whatever you replace the int 80 with has to generate a signal. Given the current semantics of ptrace, which don't let you ignore anything, that signal will be seen by the tracing thread and passed along by it to the running thread. So, this won't be saving any context switches. To do that, you need to completely eliminate the tracing thread. Jeff |