Skip to content

Commit

Permalink
kernel: hook syscall instead of unstable symbol
Browse files Browse the repository at this point in the history
  • Loading branch information
@tiann
tiann committed Mar 20, 2024
1 parent 8f33926 commit 2a64784
Show file tree
Hide file tree
Showing 2 changed files with 40 additions and 2 deletions.
4 changes: 4 additions & 0 deletions kernel/arch.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -20,8 +20,10 @@

#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 16, 0)
#define PRCTL_SYMBOL "__arm64_sys_prctl"
#define SYS_READ_SYMBOL "__arm64_sys_read"
#else
#define PRCTL_SYMBOL "sys_prctl"
#define SYS_READ_SYMBOL "sys_read"
#endif

#elif defined(__x86_64__)
Expand All @@ -41,8 +43,10 @@
#define __PT_IP_REG ip
#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 16, 0)
#define PRCTL_SYMBOL "__x64_sys_prctl"
#define SYS_READ_SYMBOL "__x64_sys_read"
#else
#define PRCTL_SYMBOL "sys_prctl"
#define SYS_READ_SYMBOL "sys_read"
#endif

#else
Expand Down
38 changes: 36 additions & 2 deletions kernel/ksud.c
View file
Original file line number Diff line number Diff line change
@@ -1,7 +1,10 @@
#include "asm/current.h"
#include "linux/compat.h"
#include "linux/compiler_attributes.h"

This comment has been minimized.

Sign in to view

Copy link
@ravindu644

ravindu644 Mar 20, 2024

drivers/kernelsu/ksud.c:3:10: fatal error: 'linux/compiler_attributes.h' file not found
#include "linux/compiler_attributes.h"
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 error generated.
make[2]: *** [scripts/Makefile.build:356: drivers/kernelsu/ksud.o] Error 1
make[1]: *** [scripts/Makefile.build:671: drivers/kernelsu] Error 2
make[1]: *** Waiting for unfinished jobs....
make: *** [Makefile:1173: drivers] Error 2

This comment has been minimized.

Sign in to view

Copy link
@ravindu644

ravindu644 Mar 20, 2024 •
edited
Loading

what should I do :(

ref : https://github.com/ravindu644/android_kernel_lpos_sm_n970/actions/runs/8354728443/job/22868536096#step:6:101

This comment has been minimized.

Sign in to view

Copy link
@tiann

tiann Mar 20, 2024

Author Owner

try remove it directly

This comment has been minimized.

Sign in to view

Copy link
@ravindu644

ravindu644 Mar 20, 2024

try remove it directly

thanks, it worked.
#include "linux/cred.h"
#include "linux/dcache.h"
#include "linux/err.h"
#include "linux/file.h"
#include "linux/fs.h"
#include "linux/version.h"
#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 4, 0)
Expand Down Expand Up @@ -384,6 +387,15 @@ int ksu_handle_vfs_read(struct file **file_ptr, char __user **buf_ptr,
return 0;
}

int ksu_handle_sys_read(unsigned int fd, char __user **buf_ptr, size_t *count_ptr)
{
struct file *file = fget_raw(fd);
if (!file) {
return 0;
}
return ksu_handle_vfs_read(&file, buf_ptr, count_ptr, NULL);
}

static unsigned int volumedown_pressed_count = 0;

static bool is_volumedown_enough(unsigned int count)
Expand Down Expand Up @@ -459,7 +471,8 @@ static int execve_handler_pre(struct kprobe *p, struct pt_regs *regs)
return ksu_handle_execveat_ksud(fd, filename_ptr, &argv, NULL, NULL);
}

static int read_handler_pre(struct kprobe *p, struct pt_regs *regs)
// remove this later!
__maybe_unused static int vfs_read_handler_pre(struct kprobe *p, struct pt_regs *regs)
{
struct file **file_ptr = (struct file **)&PT_REGS_PARM1(regs);
char __user **buf_ptr = (char **)&PT_REGS_PARM2(regs);
Expand All @@ -469,6 +482,20 @@ static int read_handler_pre(struct kprobe *p, struct pt_regs *regs)
return ksu_handle_vfs_read(file_ptr, buf_ptr, count_ptr, pos_ptr);
}

static int sys_read_handler_pre(struct kprobe *p, struct pt_regs *regs)
{
#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 16, 0)
struct pt_regs *real_regs = (struct pt_regs *)PT_REGS_PARM1(regs);
#else
struct pt_regs *real_regs = regs;
#endif
unsigned int fd = PT_REGS_PARM1(real_regs);
char __user **buf_ptr = (char __user **)&PT_REGS_PARM2(real_regs);
size_t count_ptr = (size_t *) &PT_REGS_PARM3(real_regs);

return ksu_handle_sys_read(fd, buf_ptr, count_ptr);
}

static int input_handle_event_handler_pre(struct kprobe *p,
struct pt_regs *regs)
{
Expand All @@ -489,10 +516,17 @@ static struct kprobe execve_kp = {
.pre_handler = execve_handler_pre,
};

#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 10, 0)
static struct kprobe vfs_read_kp = {
.symbol_name = SYS_READ_SYMBOL,
.pre_handler = sys_read_handler_pre,
};
#else
static struct kprobe vfs_read_kp = {
.symbol_name = "vfs_read",
.pre_handler = read_handler_pre,
.pre_handler = vfs_read_handler_pre,
};
#endif

static struct kprobe input_handle_event_kp = {
.symbol_name = "input_handle_event",
Expand Down

0 comments on commit 2a64784

Please sign in to comment.