ilammy / ftrace-hook Goto Github PK
View Code? Open in Web Editor NEWUsing ftrace for function hooking in Linux kernel
License: GNU General Public License v2.0
Using ftrace for function hooking in Linux kernel
License: GNU General Public License v2.0
I want to function hooking on arm64 but the code build fail
Hi,
I searched all the demo codes related to ftrace instrumentation, but all of that is compiled as a separate module, then using insmod to load it and rmmod to unload it, it does not satisfied me since I have to find a proper time to load this module.
I wanna compile it into linux kernel as a whole stuff rather a independent driver, and I does have a try, while the result is kernel crashed at the point of 'fh_trace_thunk' , could you give me some advise?
Can you add an example that works on 2.6.32?
In dmesg
, I don't see the executable name as in the README, only (null)
:
[ +0,000114] ftrace_hook: execve() before: (null)
[ +0,000006] ftrace_hook: execve() after: -2
[ +0,000001] ftrace_hook: execve() before: (null)
[ +0,000003] ftrace_hook: execve() after: -2
[ +0,000001] ftrace_hook: execve() before: (null)
[ +0,000003] ftrace_hook: execve() after: -2
[ +0,000001] ftrace_hook: execve() before: (null)
[ +0,000002] ftrace_hook: execve() after: -2
[ +0,000001] ftrace_hook: execve() before: (null)
[ +0,000012] ftrace_hook: execve() after: -2
[ +0,000001] ftrace_hook: execve() before: (null)
[ +0,000166] ftrace_hook: execve() after: 0
That's still with Ubuntu 18.10 and kernel 4.18.0-15-generic.
I also added a hook on sys_mkdir
and got the same problem with its pathname argument.
I tried in a VM with Ubuntu 18.04 and kernel 4.15.0-45-generic and there it works OK:
[ +0,000112] ftrace_hook: execve() before: /usr/local/sbin/tar
[ +0,000004] ftrace_hook: execve() after: -2
[ +0,000001] ftrace_hook: execve() before: /usr/local/bin/tar
[ +0,000001] ftrace_hook: execve() after: -2
[ +0,000001] ftrace_hook: execve() before: /usr/sbin/tar
[ +0,000002] ftrace_hook: execve() after: -2
[ +0,000001] ftrace_hook: execve() before: /usr/bin/tar
[ +0,000002] ftrace_hook: execve() after: -2
[ +0,000001] ftrace_hook: execve() before: /sbin/tar
[ +0,000001] ftrace_hook: execve() after: -2
[ +0,000001] ftrace_hook: execve() before: /bin/tar
[ +0,006984] ftrace_hook: execve() after: 0
I'm trying to compile and use this module but insmod fails (no modification of the code, just "make").
sudo insmod ftrace_hook.ko
insmod: ERROR: could not insert module ftrace_hook.ko: Unknown symbol in module
I am using Ubuntu 18.10 with kernel 4.18.0-15 (up-to-date).
dmesg does not print a single line about this and insmod has no verbose mode.
I don't see any "export" or "symbol" in the code.
Any idea as to what happens and how to fix this ?
The result of make is not as clean as the one in the README but there are only warnings so it may not be the source of the problem:
make
make -C /lib/modules/4.18.0-15-generic/build M=/home/stephane/Dev/linux-kernel/ftrace-hook modules
make[1]: Entering directory '/usr/src/linux-headers-4.18.0-15-generic'
CC [M] /home/stephane/Dev/linux-kernel/ftrace-hook/ftrace_hook.o
/home/stephane/Dev/linux-kernel/ftrace-hook/ftrace_hook.o: warning: objtool: duplicate_filename()+0x1c: call without frame pointer save/setup
/home/stephane/Dev/linux-kernel/ftrace-hook/ftrace_hook.o: warning: objtool: fh_sys_execve()+0x15: call without frame pointer save/setup
/home/stephane/Dev/linux-kernel/ftrace-hook/ftrace_hook.o: warning: objtool: fh_init()+0x12: call without frame pointer save/setup
/home/stephane/Dev/linux-kernel/ftrace-hook/ftrace_hook.o: warning: objtool: fh_exit()+0xc: call without frame pointer save/setup
/home/stephane/Dev/linux-kernel/ftrace-hook/ftrace_hook.o: warning: objtool: fh_sys_clone()+0x24: call without frame pointer save/setup
Building modules, stage 2.
MODPOST 1 modules
CC /home/stephane/Dev/linux-kernel/ftrace-hook/ftrace_hook.mod.o
LD [M] /home/stephane/Dev/linux-kernel/ftrace-hook/ftrace_hook.ko
make[1]: Leaving directory '/usr/src/linux-headers-4.18.0-15-generic'
i am not able to compile due to an incomplete definition of struct ftrace_ops
kernel 5.0.10
void hook__skb_get_hash(struct sk_buff *skb)
{
pr_info("hook__skb_get_hash() before\n");
// __skb_get_hash(skb);
pr_info("hook__skb_get_hash() after\n");
}
static struct ftrace_hook demo_hooks[] = {
// HOOK("sys_clone", fh_sys_clone, &real_sys_clone),
HOOK("__skb_get_hash", hook__skb_get_hash, &__skb_get_hash),
};
Moudle works ! but compilation has some warning ...
make -C /lib/modules/5.15.0-46-generic/build M=/root/test modules
make[1]: Entering directory '/usr/src/linux-headers-5.15.0-46-generic'
CC [M] /root/test/ftrace_hook.o
/root/test/ftrace_hook.o: warning: objtool: duplicate_filename()+0x1d: call without frame pointer save/setup
/root/test/ftrace_hook.o: warning: objtool: fh_sys_execve()+0x10: call without frame pointer save/setup
/root/test/ftrace_hook.o: warning: objtool: fh_init()+0x13: call without frame pointer save/setup
/root/test/ftrace_hook.o: warning: objtool: fh_exit()+0xc: call without frame pointer save/setup
/root/test/ftrace_hook.o: warning: objtool: fh_sys_clone()+0x11: call without frame pointer save/setup
MODPOST /root/test/Module.symvers
CC [M] /root/test/ftrace_hook.mod.o
LD [M] /root/test/ftrace_hook.ko
BTF [M] /root/test/ftrace_hook.ko
Skipping BTF generation for /root/test/ftrace_hook.ko due to unavailability of vmlinux
make[1]: Leaving directory '/usr/src/linux-headers-5.15.0-46-generic'
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.