admin/TripleCross
1
0
Fork 0
mirror of https://github.com/h3xduck/TripleCross.git synced 2025-12-23 18:03:09 +08:00
Code Issues Packages Projects Releases Wiki Activity

[BUILD FAILING] Checkpoint for backup, added new hook for file system, tweaked makefile for real kernel header files inclusion, still not working. Commiting for periodic backup

Browse Source
This commit is contained in:
h3xduck
2022-01-05 20:34:53 -05:00
parent f8774ac9cf
commit 4882ce790c
10 changed files with 37 additions and 1145 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/ebpf/include/bpf/bpf_defs.h
View File

@@ -1,9 +1,9 @@
#ifndef __BPF_DEFS_H
#define __BPF_DEFS_H
#define PT_REGS_PARM1(x) ((x)->rdi)
/*#define PT_REGS_PARM1(x) ((x)->rdi)
#define PT_REGS_PARM2(x) ((x)->rsi)
#define PT_REGS_PARM3(x) ((x)->rdx)
#define PT_REGS_PARM4(x) ((x)->rcx)
#define PT_REGS_PARM4(x) ((x)->rcx)*/
#endif

28
src/ebpf/include/bpf/fs.h
View File

@@ -1,13 +1,14 @@
#ifndef __FS_H
#define __FS_H
//#include "vmlinux.h"
#include <stdio.h>
#include <linux/types.h>
#include <unistd.h>
#include <string.h>
#include <linux/ptrace.h>
#include <linux/stat.h>
#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>
#include <bpf/bpf_core_read.h>
@@ -17,27 +18,14 @@
#include "../data/ring_buffer.h"
#include "bpf_defs.h"
static __always_inline int kprobe__sys_read(struct pt_regs *ctx ,int fd ,char * buf){
bpf_printk("Read a file");
return 0;
}
#define FS_MAX_SEGMENT_LENGTH 32
SEC("kprobe/compat_sys_read")
int __attribute__((always_inline)) kprobe__64_compat_sys_read(struct pt_regs *ctx) {
struct pt_regs *rctx = ctx; if (!rctx) return 0;
int fd = (int) PT_REGS_PARM1(ctx);
char * buf = (char *) PT_REGS_PARM2(ctx);
return kprobe__sys_read(ctx ,fd ,buf);
}
SEC("kprobe/sys_read")
int kprobe__64_sys_read(struct pt_regs *ctx) {
struct pt_regs *rctx = ctx;
if (!rctx) return 0;
int fd = (int) PT_REGS_PARM1(ctx);
char * buf = (char *) PT_REGS_PARM2(ctx);
return kprobe__sys_read(ctx ,fd ,buf);
}
SEC("kprobe/vfs_open")
int kprobe__64_sys_read(struct pt_regs *ctx){
//struct path *path = (struct path *)PT_REGS_PARM1(ctx);
return 0;//fa_access_path(path);
}
#endif