관리-도구

편집 파일: sysc_prctl.stp

# prctl ______________________________________________________
#
# asmlinkage long
# sys_prctl(int option,
#	     unsigned long arg2,
#	     unsigned long arg3,
#	     unsigned long arg4,
#	     unsigned long arg5)
#

@define _SYSCALL_PRCTL_NAME
%(
	name = "prctl"
%)

@define _SYSCALL_PRCTL_ARGSTR
%(
	argstr = _prctl_argstr(option, arg2, arg3, arg4, arg5)
%)

@define _SYSCALL_PRCTL_REGARGS
%(
	option = int_arg(1)
	arg2 = ulong_arg(2)
	arg3 = ulong_arg(3)
	arg4 = ulong_arg(4)
	arg5 = ulong_arg(5)
%)

probe syscall.prctl = dw_syscall.prctl !, nd_syscall.prctl ? {}
probe syscall.prctl.return = dw_syscall.prctl.return !, nd_syscall.prctl.return ? {}

# dw_prctl _____________________________________________________

probe dw_syscall.prctl = kernel.function("sys_prctl").call
{
	@_SYSCALL_PRCTL_NAME
	option = __int32($option)
	arg2 = $arg2
	arg3 = $arg3
	arg4 = $arg4
	arg5 = $arg5
	@_SYSCALL_PRCTL_ARGSTR
}
probe dw_syscall.prctl.return = kernel.function("sys_prctl").return
{
	@_SYSCALL_PRCTL_NAME
	@SYSC_RETVALSTR($return)
}

# nd_prctl _____________________________________________________

probe nd_syscall.prctl = nd1_syscall.prctl!, nd2_syscall.prctl!, tp_syscall.prctl
  { }

probe nd1_syscall.prctl = kprobe.function("sys_prctl") ?
{
	@_SYSCALL_PRCTL_NAME
	asmlinkage()
	@_SYSCALL_PRCTL_REGARGS
	@_SYSCALL_PRCTL_ARGSTR
}

/* kernel 4.17+ */
probe nd2_syscall.prctl = kprobe.function(@arch_syscall_prefix "sys_prctl") ?
{
	__set_syscall_pt_regs(pointer_arg(1))
	@_SYSCALL_PRCTL_NAME
	@_SYSCALL_PRCTL_REGARGS
	@_SYSCALL_PRCTL_ARGSTR
}

/* kernel 3.5+, but undesirable because it affects all syscalls */
probe tp_syscall.prctl = kernel.trace("sys_enter")
{
	__set_syscall_pt_regs($regs)
	@__syscall_compat_gate(@const("__NR_prctl"), @const("__NR_compat_prctl"))
	@_SYSCALL_PRCTL_NAME
	@_SYSCALL_PRCTL_REGARGS
	@_SYSCALL_PRCTL_ARGSTR
}

probe nd_syscall.prctl.return = nd1_syscall.prctl.return!, nd2_syscall.prctl.return!, tp_syscall.prctl.return
  { }
  
probe nd1_syscall.prctl.return = kprobe.function("sys_prctl").return ?
{
	@_SYSCALL_PRCTL_NAME
	@SYSC_RETVALSTR(returnval())
}

/* kernel 4.17+ */
probe nd2_syscall.prctl.return = kprobe.function(@arch_syscall_prefix "sys_prctl").return ?
{
	@_SYSCALL_PRCTL_NAME
	@SYSC_RETVALSTR(returnval())
}
 
/* kernel 3.5+, but undesirable because it affects all syscalls */
probe tp_syscall.prctl.return = kernel.trace("sys_exit")
{
	__set_syscall_pt_regs($regs)
	@__syscall_compat_gate(@const("__NR_prctl"), @const("__NR_compat_prctl"))
	@_SYSCALL_PRCTL_NAME
	@SYSC_RETVALSTR($ret)
}