int open(const char *path, int flags, ...) { va_list ap; int fd; int mode; typeof(open) *original_open = dlsym(RTLD_NEXT, "open"); va_start(ap, flags); mode = va_arg(ap, int); va_end(ap); debug(D_DEBUG, "open from %d.\n", getpid()); fd = original_open(path, flags, mode); if(fd > -1) { struct monitor_msg msg; msg.type = OPEN; msg.origin = getpid(); strcpy(msg.data.s, path); send_monitor_msg(&msg); } return fd; }
//asmlinkage int (*original_open) (const char *, int, int); // open (0x5) asmlinkage int monitor_open(const char *filename, int flags, int mode) { if (PID == current->pid) //pause core and perform analysis printk(KERN_INFO "HEY, this opened\n"); return original_open(filename, flags, mode); }