# lookup_dcookie _____________________________________________ # COMPAT_SYSCALL_DEFINE4(lookup_dcookie, u32, w0, u32, w1, char __user *, # buf, compat_size_t, len) # long sys32_lookup_dcookie(u32 addr_low, u32 addr_high, char __user *buf, # size_t len) # @define _SYSCALL_COMPAT_LOOKUP_DCOOKIE_NAME %( name = "lookup_dcookie" %) @define _SYSCALL_COMPAT_LOOKUP_DCOOKIE_ARGSTR %( argstr = sprintf("%#lx, %p, %#x", cookie, buffer_uaddr, len) %) @define _SYSCALL_COMPAT_LOOKUP_DCOOKIE_REGARGS %( cookie = ((uint_arg(2) << 32) | uint_arg(1)) buffer_uaddr = pointer_arg(3) len = ulong_arg(4) %) probe syscall.compat_lookup_dcookie = dw_syscall.compat_lookup_dcookie !, nd_syscall.compat_lookup_dcookie ? {} probe syscall.compat_lookup_dcookie.return = dw_syscall.compat_lookup_dcookie.return !, nd_syscall.compat_lookup_dcookie.return ? {} # dw_compat_lookup_dcookie _____________________________________________________ probe dw_syscall.compat_lookup_dcookie = kernel.function("compat_sys_lookup_dcookie") ?, kernel.function("sys32_lookup_dcookie") ? { @_SYSCALL_COMPAT_LOOKUP_DCOOKIE_NAME cookie = (@choose_defined($w1, $addr_high) << 32 | @choose_defined($w0, $addr_low)) buffer_uaddr = $buf len = __ulong($len) @_SYSCALL_COMPAT_LOOKUP_DCOOKIE_ARGSTR } probe dw_syscall.compat_lookup_dcookie.return = kernel.function("compat_sys_lookup_dcookie").return ?, kernel.function("sys32_lookup_dcookie").return ? { @_SYSCALL_COMPAT_LOOKUP_DCOOKIE_NAME @SYSC_RETVALSTR($return) } # nd_compat_lookup_dcookie _____________________________________________________ probe nd_syscall.compat_lookup_dcookie = nd1_syscall.compat_lookup_dcookie!, nd2_syscall.compat_lookup_dcookie!, tp_syscall.compat_lookup_dcookie { } probe nd1_syscall.compat_lookup_dcookie = kprobe.function("compat_sys_lookup_dcookie") ?, kprobe.function("sys32_lookup_dcookie") ? { @_SYSCALL_COMPAT_LOOKUP_DCOOKIE_NAME asmlinkage() @_SYSCALL_COMPAT_LOOKUP_DCOOKIE_REGARGS @_SYSCALL_COMPAT_LOOKUP_DCOOKIE_ARGSTR } /* kernel 4.17+ */ probe nd2_syscall.compat_lookup_dcookie = kprobe.function(@arch_syscall_prefix "compat_sys_lookup_dcookie") ? { __set_syscall_pt_regs(pointer_arg(1)) @_SYSCALL_COMPAT_LOOKUP_DCOOKIE_NAME @_SYSCALL_COMPAT_LOOKUP_DCOOKIE_REGARGS @_SYSCALL_COMPAT_LOOKUP_DCOOKIE_ARGSTR } /* kernel 3.5+, but undesirable because it affects all syscalls */ probe tp_syscall.compat_lookup_dcookie = kernel.trace("sys_enter") { __set_syscall_pt_regs($regs) @__compat_syscall_gate(@const("__NR_ia32_lookup_dcookie")) @_SYSCALL_COMPAT_LOOKUP_DCOOKIE_NAME @_SYSCALL_COMPAT_LOOKUP_DCOOKIE_REGARGS @_SYSCALL_COMPAT_LOOKUP_DCOOKIE_ARGSTR } probe nd_syscall.compat_lookup_dcookie.return = nd1_syscall.compat_lookup_dcookie.return!, nd2_syscall.compat_lookup_dcookie.return!, tp_syscall.compat_lookup_dcookie.return { } probe nd1_syscall.compat_lookup_dcookie.return = kprobe.function("compat_sys_lookup_dcookie").return ?, kprobe.function("sys32_lookup_dcookie").return ? { @_SYSCALL_COMPAT_LOOKUP_DCOOKIE_NAME @SYSC_RETVALSTR(returnval()) } /* kernel 4.17+ */ probe nd2_syscall.compat_lookup_dcookie.return = kprobe.function(@arch_syscall_prefix "compat_sys_lookup_dcookie").return ? { @_SYSCALL_COMPAT_LOOKUP_DCOOKIE_NAME @SYSC_RETVALSTR(returnval()) } /* kernel 3.5+, but undesirable because it affects all syscalls */ probe tp_syscall.compat_lookup_dcookie.return = kernel.trace("sys_exit") { __set_syscall_pt_regs($regs) @__compat_syscall_gate(@const("__NR_ia32_lookup_dcookie")) @_SYSCALL_COMPAT_LOOKUP_DCOOKIE_NAME @SYSC_RETVALSTR($ret) }