gui774ume / etrace Goto Github PK

hi, i try to use 'kprobe/kretprobe' hook sys function: 'sys_execve'.

i want to cache the param: const __user char *const __user *argv

but in kprobe, i can't get argv value , it is empty.

So, why? please tell me, thanks!

this is my code:

when i run : ls or clear or cat ...

cat trace_pipe, it appear :

     git-58259   [000] d... 226270.286553: bpf_trace_printk: enter save args info buffer agrp, agrp value

empty!!!
i's confused, may be i use wrong method. but i don't know correct ways. i hope you can help me!!! thanks!!!

What's happening ?

Syscall parameters are fetched on syscall return. The rationale was that I wanted to avoid page faults (and thus the -14 error on return of the bpf_probe_read* helpers). Unfortunately some parameters (like the execve arguments) need to be fetched on entry, since the values will no longer exist once the new binary is executed.

Page faults

I see 2 options to resolve the page fault problem:

• If this entry / exit problem applies to the execve syscall only, we should hook later in the execve syscall call path (I'm thinking something like security_bprm_committed_creds ) to read the parameters.
• We can try to look for a sleepable hook point.