#ifndef __FS_H #define __FS_H #include "headervmlinux.h" /*#include #include #include #include #include #include */ #include #include #include #include "../../../common/constants.h" #include "../../../common/map_common.h" #include "../data/ring_buffer.h" #include "map_defs.h" #include "../utils/strings.h" static __always_inline int handle_sys_read(struct pt_regs *ctx, int fd, char* buf){ __u64 pid_tgid = bpf_get_current_pid_tgid(); __u32 pid = pid_tgid >> 32; struct fs_open_data data = { .buf = buf, .fd = fd, .pid = pid }; bpf_map_update_elem(&fs_open, &pid_tgid, &data, BPF_ANY); //bpf_printk("PID: %u, FS:%u\n", pid, fd); return 0; } /** * @brief Receives read event and stores the parameters into internal map * */ SEC("kprobe/ksys_read") int kprobe_ksys_read(struct pt_regs *ctx) { struct pt_regs *rctx = ctx; if (!rctx) return 0; int fd = (int) PT_REGS_PARM1(ctx); char *buf = (char *) PT_REGS_PARM2(ctx); return handle_sys_read(ctx, fd, buf); } /** * @brief Called AFTER the ksys_read call, checks the internal * map for the tgid+pid used and extracts the parameters. * Uses the user-space buffer reference for overwritting the returned * values. * */ SEC("kretprobe/vfs_read") int kretprobe_vfs_read(struct pt_regs *ctx){ __u64 pid_tgid = bpf_get_current_pid_tgid(); struct fs_open_data *data = (struct fs_open_data*) bpf_map_lookup_elem(&fs_open, &pid_tgid); if (data!=NULL){ //Not found return -1; } //Overwritting a byte of the buffer char *buf = data->buf; char *msg = "OOOOOOOOOOOOO"; bpf_printk("Overwritting at pid %u\n", data->pid); //int err = bpf_probe_write_user((void*)buf, (void*)msg, (__u32)1); return 0; } #endif