Distributed computing using syscall proxying

• US 7,277,937 B2
• Filed: 07/16/2003
• Issued: 10/02/2007
• Est. Priority Date: 07/17/2002
• Status: Active Grant

• Current Assignee: Ecrime Management Strategies, Inc.
• Original Assignee: Core SDI, Inc.
• Inventors: Richarte, Gerardo Gabriel, Quesada, Ricardo, Friedman, Agustin Azubel, Ajzenman, Gustavo, Burroni, Javier, Notarfrancesco, Luciano, Becedillas Ruiz, Gabriel Martin, Caceres, Maximiliano Gabriel, Leidl, Bruce Robert
• Primary Examiner(s): Cardone; Jason
• Assistant Examiner(s): Mirza; Adnan M.
• Application Number:
  US10/621,840
• Publication Number:
  US 20040128667A1
• Time in Patent Office: 1,539 Days
• Field of Search: 709/223, 709/225, 709/227
• US Class Current: 709/223
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 9/547 Remote procedure calls [RPC]; Web services
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A system is provided for executing a system call originating in a local computer on a first remote computer connected to the local computer via a network. Communication is established between the local computer and the first remote computer via the network. A syscall server is installed in the first remote computer. A reference address is sent from the first remote computer to the local computer via the network through execution of code by the syscall server. A syscall request is built in the local computer with arguments determined using the reference address received from the first remote computer. The syscall request is sent from the local computer to the first remote computer via the network. The syscall request is copied into a stack of the first remote computer through execution of code by the syscall server. Registers are popped from the syscall request in the stack. Execution of a syscall request is initiated on the first remote computer. The result of the syscall request is pushed onto the stack. At least a portion of the result of the syscall request is sent to the local computer via the network through execution of code by the syscall server.

Claims

1. A method for executing a system call originating in a local computer on a first remote computer connected to the local computer via a network, the method comprising:

establishing communication between the local computer and the first remote computer via the network;

installing a syscall server in the first remote computer;

sending a reference address from the first remote computer to the local computer via the network through execution of code by the syscall server;

building a syscall request in the local computer with arguments determined using the reference address received from the first remote computer;

sending the syscall request from the local computer to the first remote computer via the network;

copying the syscall request into a stack of the first remote computer through execution of code by the syscall server;

popping registers from the syscall request in the stack through execution of code by the syscall server;

initiating execution of a syscall request on the first remote computer through execution of code by the syscall server;

pushing a result of the syscall request onto the stack through execution of code by the syscall server; and

sending at least a portion of the result of the syscall request to the local computer via the network through execution of code by the syscall server.

2. The method of claim 1, wherein the building of a syscall request in the local computer comprises:

creating a memory block in the local computer;

storing syscall arguments in the memory block;

adjusting the arguments using the reference address received from the first remote computer to account for memory address differences between the first remote computer and the local computer.

3. The method of claim 2, further comprising executing a series of syscalls to access a second remote computer connected to the first remote computer.

4. The method of claim 1, further comprising:

sending address information for a load library function from the first remote computer to the local computer via the network through execution of code by the syscall server;

sending address information for a get procedure address function from the first remote computer to the local computer via the network through execution of code by the syscall server.

5. The method of claim 4, further comprising:

executing the get procedure address function on the first remote computer through execution of code by the syscall server to obtain an address for a function to be executed;

incorporating the address of the function to be executed in the syscall request; and

popping the address of the function to be executed from the stack prior to initiating execution of a syscall request on the first remote computer.

6. The method of claim 5, further comprising executing the load library function on the first remote computer through execution of code by the syscall server to load the function to be executed.

7. A system for executing a system call originating in a local computer on a first remote computer connected to the local computer via a network, the system comprising:

a communications module configured to provide communication between the local computer and the first remote computer via the network;

means for building a syscall request in the local computer with arguments determined using a reference address received from the first remote computer;

means for sending the syscall request from the local computer to the first remote computer via the network; and

a syscall server configured to be installed in the first remote computer, the syscall server comprising;

means for sending the reference address from the first remote computer to the local computer via the network;

means for copying the syscall request into a stack of the first remote computer;

means for popping registers from the syscall request in the stack;

means for initiating execution of a syscall request on the first remote computer;

means for pushing a result of the syscall request onto the stack; and

means for sending at least a portion of the result of the syscall request to the local computer via the network.

8. Computer code stored on a computer readable medium, for executing a computer program for executing a system call originating in a local computer on a first remote computer connected to the local computer via a network, the computer code comprising:

code for establishing communication between the local computer and the first remote computer via the network;

code for installing a syscall server in the first remote computer;

code for sending a reference address from the first remote computer to the local computer via the network through execution of code by the syscall server;

code for building a syscall request in the local computer with arguments determined using the reference address received from the first remote computer;

code for sending the syscall request from the local computer to the first remote computer via the network;

code for copying the syscall request into a stack of the first remote computer through execution of code by the syscall server;

code for popping registers from the syscall request in the stack through execution of code by the syscall server;

code for initiating execution of a syscall request on the first remote computer through execution of code by the syscall server;

code for pushing a result of the syscall request onto the stack through execution of code by the syscall server; and

code for sending at least a portion of the result of the syscall request to the local computer via the network through execution of code by the syscall server.

9. The computer code of claim 8, wherein the code for building a syscall request in the local computer comprises:

code for creating a memory block in the local computer;

code for storing syscall arguments in the memory block;

code for adjusting the arguments using the reference address received from the first remote computer to account for memory address differences between the first remote computer and the local computer.

10. The computer code of claim 9, further comprising code for executing a series of syscalls to access a second remote computer connected to the first remote computer.

11. The computer code of claim 8, further comprising:

code for sending address information for a load library function from the first remote computer to the local computer via the network through execution of code by the syscall server;

code for sending address information for a get procedure address function from the first remote computer to the local computer via the network through execution of code by the syscall server.

12. The computer code of claim 11, further comprising:

code for executing the get procedure address function on the first remote computer through execution of code by the syscall server to obtain an address for a function to be executed;

code for incorporating the address of the function to be executed in the syscall request; and

code for popping the address of the function to be executed from the stack prior to initiating execution of a syscall request on the first remote computer.

13. The computer code of claim 12, further comprising code for executing the load library function on the first remote computer through execution of code by the syscall server to load the function to be executed.