linux 内核进程监控针对bash下启动的程序

最新推荐文章于 2022-10-23 12:38:03 发布

Z000000Y

最新推荐文章于 2022-10-23 12:38:03 发布

阅读量388

点赞数

分类专栏： linux

本文链接：https://blog.csdn.net/u012329314/article/details/72575498

版权

linux 专栏收录该内容

14 篇文章 0 订阅

订阅专栏

#include 
   
   
    
        
#include 
    
    
     
         
#include 
     
     
      
          
#include
      
      
       
       
/* For each probe you need to allocate a kprobe structure */    
static struct kprobe kp = {    
    .symbol_name    = "sys_execve",    
};    
    
/* kprobe pre_handler: called just before the probed instruction is executed */    
static int handler_pre(struct kprobe *p, struct pt_regs *regs)    
{    
#ifdef CONFIG_X86    
    
    printk(KERN_INFO "pre_handler: p->addr = 0x%p, ip = %lx,"    
            " flags = 0x%lx,pid=%d,comm=%s,name=%s\n",    
        p->addr, regs->ip, regs->flags,current->pid,current->comm,*((char **)regs->si));    
        char ** argv = (char **) regs->si;
        size_t exec_line_size=0;

        while(NULL!=*argv)
        {
         exec_line_size=exec_line_size+strlen(*argv)+1;
          argv++;
         }
         char *str = vmalloc(exec_line_size);
         if (NULL!=str)
           {
          memset(str,0,exec_line_size);
           
         argv = (char **) regs->si;
         while (NULL != *argv) {
			
			snprintf(str, exec_line_size,
					"%s%s",str, *argv);
			argv++;	
		}
         printk("%s",str);
         vfree(str);
		 }
   
#endif    
#ifdef CONFIG_PPC    
    printk(KERN_INFO "pre_handler: p->addr = 0x%p, nip = 0x%lx,"    
            " msr = 0x%lx\n",    
        p->addr, regs->nip, regs->msr);    
#endif    
#ifdef CONFIG_MIPS    
    printk(KERN_INFO "pre_handler: p->addr = 0x%p, epc = 0x%lx,"    
            " status = 0x%lx\n",    
        p->addr, regs->cp0_epc, regs->cp0_status);    
#endif    
    
    /* A dump_stack() here will give a stack backtrace */    
    return 0;    
}    
    
/* kprobe post_handler: called after the probed instruction is executed */    
static void handler_post(struct kprobe *p, struct pt_regs *regs,    
                unsigned long flags)    
{    
#ifdef CONFIG_X86    
    printk(KERN_INFO "post_handler: p->addr = 0x%p, flags = 0x%lx,pid=%d,comm=%s,name=%s\n",    
        p->addr, regs->flags,current->pid,current->comm,(char *)regs->di);    
#endif    
#ifdef CONFIG_PPC    
    printk(KERN_INFO "post_handler: p->addr = 0x%p, msr = 0x%lx\n",    
        p->addr, regs->msr);    
#endif    
#ifdef CONFIG_MIPS    
    printk(KERN_INFO "post_handler: p->addr = 0x%p, status = 0x%lx\n",    
        p->addr, regs->cp0_status);    
#endif    
}    
    
/*  
 * fault_handler: this is called if an exception is generated for any  
 * instruction within the pre- or post-handler, or when Kprobes  
 * single-steps the probed instruction.  
 */    
static int handler_fault(struct kprobe *p, struct pt_regs *regs, int trapnr)    
{    
    printk(KERN_INFO "fault_handler: p->addr = 0x%p, trap #%dn",    
        p->addr, trapnr);    
    /* Return 0 because we don't handle the fault. */    
    return 0;    
}    
    
static int __init kprobe_init(void)    
{    
    int ret;    
    kp.pre_handler = handler_pre;    
    kp.post_handler = handler_post;    
    kp.fault_handler = handler_fault;    
    
    ret = register_kprobe(&kp);    
    if (ret < 0) {    
        printk(KERN_INFO "register_kprobe failed, returned %d\n", ret);    
        return ret;    
    }    
    printk(KERN_INFO "Planted kprobe at %p\n", kp.addr);    
    return 0;    
}    
    
static void __exit kprobe_exit(void)    
{    
    unregister_kprobe(&kp);    
    printk(KERN_INFO "kprobe at %p unregistered\n", kp.addr);    
}    
    
module_init(kprobe_init)    
module_exit(kprobe_exit)    
MODULE_LICENSE("GPL");