66 lines
1.7 KiB
C
66 lines
1.7 KiB
C
#include "hook.h"
|
|
#include <linux/sched/signal.h>
|
|
#include <linux/kprobes.h>
|
|
#include <linux/unistd.h>
|
|
#include <linux/fs.h>
|
|
|
|
#define MAX_PATH_LEN 256
|
|
#define MAX_ARGS_LEN 4096
|
|
|
|
static struct kprobe kp = {
|
|
.symbol_name = "do_execveat_common.isra.0",
|
|
};
|
|
|
|
static int handler_pre(struct kprobe *p, struct pt_regs *regs) {
|
|
struct task_struct *task = current;
|
|
struct task_struct *parent = task->parent;
|
|
struct mm_struct *mm = task->mm;
|
|
struct file *file;
|
|
char *pathname;
|
|
char *args_buf;
|
|
|
|
if (mm) {
|
|
file = mm->exe_file;
|
|
if (file) {
|
|
pathname = kmalloc(PATH_MAX, GFP_KERNEL);
|
|
if (pathname) {
|
|
printk(KERN_INFO "Program Path: %s\n",
|
|
d_path(&file->f_path, pathname, PATH_MAX));
|
|
}
|
|
}
|
|
}
|
|
args_buf = kmalloc(MAX_ARGS_LEN, GFP_KERNEL);
|
|
if (args_buf) {
|
|
if (copy_from_user(args_buf, (const void __user *)regs->di,
|
|
MAX_ARGS_LEN) == 0) {
|
|
args_buf[MAX_ARGS_LEN - 1] = '\0';
|
|
}
|
|
// kfree(args_buf);
|
|
}
|
|
printk(KERN_INFO "PID: %d\n", task->pid);
|
|
printk(KERN_INFO "PPID: %d\n", parent->pid);
|
|
printk(KERN_INFO "Program Name: %s\n", task->comm);
|
|
printk(KERN_INFO "Program Args: %s\n", args_buf);
|
|
if (args_buf) {
|
|
kfree(args_buf);
|
|
}
|
|
if (pathname) {
|
|
kfree(pathname);
|
|
}
|
|
return 0;
|
|
}
|
|
bool init_hooks(void) {
|
|
int ret;
|
|
|
|
ret = register_kprobe(&kp);
|
|
if (ret < 0) {
|
|
printk(KERN_ERR "register_kprobe failed, returned %d\n", ret);
|
|
return false;
|
|
}
|
|
kp.pre_handler = handler_pre;
|
|
|
|
printk(KERN_ERR "Planted kprobe at %p\n", kp.addr);
|
|
return true;
|
|
}
|
|
void uninstall_hooks(void) { unregister_kprobe(&kp); }
|