PLDI 2025
Mon 16 - Fri 20 June 2025 Seoul, South Korea

System call interception is essential for tools that modify or monitor application behavior. However, current system call interception solutions on ARM platforms still face challenges related to performance and completeness. This paper introduces ASC-Hook, an efficient and comprehensive binary rewriting framework specifically designed for intercepting system calls on ARM architectures. ASC-Hook tackles two critical challenges: the misalignment of the target address caused by directly replacing the SVC instruction with BR x8, and the return to the original control flow after system call interception. To achieve this, we propose a hybrid replacement strategy combined with a customized trampoline mechanism. Additionally, multiple completeness strategies tailored for system call interception are implemented to guarantee thorough coverage. Experimental evaluations demonstrate that ASC-Hook reduces overhead to as low as 1/29 of existing solutions, while incurring an average performance loss of only 3.8% in system call-intensive applications.