admin/TripleCross
1
0
Fork 0
mirror of https://github.com/h3xduck/TripleCross.git synced 2025-12-22 09:43:07 +08:00
Code Issues Packages Projects Releases Wiki Activity

Modularized the ebpf program loading and attaching.

Browse Source
This commit is contained in:
h3xduck
2021-12-30 21:09:26 -05:00
parent 19a11da18f
commit d9a70f866c
12 changed files with 947 additions and 886 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/ebpf/include/bpf/fs.h
View File

@@ -29,14 +29,14 @@
* @ref https://elixir.bootlin.com/linux/latest/source/include/trace/events/sched.h#L397
*/
SEC("tp/sched/sched_process_exec")
int handle_exec(struct trace_event_raw_sched_process_exec *ctx){
int handle_sched_process_exec(struct trace_event_raw_sched_process_exec *ctx){
pid_t pid = bpf_get_current_pid_tgid() >> 32;
char* message = "PROCESS ACTIVATED\0";
char message[] = "PROCESS ACTIVATED";
//Just deactivated for now, but working
/*if(ring_buffer_send(&rb_comm, pid, INFO, 0, message)<0){
if(ring_buffer_send(&rb_comm, pid, INFO, 0, message, sizeof(message))<0){
bpf_printk("ERROR printing in RB_COMM at fs module");
}*/
}
return 0;
}