From edd206a52f4215e3a67dec56754a631ea9ccebdf Mon Sep 17 00:00:00 2001 From: "QCQCQC@Ubuntu" <1220204124@zust.edu.cn> Date: Wed, 9 Apr 2025 20:33:05 +0800 Subject: [PATCH] =?UTF-8?q?=E6=94=AF=E6=8C=81pre=5Fhook?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- Makefile | 9 +++++++ build/execve_interceptor.o | Bin 5448 -> 4056 bytes build/intercept.so | Bin 31608 -> 27312 bytes src/execve_interceptor.c | 51 +++++++++++++++++++++++++++++++++++++ src/execve_interceptor.h | 3 +++ 5 files changed, 63 insertions(+) diff --git a/Makefile b/Makefile index f15165b..43bdc3b 100644 --- a/Makefile +++ b/Makefile @@ -24,6 +24,11 @@ ifeq ($(DEBUG),1) CFLAGS += -DDEBUG -g endif +# 如果需要开启 hook,只需执行 make HOOK=1 +ifeq ($(HOOK),1) + CFLAGS += -DHOOK +endif + all: $(TARGET) $(HOOK_TARGET) $(BUILD_DIR)/%.o: $(SRC_DIR)/%.c @@ -49,4 +54,8 @@ debug: rm -rf $(BUILD_DIR) $(MAKE) DEBUG=1 +hook: + rm -rf $(BUILD_DIR) + $(MAKE) HOOK=1 + rebuild: clean all diff --git a/build/execve_interceptor.o b/build/execve_interceptor.o index 2baa4e73ac6fa87cbea15f5be940806c1e93b552..916b815ca76a7fb3d30ba96483e2c555bea7415e 100644 GIT binary patch literal 4056 zcmb_eYitx%6h7MrV0r9<_)3Y65u^egTHuFZf`vMCG>s6XQLJV%-JP~0yEB{F8E8!q zVvBaOZ6L%DH2yIm!T8{h5is?!hD6FA(qG!2m_VVn2{k09A(DE|%)Q&oxC6v^va@sV zcfRwTb6+!aNNL?s5sLx07;J^P9!CM*STxse@|#Vt1Qx@s_>;HW)ciHIZ>mYn9~@Kj z-l&>y8=0(D`;@VmT2RK~XQ997*4>~ewUA(t8vn7V#_%^9KL_!1#Z@2y94UGu;THp>;@0*U{IGFc4-`h4CRQqeG;DUk>V6oG_XXp`MIA0>5{tEPrs(nSA3Cia# z^81CR1dAfy0_I!GxPHH!7%OKDmUB^=qGS^@xPGO=69r{TJ*k?-m2pII8i#gOq2{zI zmJ~lye1I5S0$~{O{=w*&YT84Tt*=<6-lOc?f0u|KIqEMNTcEqgSuF|q^S`J=0V{t| zSo1QNzZnLU$-@UH_qtEvf3N$*T&(Z?359{}O)lzpCqBJLIrp26WW;(sz&Pd#>Qkoh zXz&eNIK2FiYS^qy#RqTRnVp@C9rMfdC*aZrm_@^aVZE1g)~C&m^+`LE(XCXyWxMsA zwr8av*KMTJa@Nk7J&@aHX5oPDSWw%(abu?ab!?he*W1#nTup6zLk7kN^HL}Ykj;5IFH}ABEC$>>yHJo7QAR)!q$dBIsB~%+=;*kBJkr8_{S0WsR;bb2>hD} zoX$bHas3d11MSBBhGtr>;UtZ$YddlhkBIIVDJ^MRon{yIGMbr!w4QUdjGZz&P4u~D z#(=D2Xx+BG4>T?5_GS&OLrdEj?mB71g0!u34bAM-EW=0{DbQM4cW&R-s_opd<27ZE zwrAV+Rz-sYj_Dd0jM-c#naP6gbmg>+?k2l23s%<&T?Te^2eO`j{l_WBQ9Yvm*p>S<3M6x@=-N$x-tZ(|J+Q5%_JzsvIEtYc>l$L+-!QZl-= zPDjV5-Tz?{iqO%T7ZPh?eg59!ZgvcL7izIZYu{8tg2wdx;6BFYaUpgomY#)Vj|Vq+ z7Vm^J8bbkQg!wOl*q~gZt-}s!hT}Og{O;lTxke*4DF0n+NlupN0<{GT$8Sa-#Wx5X zYF=RRRG(73maa{RFYL|C zZ{GX8H*aU&PT8&0tt|)y2$uj^MMg#(CFI>Z;l?xK&N< z%BZR22{qN&HBhW}D4BqoRx-g;WN+4)e;uvVbSZ<>;F+u%fPcB*X%al0okJu-_GOdj za9&OIxayq^!*m?TsVQX$NuxtZI;5^tGTTMYA#mfzd7k;)n@yHvFpT~g#Slv;{6LfX zTJ7l>260`czEIO_0%CQ0X`(`COS}pIcTRFSzJ-t}HPtzbDWts-Y@`QNvl(+8P^25X z)bz#^?z)j@^>D7gy$F*fdLPq7xx)m~(QzXHi67H$618h&0bI)GKCJ)*=}~Ub&^o8N zE6ppwGG@Ze3AH0zii-QP&O|y+SC=v?oSVSr6sAkZqmhjnXt7~t z2Gw^}Gdnv7DD0Kah9dBGLrn?62KW60ZzZ2o9~;=bqRrlq{B4TyprE&oY>|3T3wq0c z5o3`D_Z@;X_^hT_5+Z}`%{RKRLr25thCQHM+_UTA7Uxm;-RaC2(erF<&qV)w{}Iku zi3;8OIz~=fhcXD2fuET4o~geTljX`_@Zk6V3=aN*#Ri8(B{dYghIsvv;Zn@4vS+Bies;xcJ)QQ zoZ5r&@NMH3pX^=5=lqw1;9^kKXg5OJ4Wig~%$7_`3P%z(Zq&bNavM8Cb z7e&nGMWI+Us$1a-E9O+R#FAE+B-)HfM2^Q2W;;o2Gvj23Zd;_hX~~jk({s=@t=1Qj zqr9myivIczrhd(&rFmQCN!PlMUF$yHmpXR+gM$mDz5_>buDiQ$@1g#;Ke>A7Xy2&= zD~YTW2FkREE5A4g8r+bO>|M{9i5kus2+*L zLZq%%YuKdJ)vvC7nviuhH7lg~jm=5RNlH~!@>037qAE#;Rj(~xELSdFz+em>1ZpWM zg$MWHx@Q^*obW7SP`ap0Wo_W)O(f7>8YrJQe!^imtuq0~2jvnPE0at27t~A|S9qZq zR46{$514|_Kj^#i&KHjQCC6CkDY--aK^RS;(YrABIGf@;dUt)O@dU+-2-oB7Du!bY zP&i%#{W2jQx<H8nS}10N>4{?b>IR z&D!SGYw8pY=G?=caKg|bEpZ!yXn}xCheTpJcdwZ(nq?SaBTUSM22n;$OOI%@aFHFh z=@{S;f^_UqG){E8HK9dyC)7q-4fxe<5>Gk_5>Cd~*Ygq*=Z?pDEyYzB$ia0mnZzI9@5>WdgpE;ofy=0*<~p zk0sz@9*zjOsE_wP6fgfJhNJES@NoV?hVwi;hQ=U&3Hn(3x&Crg1mXHmxkFORaO4;D z>lyBiXSaZh@qg&UbJ9ouvY?L_eIDmEAN>;cqH!9#Dm*CD819WPO-e)`mg8px=m&Mr$HppbOX)U%6U&;SNBp|_3HO@m;&Bpw`#-~|X<3pNb z%yo4haXW4JF#^f4JmL^-`MnVLF3MbZ5NF#RAu7{ZKjVEEAA^hz#x_twS-=QocKVJKP0Y$O8>;M1& diff --git a/build/intercept.so b/build/intercept.so index e7bbe09c83d9c51605c903d341b5459bb7c9d187..c269ed518e8fa8882112d9faf8ecc1a1e1d4fc1f 100755 GIT binary patch literal 27312 zcmeHQ3wTu3wcZmLjR+(>q9`Jxf>MPLUMeUWz=1(|L?Av&aWYIMWF+%&9tv0_8lt2_ zG`rify&&rznMr@den2Mz0TS^)|MOGX^xK+D?%=_h0*QW}m|xdwak8_51F3 z+3jSV_3yRT-fQoD_TwDRa-DnL>>`JQsnmyE#PS?tl`C#1ikX-z)LFbMTyrQ}uFRxO{TWA9}%9x_M-Z4NQF|MSEmpDOxPdGBQKItz@78b#c^ims$1pN@vHR0C?qzS>e%*#a#}8XMbo#ni*N;Bt!9^wSZh2<-lTY26 z{hRM+XEeRjJ}K0@wxX`zQwu)6Z``^O8`cc|&E(5_u6u3YmoQr}bpRb)Am>ClSP0*2 zBY%dC{77^_Av@F;t^(zbMu$)vThpfi3fY-#Q|@~<9Bw84vQ>L0VI&&f7;gAM+Ijr})m@bBBybG8i* zGt6ZjY~U}qu|LHIuZK>d@$<4xxwSTS#@e()yN&&?Z0wiW*!h)>{O30KlQy{1#{LC1 z@~7C~(`@i}ZSYo`cDvgKUuT0awWgqVlVu$aaQg#UVxj_B_GM?GC$8+COugz$1dNYal;}4PzBG0#N&cvmj6SFo~;uO}(^#pRD+W z(#|W={z&Q9yAt0o@qJQ$4tPqpa{DK;;u_BKeF0sqk$x3V7r1Jl8)dmSNWZ=o*{m9L zFdN9GeoFucW&4D=UnjEuH3CyYR!5MZ#ESLxY;8pa8qRbat z5%)sRU(aCCkNPsSPn-o-1rw|`8J)Y3`KbkyQS=9Q23|yBj0g(FnDFAby2idqK?)18zOP?b%p3(e|@l_ z)*B_)NWd$2YNBME#RCac27@dVjKo>JFI+m-ikD{H$bwpez{AeCuA`t@`@~sTSd^fO!AF>>) z^M_GFGy;3EfUj0GGa9Ehg0WUt*N}|Y6Nd(2$#_E`5QVNlgK^;ss*MH?zyQjLQibAS z)jB}nb|U7FN5c#XzHmI~4aEIE^lm(GT`~~%qw#{v>9!c>FONscrx44p&Si7v&7C>R zJF$FH{%W#uIU#>JDK9V)1}-j;D;PTCR*FmhcZ-Hoo=RIaoX(XhwQD$?5mnl*;dFjfsYAo{ zbLUIl( zC5(_Z4M#^BX|smQuH|`KG+eF0l(ALA<)a=h->%`R?)4gV-Ys3|`v%X&})^L4aTdLth z3?qyU)9|4h?$Yow4IiW7Cun$uhM%b6=WDn}!z(phJ|g6~9t}T9ldsZndd8yCRT_S> z0zqpue7J_!YxpS|9@TJqzN6AA4WFw(&_)d(q2U`e{8SBZ)9{fRzFEUv8ooutPuK9R z8h(a`w`=$)4d1TeOEkPg!$)iQUJXA}!#g$nEDhhM;WIV7OT*O^OxbA-ms2*^>e2AC zH9J`iKS#rvoPTKi)7eg?VhxvDY@SuB;c`pP@nIT1UKs&(X?TT(kJ0c68eXB{atqIM z&)4utntY{(tFsDado+BCCSRrD@~FgfuhMXN#Nl|2hO09nWz=i9n@fs6Q4OD};j1)! znua%OxH`*G_67}~uF1D)_(d9i^zvv69BqN4EpW62j<&$j7Wmh+RRQ0z%L ze{nIkAI%+!qFkq^>80Wqd1Z1_7GW9h&5d3RQZkZ}d_Cp#W)y=G22Y#3-pq9dPY1l-jL+cdVAq?u z+~Daz*PEGP@N{77%}g+OI;iz#PBVBqp!H@389W`#dNU4#rvq7U=JT(WzjP3T{{~M7 zF!*oqbnt@z22Ter_;2uZ(1QO4PX{dcZ}4=mg8v3j2P*h)@N{5;{{~M7CHQafbP$67 z22Ted_;2uZ@PYpZPX`$IZ}6vb-eK?~Isf_JmH#fze_-(RKmz_7JRMlzzroW%1^yd6 z9Z=xE!P5Z*{u?|UJm9~<(}4s28$2B-;J?AsK?438JRKn5zroYN0sb329T?!h!P7wj z{u?|U5YYbyPX`0^|6%1n9SG3>22Te8_;2uZ0D%7nPaA*uZ}7C?hyMmo8-4h1@U+2) z{{~MRd-!kg^neEb8$4~;;lIJtMjieeJUzI9{{~MRcKC1bv{8ru22UGw_;2u-7{Gu2 zmGZxm^B)-e49>rh!`b-v8P53uk~3;%bxtm}Vi;SXB)k1YKA z7XB>@|62?HvW0)v!f&(ik6ZX3S@`=c{3Z+EYT=tL{8|g2wD2JdAF%MtEPSUyxYQ0xA0Re{5T6g+QN^p z@MVhkv`%lqwWrm23z4bWL>aas$IvylBFE*rN=7zfc403{3i+$K{FFsRzV)@IrN{I9 zrx$yk&-U>+c6(m`Ix!Rm21oq>F0k&1=1H6muQQd2T*HFGD;{{YSBRQ{PK| z2A~le5qP%w1S(-qx)KYDr^VglX*G;!ruNxu;bG8*M%PpX*<0DATiK_#0yHgFRqPjk}L<5=I3IDuP$&={1voh)Z2 zqA-}>k~cp#Z=Uu8u(kg8*uJ3%E(GmqD55FrENOnxj1Pu*i~B&zePBl|Y)|bhS@=SW z`=veZ!@MZ^2Ma0pVUNGlu=O@MaRJPs5xP)~&7vB(9PkrtfjlkT%X_JnS~s=jGw;f0 zt`(UZ@|kP$nKhJ|YUXCqP8X_cl=>wv^?BH(mZo}b_5?ddVPofUV7J@RcSjDjmNnS$ zH*Sa50Cr}=4!?$-$L;Mn>3xT?Mmr{HZJMygt1PYYYgqGsgEg0CEl1rZTIWDEXQ_VL zGj8nfooo-aI(2SizHOFcqbc<+!D3FG`zZ;fnz;~aungvS=e}*mr$D^L{a(ub-VWMK z^Uh6Gqc`911m6(N_KD}_PpIIQqCM^`WLS4H<<5%!7Up?>UxpIU-)Q8uoh-2cW3rQm zK`pgPOTI(0=#b~Tiajm6&7ITZak_9kQ0=Pq(jWhds=Koev%GAL6r1YKmTX*!JFLll z7&0$Sbsq-LM+ojK)L<|*e#*HMn>9}g4cAH|W5=*hoT|xgMiu#O^U90rX2(6f1)h3Z zn`>YhmBrn?1G{~)HxuIM-($H-_cTwcdOOU|ljf(sfSa`B>5dln;ik2R8O?G$e=Oy< zl+r){VBO9mi)*9eQqD4I23^>E0ML$yF(h_TWuKdh-DnzBhcjgZA=Xj^c_%JXtSOsI z4n-BcgGCizLlrYG3yXikrZvTOfML7n4?O6gK1r25h8z#K@&H|-ZOG0@*cmPD+{Oi+ zjg&3MU3Uy^5;fZ7kwK!sa&&%kM-nqu^_D?|$O?YStzQSVFBc;kxsYQ8s z7{K$+k+Pg`EnAW|c7iY_t8+H0v&T)tl4Y_qZKa$69GN_+QY;RpiMF+>FKpuW<5lYX zlB!hF+#z%(e3K5kfa`1&I_ozIoxkI#W-Ujbh|va*(IhXFy4u(;MQ=4xE+?_x9?QO@?~8 zWN`;B?xmF}mn?y+w}^7nB`63|#Uv%>owjB9xmipCdoc-gcv{76{51-N{z9q0ko1iW z7|o1JWX?7;Mdo{aK#0{Lf#M;W#Olmz#4M4lCrnOy+uLav=4)sT7GcQB5)#<1d4Oc!@L!;$&PfM?- zb;=Kgf*8E>(JXR@*L|*7d0U6lih^P1ruo#9DyDrxiZ*ytlDg_(>QKHG)8@;n#V5Zf zxE>nlR`_EYCj;;Zhp%UeGcW*hc)$a$YaNEo5b&QVzNy2}nO)yu9u+kh4eiwIJ)cp} zIUj^H9DRSUG=l8iVOeg!NsGLUdnmdbm4yO23WnbD7iOb@4SD0kbN z>d}@cs2%8bpiyF5Hmwq92cNlG+>O`)Zh#ba4DL2;gIe4eVba2$^jI>i*cZeN#!K`g zBh^e5*+KtEa2M)@5g_jRce-^{n+|p%V^4Dxl*mTip5`UEbTDD3rTHpw0Kdb*9S@@) zcg=uZOdgw11R6w`&mL5xLu}W7ATrY~R4H>B?e$uD8T_1WtTHjKm8CJidQ|$QPsCEw zw`6@Ijh9wuNLu+F);?#L{l_a+$+{pCl!ewh4F zz2%~DCgm#}r9xBA>+;AoK%Of-3r+kcs;-UBZB#P9LG&^EGl-`TAa(wvs?=GiAbD|Gc?-A+dYClQJ}cgP6)>d9Oe~3`nK@RzCBmB6C{a^e^+7cZkdp z`OJs&nK7Q3q?xRThR4LTocz0KlH<@wf>3X!wV#}fapbyiI4!0)?P0wnb}5z?>T`Ka z7dub>?$mf&O16%sqb=}%rv=6*LecSoRRKT$mSw#7WQGIR2fVRlLm*yGUpufsm_9M8 zWgKGuP%YzM@`U0m_?Ip8l?uL|aMk(nu?_!h#%D0RF~%q3vGMp;0wsh(_>^Q^IFcAw z7fFUm7++(QM6N&|cRtHpqvQRCFRci%{To|8+@5ls zb@f@Uk9R)$@y^Hhw>+ADaN}6l{tfp~-p-x-*WZ!3`-zY4xM%;<8>YEfKR299(swZ~ zzYpJUG@yRvtlz9iI1vmdVcSLCbAj^mawfj;LE#fZOWpLf4;4)%_Y)uDC=V^|hA(R3 zvenAvM?d&nM+wWXb`;CM&rysVD&kun3A*qJjSFU6P{apW^c9d#e9vPQ;9qGi9UWih znkCwG8nqO4$L zqA!eiJ$W_gs~lx)d^8sEj~`vjyPL&WKepV5PjlAbR~Mvjbm~!@V|bqnHiP1+B76A# zT<$5*H$TYb=w$mL=og^R?$71=W7hpKR?o4ZCt-1#2RZ}mTLWkoTg;81v#~$_DX0r) zo!@|d2lN2wLpbL4#}?|lI6jXBZKq>2=vSZ(pnt<7fsLT^@GS4Apd0ZZ^*5k+a?X=u z%_8PlRq7bt|JdR-*uz?ls25mZ-^=AH`r=|>>Fj~SE-g9!hT=wc@yXN9o;2!oQY8IL z@ayTyB~em6Zk#$Q7*^7MRX4=y|rl8fMfc6*at=PGVezI^;p#+ zq@(hS>L{D%KLz+@4f~UkKM(zIp{^h2>b!nSkYA5{{w=4Wf03b|K>i&#cD}3Y7j<$2!+_n5 zd=L6{vYwA?7k=%?t3lpndS1~?Q8+Ma-!~z18)UvV$$V+}_XY9;7%%)=S)+cJ8tpR_ z<6<)&zEwibXrDgk8TF@F2HWvg!c@PNMir>kqv>c19BqN4EpW62{-3pg`aae89##5J zO9>_V)|Hat>DyXLcseYSOAtI!=jlTFH+x7Y3BuI(u)`&fEdfs_ORBz$rFD>!+LL_w zwb)MdVC|xW^D|Fdju#Z?c%HV(`t*~$ikBe85b;4IDaNA91TW393TbGllsi_^6D6&p zO(2rOx62ADKQ_yTIZlWf<((>dC5Hz+e0!wY5lL)Zp# zUil%-|F01hH_U3V!X=PONvkBSku)l4qoi$;ZjrQI(hf;GCGC>5M^bhg+1KEAq=lr?2E=luQ5#p{ij?qyZqa@yL!D-l#ymj8Bf57L!EKpj5 z3nVI!(k%QOIDM)4j)VAfEq-K2&BF@69v2Qa#F#%7z6lqF>i`rw#rq8~jZh z{6B5*{Wf^k26v#L3i)N%U&kTCffIVY8wM?@kew4DU&Kn7TA!542yO?neT_l{J)7fY z%sMYl0#0AHe|M%?ezvru`d#HN;`j;1x})%V;6-@+z+4IuGz?rWIi`%;ZSV(daJ%?s zf8g>1nKk}T+Q!adDQ}JM)UW7>s`L7u34D;L=7O0DypUfMuc;6owZU)Z_J=W7jj*fM z*Sop=KxU1n^zSxyp0dGr+u-}8eQP|cPi^EKeG2)c)2uVEs96Dv~orHvKrlM!rJYrw>Rdskm^{Y~-t@yft3j3LE*g zQr;RzZljI-{lE*wk$coeey0uox()uJ4PJ)xNTKn0$VPquPMydtV7EI~o^f?g4uE)Y)O%}iYk0olB@$xvuDR5Z>D$%IK%yj|lpTAo}1 zO0S;qo(&Pz0x^FeifRDlYBClaSiA>9$TgBiP&Jej#g%w5hhTF&44YTPW{bsv zj5EB^Y9PStoxNzre7D!V;1UWSNYy9L;t{FEyq8?PV8;Bpvw$LSve)gA3Z6?A0YZR5 zr8;Nc!kIJXc^A%}z1Y3PyJW`9d2Se_+M43_;WZ$S@>i(^HluKLl`1|O1wGRP3zC8i zAE@hC!`hkjjo^DS0H7(;9IEb{A|{H!aVBNGW~LB?dfoUNJd+y5@-qPiLJXP%>hZXK zCKVps&V=wNf+nPJj6f0B&n!rR|I7$Q+!ImuOt^?xXoBow-^pNlCRr6e&jiXho+eBL z{xd=R)uah25Qk9j5gIF~FYX7uJM?&#`PhxPaYU3u8PU&F4n+?%0d+8K?m-chQH$G1 zc0y5;7L+KIqX`o?r5Q4Xr@8$Vb3H5z*2>5Gzn`6(eA$-YEG9loWo^ zP^G(11WGhP@}5DkM%^$*wQlmr7>Y)W#zMx>5Iig-y%;v-=fh6Qppd3qBLbuem2ayJ zY|`X>SV#jT=fs$w-?9 zz}tq$;50$3Jia=V@GS>T#00HZSNO*uf$|mMWI6uX0NNhGL(2_lc@i;7$D#YUKt264 zg7VtcVHgt>kwSUS^?_KNqMz!F7kRNjgO3#CRkR_&%K4&Ij?3~D5wLU-5BOPmBCrZ9 zUn9$7ky>BE$I1isa#63Zg*C+q8)9`A8tNKF`9eV$6Y9$mp|za;(F=A91@=MzEJV-u zvE{)t4Ux9W3q@TLS45rL6<>}EU4O6CS9FvTlvM3=6+8nMcm*C&<*WAwif*^)S8tk&ie{;DNZ5umJQ6YDb*lFZi-FRO9)+3+ZDJWjOS5UN3>Qntm#_InKz{s}JSMNC#Rqr`e`AT2;f3wt|2}()5 zH&Il*XCZxj+G~`r^i#m7O|Xp@$z`VM{gFhCbB^L~#f7f#a)}&8`M-%#!l3FslcIM5 z)Ag%H31LN*oHC(!Menuf*GPRu>A8cRl%ApwS@hL&XhnaiUQkIRN>AB*%%ZQJb1JId z&nbCJb=c3OzUqHgDJ3OcV`K7Lql(_A1SPeW|FT7Y*eoHa=n`dE z>RZcy4LCikSGSpZ@2LKJE>?NPEBbrr(yKP5ub$IKX<|UKwztw#^kc}-*j4)Kxv~21 z^Qiw058Z#1l%BFn&-JPOl)idT8J$nkh*N9hzp~Q<8C{>%kQP#vAgUa}<;z$6UvNRT zRQc*TcB#}KqXZ>Y>13Ep$dt^*xhUv@aYHP# zacta`mUZolUAMB2wv85*#TEw?g4?RGTP{y+1(muH{d z=h-I*X1@P>&-Z=jobR0fT>gJ@&YkX6%ZeNhrote0E$ibLtCSH75=w%w1#B3;C$fvV z?BKqrepi_b1*9k|6+ETkq)QilA-MRrLC=@GqPiYWuS&{W=;PcdV~Xl}L!h!?qtIKh z)l5&yLKI7VrB?(o(yNksRZ>sUZs{yVi-lQ6=IFDZ3>2U)jvB>fR=pEa&q}9BJw+)E z3OBu%sQvGxS0(j+yiVA$(gy|16jkZn2tD%4e>TW!XX|8ocJ**VCZMQvFZU(cpz2w^ zrkcS$84?{NGeFm4B~S6|rcWF^W&EwqY2L4HpML1cmwvPJpNEm?D14UUL+(8fpH+^< z4)zzt#g|pxvhH8T{6#y(sjv(eEAhDjpH&iE4Z0Se8}T8R-GtA2e5&!e8J`XK?CfS2 zUj4|5zt2V&zdUFEk1l!nZzn9gqwAyF-J5=X?=8DW4LkPG{Z18W`*tyFFzr@DQ0UN)?ZRB6Ik#Dk*ud>O{FdO+(HuAe|@M4?%{FROUn{4oV zZ17KQ><_caPlp|DV+SyESsNSp8*Sw0+u-%kDb#+>+2p6z#?B=+@&OzFwArLP&qjWY z4L-;Qzsv?dZIjPyZRG#lMt+kGeuoV{+Qxp`#-GpH;P>0$ciP~0*ra>XM*ectiwhrX z*a@IeJ6T~M#>+bDfoyW?AwqZ#md-%r~qi3 zr*J9He;F&2xSBsbB<*aPCFEY0^SOs*x*M+)_%(v?iNI(!lKpyt0N#*znUw#wlwU6M ze>YEeJS(>3=K=2Lk*xhXVL)+<{)&;}9hT!c1))4X4di{}bU2uyx z5%I?BL+tBuBof*D^?*O&t&2rM5Qaq^m62Nl32$JVDTbiUkw`Ae~@s|McRCSTMYWfrS0h?JQpJiv?7fSSS!8P?nHN;tfS= zgLT0`Ei`-y*5HdL49J@ZhRi+*)_KE$KrKnvhmZpz$OVfAVzEe!IM|59;Jv`Mfd5u_ z-s`7=c{h6-B7Vvg%EM|K;@d;`mP!fKT8!02k?%wu3v3G}STOEI9fqh{PziyC26kI4 zmlrfQM==@P8fUf1=!&&02_sCf|LV5Qkf{`!_ZG{-Ci$qZhKle_ZzabJQ zCv6c8!(Sh4sP#t4CsZD<;K{eiIEx1o$OJE0B+lx6Vfers4{m`V13_su&|lwB%YqSq zq5%oUwnh`%Rb(*2wg$;3zF>kil7(5RJfIEa0mZj)qfeBWR>`bq&dQJxj(L0)Z%$1PgOfN;e*sbyf!irAx&8 z@o1PT&lipdy@9yjhpLYUZb=5he)uT3nQohz{_=RFd_J-K>I$}e)r#wvc;}SQHLhmQ zGcM=$p>v>R$j)OcZ(6%%iMOI0!U#oJaSg`zVE)gcT??epw~|(I4y@va7&iK>4d%9$ zl+HP%bP?8U6z}*i{G(hm$UE5)^s%M5uEA$aFgSu%fIpSk{r7zf%h@69HOc>o^G?<& z`Q$~x^JzujCHVt9eh~WucnXxGCuJP*gLB_P&s@Zch!{L-zZX@_B;7TP4mc z{kGygQl7eJHzg!Ps~j+CO|GwD_iDIGgH-luI0|Nj{TfbVlnQMcPU~G24r;g>%PB6S z;Zv0`=m`z?Xn2Q)(>hv(lNwHIaTPi>yh?$fSq(SFc;MX{E{ABY)vMu4G&>tYf}v*w zYA7V6M#E9TM!*op1If!K!TG3$tGNqBY}0V{$cgYq4X3(PVYh};8Y;AE_)rCc?$z*N z8op1%himwL4PU3>Z5lp8!w+isNDa?uc!`Fe&~Um3Rp`)geLi|p!}WP{r-qMFMnJO~ zK32oKHGG_g_iFeB8qUIkAs>&|@L~-w)9_LamybGmY?+3y*5q9pevyXH(C`TwUZLUi zY)OR$8h)_?K`S+UqK11k{1OeX((tt!zCpv+Xn2i=Ptx#u4R>ic1}YxNpOZCwn}$!( z@J0=vrs2Cae7c6WYWNp4e6NOoMZ@=L_@x@YU&Ci;c$0_YWQWEd`82UY4`~Z z|B{AxX!vpsKdIrgrc|L*!)GcGG^^p|8s4qpvoyR{!z(nL$^MY)Yqo|LYxo=uFV*n5 z8eXR1YAr<3E)ADU4X!mq!>`cnRA{(dit*S58ZMV^9Iw=Hxy0nSN5kb(jN?@rE|;(z z-=N|2j8}yk4PT)^(0UDDq~TEwmrG$DyG_F@HTgyjU##J~HT-%FAGjRwz<>t^JTTya z0T29lJn(NNmwe`FI$i8(aXzt@F;8|i7(6YAdU8(~JS~KJat|9kEr5D*_Zd7be0p+s89Yr! zdUCfIJS}8cv>j*KdJJ&IRB2p z)5IR-H+Y)Rqx=RxmGe&+JWcFTeuJk8J<4zJG?7R74W1_ID8Iqe1Rdo!c$%1_{02`G za+KfTX~K>28$3;@QGSD`i8RV@@HBx&`3-&+=RZEH%1;w!)W5;gL>c8bc$y%i{02`G zW7NOF(}Wo1H+Y%|qx=R>6JV6z;A!HE@*6x&cu{_Xr-?4gZ}2q1MfnY$CblTQ!PA2g zl;7ZK!iw@6JWW(leuJk6CaC{Es`6KI{vCs-i7Lu(@H9b1`3-&v=bte6rJR4*;N6_R z&){j{gz_sMy^s3_>V2R`{SEl|%@%%#g-=@ekcAIe_)QkR+QP54@NNsg z$imOJ@G~v^bPGSx!jH4?BP_hr!v6_tP2HcLSojYu{CgJuR~G&?3;&XZKW5>7V&R{% z@ZY!a|6t+2W8wE$__T#@w(vVFeA2>)EPTMiZ?f>!7JjvbcU$;H7Jj~kpK0NzTlk3< zew>9LVd0$?{!h5YO!aT!KeX`gS@>UB_}47_OBVi^h5w0#f6Bst-@^Zch5wF)-(%s^ z7QWfS@38Pm3m;OvC%q_#Yfsww8zKvP6XP&d`Wjths&sz7vt&{udMoz4q>%q7Es`q`DM~?#DoE5y2#Vg%mo1LKwg_OC3`ZvxrvgeIce&4?8+oA z;1(cMjC2o@<=h-32J`#+%-_>zp5`mCwd*ZRFOdWng7ycW=JQRx&XVTm&G=}Dr`)Go z+@}xK!uG9v9^(w>vkiR{tf_9wr9z$898J)EDSueN7vn;LgYgn80Io4d7 zwLDduaKPiRX3l=rGxPGdoUEO^PL~21J7L_P{OIAc6TpiSXZ*e-7D%_nCJC9fr_7U z!^t~3SYi#@WCt~adE{fwk-eypBb~*b)Nym^x;;*p6It$GOW*wivhMD6nB}E6TG&E& zZ^=Ddafdaz&qC&fh3>Q9c?-dPg&g$oT6T`XWXjV5$EB%d94h<3sa$;{1o&<9;`8ce z$349dCH176YhW3f#oc|;6acU{8sezm^SDaaRi2jWgXoAJ!Q73^FFcBywB+eb%6+zJ z$5}?b9FN~c@u|{-sBPBe?4MjKC5Qe@nn4vdp9Xa35j2Uzl-cJNVz!(`*3o3gg&~$I zf_wlMEv%_GpB#%UJ~vrp@i}BMcT8AZ!X*xYVTb7pCCG4(jB_By!># zPT$U5f@yCYi?UJZDih*yh{L@@1y>DDtCptIHJ;RtgPv5f&6BF$-{tf)xeq$f)()0D z&CnIj$R>D}OC{tfIh^r0@V}$v8CLR4W;$~*hKwSUZdhs0I)4v;rmLtEK1gjZ$%!}@YWewmtnIP$=KO^QKq>ogD#&+l)I1`blSNBX;KqvZ-?LV**W}1ISL=_ z#d-j4!qvTWg$h8{=4Nj>LrsnZ9+Gf+#Bgqdx<=ub9mw}{4kVJD3UdN`;}dmNBC2B= zOw5CcRj}Mrz2DQax=oau>@3cAOe5P(N6=0Z)GQjtd*z)7jHRBE-MU&nJ7 zJ`Zq9SX$2xuBj(p7_z8u}QX z*=JE}bl1`kzL3TvpQnSy%XMxOI=kpchtP=@(9uU5cxS~WhIdwSD}&E z8h5<%mBb``Z%H^&<-=Nr??e9xvJ^rUF`gR3hCh( zQ`{%fAv(~#f*QF+7m5xEXc3CkL7ig*jfi;&mlI^<9RH$8&~D570v`gJ~9uioOk z6@u~(o(H`xl0~5hBd;_pmB10_CJ0A#l8;-Qi%CihORbywhVG`*l^7#VV2sFk(kKj! z{19yi`W;fgLbzDY&uQR%O~%{}%elYgccYj*Oh@vljVx*-%aSgL9+aXRc_xI^D<47a zCZU!+jQfq(*ZGjZNVYlKfoK|}i;`EsUD?AQk|eU#3!KVU3A0gYcCco48<{=JtIt_0 z0Z*J$#~O_PR6GSS4eyJ(`~hvry+dx zFJuFw6(7l=k$TmW>hYxKPZA1Zs5$q$d|oa9x~>otGgDhZ%PyvAByaNbe=l+&RG){c zn5xm-+^WTgz#niuIOs~`#neugEs)cl#8fnZ1%m6m6J8zzeumdH<;u7I7B7(Iy2o=;dBH)`tW;W6tOdk!EIg(yeHnlsz! z?)-vu@eODxqMx{r+Dv-&eoq?1UE1AynDi*&6EKK*A=3FC(t&?cr8Gz6X8wR@&m=?b zU6@&kD~e8z;s!)MlSsHLf~g5aDSzVXIZ>h+WR*3MKayA!I?FhJq_>#nqwU#GMH!2f zl=RY068#X5O1WxNwh^K)LsaDA1zc%W&~(~`n=6Z(tCK3JrO}0@6_OjuC$_oAP*Sxp z{06`7rNXzn&!EY(u9c#x(ELB$%BTC(KpaO~+-ImQ3|D<)*5kko4gTQ$w-2R566a(2 z!L7KOU{0zS9S>Agcltonj$W3O^Ye?Tt@UMF-TsoMr zlWN`o4&YZgc<2$-X>vMNp9CPevK-{&d3gV$9pOx)ouBOU`MqK_cC=1gu4 zz4ps_=$k(Y7>dphejOv6(?H_X#kFT=iwr;6hfD(UTwrp6Z;~k_eDJfA?>^?I&XcVZZ|e9vJYzfCmOVFyMg!4-9xC?4$2L`~6d?N3###bGhr(?r%}tv(KK|_08P< zKX~t(-#Yd5?yFpEs2fg5()JTBzYqH;G@u;iZ0M3mI1vmdVctb~Xi6UwJFA`rQWJ_?p13SFI^>u3tqNmyp6aL5f^Rn!Sl(pL7QVJW3!^Mh=11f zTHX>^j16U*eb^!6c6{oB_`-j@SeP*A>b;<&@u__&pFaTl?yLDcy;?j2dIogjFZ21~ zcQyI;kpw z-Jr)6T`v*`M*jT;WQO3G>p7FmCr0_sApTv%^F6SP{H-+nKNjs`Jf2QhLeB8dpev31 z&qMr`cyMmY-&P|Fl2eoe$jY|~N9O095VtDVySVDn*azVi* z6CNU1)+X~qzn-T+zjLK9Oc3n2D1sDYm3&q$_D!ak{nF4_DR-Wv<0UP_n@kD{uOB6N zRSp_&DbSzpQc&q#B3NTTY`ppA(-q}MyoTj`Ru&jPp5VMJF2j$HIA1Q~@e^pyt8z&5 z|6@e$18y}~;Sxxtq*apENE(&2QPNgP_et6&X-3ixNjoL&mQ-!3Q#zUP;F7dLQv9Zc zhbl>HB#lbiC~2#t`y_3XG$Uz;q@9v>OR6?0EuA9Mm$X9CN=d6Et&ub;X``gAlJ1kV zP11~{9g=oR+AS%YD$*^L)Fo+!q?M9ZNm?UmRMJLCTP58mX`7@ONjoI%l(bt?KA}ez zN~g*4OIjgmrKDAo)<_zav{BMlNrjdF#qX#{3-=KZ%a<&<$~B{Ub26Mrx@ONVpI2Tn zb9R!mvvSdi+}h9L z$AIWt%UG$*Kcz=u2|f<2o>c$HL4183AF`wRZH3>83kMrx^tTG%gNs7>|2rG}dp7v9 zHuyi=;J>iJe{F-GvcY?8a0eV!s9bjSbv_~-SYhw4hCxdxWM@3&i&%*KBTB{elFs8|NWR}0C!n44}K}|Q3dduZS33a&rSOZ7xK?T+%QGF8#~Q5_}|#zj{~Q2S@#z|WF!AF@Iv?FuWaN$ zw88T>IQ{CJ_U*Rr&wUxk``_>`n|i$3Mt+SA?vv?S_jliFBY(G)x9F%zi4CUO(}2PC;nX<`Cc1*B-S;B`n}0E_&OW>N*jD7aO!8Q`^VpCBk#At z@36t|wZR{}%=;)!HkUAdq2ZIka!guK|nJRG3S&TAvy zEe(;)*mJ!WuV%1|cXAuU3$JKHAc0p-6@?{e^ZcM!>`5O8C-6q6E{1*7y|u|uXggFi z&I`$eNmRVm<2l-#+yW|IyFn0}r27L=WCI{qlUulh#rq@dm`>8z6CLS9aV1^|VuyLY zi@H~AtsaXb#@I(5Z^#-5@Oqc6TfExsb+1`U#|BXLsbukp)MDPHUsR8#n-QL!yx6>v|m3qN9ViyS85xU%gygA zwe8Gl<9UOptzOniOrU3z zzZW#A(N_H?puoWc=H2r7X8k4=zH_|^;fDm6kir}Pi%t8@g0!2z8KLd;#TNP|TpVIx zg6wv@mmB7rWYwnmCQ!adHDO{`e-p%Cc$$y`hYaX7Ld^#G#oeM;hknXM--!;mt;7)q zavy(FI&?IE3E*4)n-FpEf_5we*|9V=~!IGjOG3k_XQrT@Ve#+eL- zjKMej7zq7H4SE}GlI=TkLLLZViZxDuFro4lxq;1{*LNg@0aDq;>w6O<&-~!0V3;Db z11L2MdlCegal;!P>zuoLYt8B>&QQa{*5w`e*m#n7HBPv0;A?i+q)iV0%nI8-I!+YFkB z30kkN@N1Po`Id0996w$_W#A-{as%3&#DOITCPetnyPw!F` zuimF9+9>rY|0JXGFJX2YF37ghSMPTeRquCH`buAw|1PP2y)>xa7b&XVFOfd}p43QR z>9+tQpI{jwg3CnPeK2P3qAkp{iCAly`+-2xP$#r z>Z|%^RZ>#YLq>$aRsAb_&sg-;b6!OsRDzOP(?4d>-#|AMf}-pHgY;j4EWLA}dys;9 z->S}~wdPmxioOM%5`2`tdf!k_aQ@VSLv(g-|C#vUqjmV`4_S1J8?m_RQl?9d})o4s1U^XR_Q9> zkGP=pt#V5LOG;2u=?<<#5b>5Ga>>dXPFN{*&Ir^GU|Sr+f2#kW_s%NsxHN*QhfW$? Xw4l;g5Uu?S=~u*s#9)hpg=PN^_Ykh# diff --git a/src/execve_interceptor.c b/src/execve_interceptor.c index 1503682..291ad3a 100644 --- a/src/execve_interceptor.c +++ b/src/execve_interceptor.c @@ -21,10 +21,26 @@ int shm_id = -1; time_t last_modified_time = 0; // int is_initialized = 0; +#ifdef HOOK // Original pointer orig_execve_type orig_execve = NULL; +#endif +#ifdef HOOK +/** + * 拦截系统调用execve, + * 在真实调用直接检查配置和创建输出 + */ int execve(const char *filename, char *const argv[], char *const envp[]) { +#else +/** + * 在真实系统调用之前可以调用这个函数, + * 主进程会做出和直接调用execve一样的逻辑, + * 在此之前检查配置和创建输出 + */ +int pre_hook(const char *filename, char *const argv[], char *const envp[]) { + (void)envp; +#endif // 去除首尾空格 while (*filename && isspace(*filename)) { filename++; @@ -42,6 +58,12 @@ int execve(const char *filename, char *const argv[], char *const envp[]) { // if (!is_initialized) { // initialize(); // } + +#ifdef HOOK +#endif + +#ifdef HOOK + DEBUG_LOG("Intercepted execve for: %s", filename); DEBUG_LOG("argv[0] = %s", argv[0]); @@ -50,29 +72,42 @@ int execve(const char *filename, char *const argv[], char *const envp[]) { fprintf(stderr, "Error in dlsym(\"execve\"): %s\n", dlerror()); exit(EXIT_FAILURE); } +#endif // Load configuration (only if needed) load_config_if_needed(); +#ifdef HOOK // Intercept only when execve is called from a shell terminal if (!is_terminal_shell()) { DEBUG_LOG("Not a terminal shell, bypassing interception."); return orig_execve(filename, argv, envp); } +#endif // Current configuration information DEBUG_LOG("Current Config rule count : %d", shared_config->rule_count); // If shared memory was not successfully loaded, execute directly if (shared_config == NULL) { DEBUG_LOG("Shared memory not initialized, bypassing interception."); + // 这里也是直接执行就行 +#ifdef HOOK return orig_execve(filename, argv, envp); +#else + return 0; +#endif } // If the feature is disabled, execute directly if (!shared_config->enabled) { DEBUG_LOG("Not enabled."); + // 这里直接执行就行 +#ifdef HOOK return orig_execve(filename, argv, envp); +#else + return 0; +#endif } write_log(filename, argv); @@ -85,7 +120,12 @@ int execve(const char *filename, char *const argv[], char *const envp[]) { // Special handling for commands executed via shell.posix // Execute directly, without rule matching and output redirection if (argv[1] != NULL && strcmp(argv[1], "shell.posix") == 0) { + // 直接执行 +#ifdef HOOK return orig_execve(filename, argv, envp); +#else + return 0; +#endif } for (int i = 0; i < shared_config->rule_count; i++) { @@ -97,7 +137,13 @@ int execve(const char *filename, char *const argv[], char *const envp[]) { if (strcmp(shared_config->rules[i].type, "skip") == 0) { DEBUG_LOG(ANSI_COLOR_BLUE "[Skip] %s" ANSI_COLOR_RESET "\n", shared_config->rules[i].msg); +// 直接执行 +#ifdef HOOK return orig_execve(filename, argv, envp); +#else + return 0; +#endif + } else if (strcmp(shared_config->rules[i].type, "warn") == 0) { printf(ANSI_COLOR_YELLOW "[Warning] %s\n" ANSI_COLOR_RESET, shared_config->rules[i].msg); @@ -122,6 +168,8 @@ int execve(const char *filename, char *const argv[], char *const envp[]) { // Duplicate stdout and stderr to the log file dupIO(); +#ifdef HOOK + // 移除LD_PRELOAD // 计算原环境变量数量 @@ -149,4 +197,7 @@ int execve(const char *filename, char *const argv[], char *const envp[]) { new_envp[i] = NULL; return orig_execve(filename, argv, new_envp); +#else + return 0; +#endif } \ No newline at end of file diff --git a/src/execve_interceptor.h b/src/execve_interceptor.h index 5225ee1..a20a2c7 100644 --- a/src/execve_interceptor.h +++ b/src/execve_interceptor.h @@ -3,6 +3,7 @@ #include "exec_hook.h" +#ifdef HOOK // Original execve type typedef int (*orig_execve_type)(const char *filename, char *const argv[], char *const envp[]); @@ -11,4 +12,6 @@ extern orig_execve_type orig_execve; int execve(const char *filename, char *const argv[], char *const envp[]); +#endif + #endif // EXECVE_INTERCEPTOR_H \ No newline at end of file