#include <dbi_kprobes_deps.h>
#include <ksyms.h>
#include <writer/kernel_operations.h>
+#include <writer/swap_writer_module.h>
#include "us_slot_manager.h"
#include "sspt/sspt.h"
#include "helper.h"
{
struct task_struct *task = proc->task;
unsigned long start = umd->start;
- size_t len = umd->len;
+ size_t len = PAGE_ALIGN(umd->len);
LIST_HEAD(head);
if (sspt_proc_get_files_by_region(proc, &head, start, len)) {
if (file->vm_start >= end)
continue;
- if (file->vm_start >= start)
+ if (file->vm_start >= start) {
sspt_file_uninstall(file, task, US_UNINSTALL);
- else {
+ } else {
/* TODO: uninstall pages: start..file->vm_end */
}
}
sspt_proc_insert_files(proc, &head);
+
+ proc_unmap_msg(start, end);
}
}
+/*
+ ******************************************************************************
+ * do_mmap_pgoff() *
+ ******************************************************************************
+ */
+static int ret_handler_mmap(struct kretprobe_instance *ri,
+ struct pt_regs *regs)
+{
+ struct sspt_proc *proc;
+ struct task_struct *task;
+ unsigned long start_addr;
+ struct vm_area_struct *vma;
+
+ task = current->group_leader;
+ if (is_kthread(task))
+ return 0;
+
+ start_addr = (unsigned long)get_regs_ret_val(regs);
+ if (IS_ERR_VALUE(start_addr))
+ return 0;
+
+ proc = sspt_proc_get_by_task(task);
+ if (proc == NULL)
+ return 0;
+
+ vma = find_vma_intersection(task->mm, start_addr, start_addr + 1);
+ if (vma && check_vma(vma))
+ pcoc_map_msg(vma);
+
+ return 0;
+}
+
+static struct kretprobe mmap_kretprobe = {
+ .handler = ret_handler_mmap
+};
+
+
+
int register_helper(void)
{
int ret = 0;
goto unregister_mr;
}
+ /* install kretprobe on 'do_mmap_pgoff' to detect when mapping file */
+ ret = dbi_register_kretprobe(&mmap_kretprobe);
+ if (ret) {
+ printk("dbi_register_kretprobe(do_mmap_pgoff) result=%d!\n", ret);
+ goto unregister_cp;
+ }
+
/* install kretprobe on 'handle_mm_fault' to detect when they will be loaded */
ret = dbi_register_kretprobe(&mf_kretprobe);
if (ret) {
printk("dbi_register_kretprobe(do_page_fault) result=%d!\n", ret);
- goto unregister_cp;
+ goto unregister_mmap;
}
return ret;
+
+unregister_mmap:
+ dbi_unregister_kretprobe(&mmap_kretprobe);
+
unregister_cp:
dbi_unregister_kretprobe(&cp_kretprobe);
/* uninstall kretprobe with 'handle_mm_fault' */
dbi_unregister_kretprobe(&mf_kretprobe);
+ /* uninstall kretprobe with 'do_mmap_pgoff' */
+ dbi_unregister_kretprobe(&mmap_kretprobe);
+
/* uninstall kretprobe with 'copy_process' */
dbi_unregister_kretprobe(&cp_kretprobe);
}
unmap_kretprobe.kp.addr = (kprobe_opcode_t *)addr;
+ addr = swap_ksyms("do_mmap_pgoff");
+ if (addr == 0) {
+ printk("Cannot find address for do_mmap_pgoff function!\n");
+ return -EINVAL;
+ }
+ mmap_kretprobe.kp.addr = (kprobe_opcode_t *)addr;
+
return 0;
}
MSG_FUNCTION_ENTRY = 0x0008,
MSG_FUNCTION_EXIT = 0x0009,
MSG_CONTEXT_SWITCH_ENTRY = 0x0010,
- MSG_CONTEXT_SWITCH_EXIT = 0x0011
+ MSG_CONTEXT_SWITCH_EXIT = 0x0011,
+ MSG_PROC_MAP = 0x0012,
+ MSG_PROC_UNMAP = 0x0013
};
static char *cpu_buf[NR_CPUS];
+
+/* ============================================================================
+ * = PROCESS MAP =
+ * ============================================================================
+ */
+struct proc_map {
+ u32 pid;
+ u64 low_addr;
+ u64 high_addr;
+ char bin_path[0];
+} __attribute__((packed));
+
+static char *pack_proc_map(char *payload, struct vm_area_struct *vma)
+{
+ struct proc_map *pm = (struct proc_map *)payload;
+
+ pm->pid = current->tgid;
+ pm->low_addr = vma->vm_start;
+ pm->high_addr = vma->vm_end;
+
+ return pack_path(pm->bin_path, vma->vm_file);
+}
+
+void pcoc_map_msg(struct vm_area_struct *vma)
+{
+ char *buf, *payload, *buf_end;
+
+ buf = get_current_buf();
+ payload = pack_basic_msg_fmt(buf, MSG_PROC_MAP);
+ buf_end = pack_proc_map(payload, vma);
+
+ set_len_msg(buf, buf_end);
+
+ write_to_buffer(buf);
+}
+EXPORT_SYMBOL_GPL(pcoc_map_msg);
+
+
+
+
+
+/* ============================================================================
+ * = PROCESS UNMAP =
+ * ============================================================================
+ */
+struct proc_unmap {
+ u32 pid;
+ u64 low_addr;
+ u64 high_addr;
+} __attribute__((packed));
+
+static char *pack_proc_unmap(char *payload, unsigned long start,
+ unsigned long end)
+{
+ struct proc_map *pum = (struct proc_unmap *)payload;
+
+ pum->pid = current->tgid;
+ pum->low_addr = start;
+ pum->high_addr = end;
+
+ return payload + sizeof(*pum);
+}
+
+void proc_unmap_msg(unsigned long start, unsigned long end)
+{
+ char *buf, *payload, *buf_end;
+
+ buf = get_current_buf();
+ payload = pack_basic_msg_fmt(buf, MSG_PROC_UNMAP);
+ buf_end = pack_proc_unmap(payload, start, end);
+
+ set_len_msg(buf, buf_end);
+
+ write_to_buffer(buf);
+}
+EXPORT_SYMBOL_GPL(proc_unmap_msg);
+
+
+
+
+
/* ============================================================================
* = SAMPLE =
* ============================================================================