admin/TripleCross
1
0
Fork 0
mirror of https://github.com/h3xduck/TripleCross.git synced 2025-12-24 18:33:08 +08:00
Code Issues Packages Projects Releases Wiki Activity

Modularized the ebpf program loading and attaching.

Browse Source
This commit is contained in:
h3xduck
2021-12-30 21:09:26 -05:00
parent 19a11da18f
commit d9a70f866c
12 changed files with 947 additions and 886 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/ebpf/include/bpf/fs.h
View File

@@ -29,14 +29,14 @@
* @ref https://elixir.bootlin.com/linux/latest/source/include/trace/events/sched.h#L397
*/
SEC("tp/sched/sched_process_exec")
int handle_exec(struct trace_event_raw_sched_process_exec *ctx){
int handle_sched_process_exec(struct trace_event_raw_sched_process_exec *ctx){
pid_t pid = bpf_get_current_pid_tgid() >> 32;
char* message = "PROCESS ACTIVATED\0";
char message[] = "PROCESS ACTIVATED";
//Just deactivated for now, but working
/*if(ring_buffer_send(&rb_comm, pid, INFO, 0, message)<0){
if(ring_buffer_send(&rb_comm, pid, INFO, 0, message, sizeof(message))<0){
bpf_printk("ERROR printing in RB_COMM at fs module");
}*/
}
return 0;
}

4
src/ebpf/include/data/ring_buffer.h
View File

@@ -25,7 +25,7 @@ struct ring_buffer rb_comm SEC(".maps");
*
* @return 0 if ok, -1 if error
*/
static __always_inline int ring_buffer_send(struct ring_buffer *rb, int pid, event_type_t event_type, int code, char* message){
static __always_inline int ring_buffer_send(struct ring_buffer *rb, int pid, event_type_t event_type, int code, char* message, __u32 message_len){
struct rb_event *event = (struct rb_event*) bpf_ringbuf_reserve(rb, sizeof(struct rb_event), 0);
if(!event){
return -1;
@@ -34,7 +34,7 @@ static __always_inline int ring_buffer_send(struct ring_buffer *rb, int pid, eve
event->code = code;
event->event_type = event_type;
event->pid = pid;
bpf_probe_read_kernel_str(&event->message, sizeof(message), message);
bpf_probe_read_kernel_str(&event->message, message_len, message);
bpf_ringbuf_submit(event, 0);
return 0;