Hook syscall on read, write and openat about khook

[milabs]

Hey, on modern kernels syscall prototypes are changed. Each of __x64_<syscall>() function has proto like __x64_xxx(struct pt_regs *regs). So you have to deal with struct pr_regs and extract syscall arguments manually using syscall calling convention (regs->di, regs->si, regs->dx, regs->cx and so on).

Update: have a look at https://github.com/milabs/khook#hooking-of-system-calls-handler-functions

[akrogames]

Oh thanks ! I didn't found documentation on kernel.org ... Thanks so much ;) that's work ! I have to learn how to manage arguments.