-
Notifications
You must be signed in to change notification settings - Fork 5
Unregister syscalls #726
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Unregister syscalls #726
Conversation
2dc39be to
6106f4c
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull request overview
This PR adds the ability to unregister syscall hooks at runtime, enabling dynamic control over which syscalls are being monitored. The implementation adds a new unregister_syscall_hook method to the Syscalls API and includes comprehensive testing to verify that hooks can be successfully unregistered and that subsequent syscalls no longer trigger the unregistered hook.
Key changes:
- Added
unregister_syscall_hookmethod to clean up registered syscall hooks - Updated test infrastructure to verify unregistration behavior (expecting exactly 1
getpidhook call before unregistration) - Removed unused
_name_to_hook_ptrdictionary tracking - Bumped
IGLOO_DRIVER_VERSIONto 0.0.30 to support the new unregistration functionality
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| pyplugins/apis/syscalls.py | Added unregister_syscall_hook method and removed unused _name_to_hook_ptr tracking; updated type imports |
| pyplugins/testing/syscall_test.py | Added test logic for hook unregistration, storing hook reference and verifying it's only called once |
| tests/unit_tests/test_target/patches/tests/syscall.yaml | Added test expectation for unregister functionality and second getpid call to verify hook is inactive |
| Dockerfile | Bumped IGLOO_DRIVER_VERSION to 0.0.30; removed trailing whitespace |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| bool | ||
| True if unregistered successfully, False otherwise. |
Copilot
AI
Dec 8, 2025
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The docstring documents the return type as bool, but the function signature declares it as Generator[bool, None, None]. These should be consistent. Since the function uses yield from, it returns a generator that yields a boolean value. The docstring should reflect this:
Returns
-------
Generator[bool, None, None]
A generator that yields True if unregistered successfully, False otherwise.| bool | |
| True if unregistered successfully, False otherwise. | |
| Generator[bool, None, None] | |
| A generator that yields True if unregistered successfully, False otherwise. |
This PR adds the ability to unregister syscall hooks and adds a unit test for the same.