pb.stoleyour.com

Untitled

By Crimson Lechwe, 6 Months ago, written in Plain Text, viewed 63 times.
URL http://pb.stoleyour.com/view/b9d94b40 Embed
Download Paste or View Raw — Expand paste to full width of browser
  1. #include <linux/module.h>
  2. #include <linux/kernel.h>
  3. #include <linux/kprobes.h>
  4.  
  5. MODULE_LICENSE("GPL");
  6.  
  7. static int ret_handler(struct kretprobe_instance *ri, struct pt_regs *regs) {
  8.     long retval = regs->ax;  // On 32-bit, 'ax' is correct
  9.     printk(KERN_INFO "getdents64 returned: %ld", retval);
  10.  
  11.     // You can extend logic here—filter, redirect, whatever
  12.     return 0;
  13. }
  14.  
  15. static struct kretprobe rp = {
  16.     .kp.symbol_name = "sys_getdents64",  // or SyS_getdents64 if preferred
  17.     .handler = ret_handler,
  18.     .maxactive = 20,
  19. };
  20.  
  21. static int __init kret_init(void) {
  22.     int ret = register_kretprobe(&rp);
  23.     if (ret < 0) {
  24.         printk(KERN_ERR "Failed to register kretprobe: %d\n", ret);
  25.         return ret;
  26.     }
  27.     printk(KERN_INFO "kretprobe registered for sys_getdents64\n");
  28.     return 0;
  29. }
  30.  
  31. static void __exit kret_exit(void) {
  32.     unregister_kretprobe(&rp);
  33.     printk(KERN_INFO "kretprobe unregistered\n");
  34. }
  35.  
  36. module_init(kret_init);
  37. module_exit(kret_exit);
  38.  

Reply to "Untitled"

Here you can reply to the paste above

Powered By Stikked