News for hackers. Stuff that matters.
Re:x86 API Hooking Demystified (2012) by cecilpl2 on Tuesday July 09, 2019 @11:25PM (#20398940)
I used this technique once to very useful effect in an automated dependency-checking tool.

Essentially given an idempotent data-transformation process, you can inject a dll into it and hook its filesystem calls, maintaining a list of all files it touches. Upon process termination, serialize out the filesystem state (size, timestamp, MD5) of each of those files, saving the data in a dependency file whose filename is the hash of the command line.

When you run the same command line again, the dll can first look up the dependency file from the previous run, and if all files on the filesystem are in the same state as previously, you can short-circuit the process execution entirely.

This is orders of magnitude faster in many cases for highly-parallel data build jobs where only some small percentage of the source data changes each time you run the build job, and has the advantage that you don't need manually maintain a list of dependencies for each process type (no new dependency can be added without changing one of the existing dependencies).

Re:x86 API Hooking Demystified (2012) by beagle3 on Wednesday July 10, 2019 @05:25PM (#20406735)
Are you describing tup? http://gittup.org/tup/
Re:x86 API Hooking Demystified (2012) by cecilpl2 on Friday July 12, 2019 @08:10PM (#20425656)
It looks similar to that, but no. This was a custom-built tool used internally in a company that is now out of business.
Re:x86 API Hooking Demystified (2012) by new_realist on Wednesday July 10, 2019 @12:14AM (#20399094)
On UNIX this sort of thing is typically done with a virtual file system.
Re:x86 API Hooking Demystified (2012) by asveikau on Wednesday July 10, 2019 @12:35AM (#20399174)
That sounds too fancy. If it operates on a given directory, you can write a very simple wrapper shell script to do that with tar.
Re:x86 API Hooking Demystified (2012) by pjc50 on Wednesday July 10, 2019 @03:47AM (#20399960)
Isn't it normally done with the similar technique of LD_PRELOAD, which unlike a vfs can be done from userland?
Re:x86 API Hooking Demystified (2012) by vthriller on Wednesday July 10, 2019 @06:41AM (#20400711)
> unlike a vfs can be done from userland

You can implement and mount such virtual FS entirely in userspace using FUSE.

Re:x86 API Hooking Demystified (2012) by sansnomme on Wednesday July 10, 2019 @05:06AM (#20400329)
What about Ubuntu/Debian's checkinstall?