예제 #1
0
struct syscall_exec_desc * find_syscall(char *name, struct parasite_ctl *ctl)
{
	if (compel_mode_native(ctl))
		return find_syscall_table(name, sc_exec_table_64);
	else
		return find_syscall_table(name, sc_exec_table_32);
}
int efab_linux_trampoline_debug (ci_uintptr_t *param)
{
  unsigned long op = *param;
  void *p;

  TRAMP_DEBUG("Trampoline debug op=%lx", op);
  (void)op;

  *param = (unsigned long)find_syscall_table(&p);

  return 0;
}
예제 #3
0
struct syscall_exec_desc *
find_syscall(char *name, __always_unused struct parasite_ctl *ctl)
{
	return find_syscall_table(name, sc_exec_table_64);
}
예제 #4
0
파일: kp.c 프로젝트: apcwowo/kprobe-sys
static int hook_sys_call()
{
        long offset;
        unsigned long inst;
        unsigned long flags;
        
        syscall_table_addr = find_syscall_table();
        if (!syscall_table_addr) {
                printk("can not find sys_call_table address!!\n");
                return 1;
        }

        printk("find sys_call_table address: %p\n", syscall_table_addr);
        rel_sys_open = syscall_table_addr[__NR_open];
        printk("rel_sys_open address = 0x%08x\n", rel_sys_open);
        rel_sys_close = syscall_table_addr[__NR_close];
        printk("rel_sys_close address = 0x%08x\n", rel_sys_close);
        execve_wrapper = syscall_table_addr[__NR_execve];
        printk("execve_wrapper address = 0x%08x\n", execve_wrapper);
        rel_sys_creat = syscall_table_addr[__NR_creat];
        printk("rel_sys_creat address = 0x%08x\n", rel_sys_creat);

        if (mem_text_wp) {

                MEM_TXT_BEGIN(&syscall_table_addr[__NR_open], flags);
                syscall_table_addr[__NR_open] = hook_sys_open;
                MEM_TXT_END(flags);
                printk("hook_sys_open addr: %p\n", hook_sys_open);
                
                MEM_TXT_BEGIN(&syscall_table_addr[__NR_close], flags);
                syscall_table_addr[__NR_close] = hook_sys_close;
                MEM_TXT_END(flags);
                printk("hook_sys_close addr: %p\n", hook_sys_close);

                /* find sys_execve address */
                b_addr = (unsigned long *)((unsigned char *)execve_wrapper + 4);
                orig_inst = *b_addr;
                offset = orig_inst & BOFF_MASK;
                printk("offset = 0x%08x\n", offset);
                rel_sys_execve = execve_wrapper + 0xc + (offset << 2);
                printk("rel_sys_execve address = 0x%08x\n", rel_sys_execve);
        

                /* hook sys_execve by modify offset*/
                offset = (unsigned long)hook_sys_execve - execve_wrapper - 0xc;
                offset >>= 2;
                printk("new offset(10) = %ld, HEX: 0x%08x\n", offset, offset);
                printk("hook_sys_execve addr: %p\n", hook_sys_execve);
                inst = (orig_inst & ~BOFF_MASK) | (offset & BOFF_MASK);
                printk("new inst = 0x%08x\n", inst);

                MEM_TXT_BEGIN(b_addr, flags);
                *b_addr = inst;
                MEM_TXT_END(flags);
                printk("hook sys_execve success!\n");
                
                MEM_TXT_BEGIN(&syscall_table_addr[__NR_creat], flags);
                syscall_table_addr[__NR_creat] = hook_sys_creat;
                MEM_TXT_END(flags);
                printk("hook_sys_creat addr: %p\n", hook_sys_creat);
        }
        else {