Continue

3 files changed, 33 insertions, 16 deletions

diff --git a/fs-tracer-ebpf/src/main.rs b/fs-tracer-ebpf/src/main.rs
index 7960f4e..206fc3b 100644
--- a/fs-tracer-ebpf/src/main.rs
+++ b/fs-tracer-ebpf/src/main.rs
@@ -52,7 +52,7 @@ pub fn fs_tracer_enter(ctx: TracePointContext) -> u32 {
 
 #[tracepoint]
 pub fn fs_tracer_exit(ctx: TracePointContext) -> u32 {
-    info!(&ctx, "Hi");
+    //info!(&ctx, "Hi");
     match try_fs_tracer(ctx, SyscallType::Exit) {
         Ok(ret) => ret,
         Err(ret) => ret,
diff --git a/fs-tracer-ebpf/src/syscalls/open.rs b/fs-tracer-ebpf/src/syscalls/open.rs
index f33a302..4b55400 100644
--- a/fs-tracer-ebpf/src/syscalls/open.rs
+++ b/fs-tracer-ebpf/src/syscalls/open.rs
@@ -1,8 +1,9 @@
-#![feature(ptr_metadata)]
 
-use aya_bpf::helpers::{bpf_d_path, bpf_probe_read};
+use core::{mem, ptr};
 
-use crate::*;
+use aya_bpf::{helpers::{bpf_d_path, bpf_probe_read, bpf_probe_read_kernel, gen}, cty::c_void};
+
+use crate::{*, vmlinux::files_struct};
 
 pub fn handle_sys_open(ctx: TracePointContext, syscall_type: SyscallType) -> Result<u32, u32> {
     //info!(&ctx, "called");
@@ -19,7 +20,7 @@ unsafe fn handle_sys_open_enter(ctx: TracePointContext) -> Result<u32, u32> {
     let uwu = (*pid).pwd;
     let ra = uwu.dentry as *const dentry;
     let ma = str::from_utf8_unchecked(&(*ra).d_iname);
-    let mut buf = [0u8; 120];
+    let mut buf = [0u8; 12];
     #[derive(Clone, Copy)]
     struct OpenAtSyscallArgs {
         dfd: i64,
@@ -33,22 +34,38 @@ unsafe fn handle_sys_open_enter(ctx: TracePointContext) -> Result<u32, u32> {
     let args = *ptr_at::<OpenAtSyscallArgs>(&ctx, 16).unwrap_unchecked();
 
     if args.dfd == -100 {
-        info!(&ctx, "wat")
-    } else {
-        info!(&ctx, "not relative {}", args.dfd);
-        let files = (*x).files;
+        info!(&ctx, "relative call!");
+    }
+    else {
+        info!(&ctx, "not relative call!");
+          /*   let files = (*x).files;
         let fdt = (*files).fdt;
-        let fdd = (*fdt).fd;
-        let file = (*fdd).add(args.dfd as usize * 8);
-        let pat = (*file).f_path;
-        let pathname = pat.dentry;
+        let fdd = (*fdt).fd;*/
+        info!(&ctx, "pid from ctx: {}", ctx.pid());
+        info!(&ctx, "pid from task {}", (*x).pid);
+        //let x_addr = &x as *const _ as usize;
+        //info!(&ctx, "x_addr: {}", x_addr);
+        let good_files = bpf_probe_read_kernel(&(*x).files).unwrap_unchecked();
+        info!(&ctx, "test: {}", (*good_files).next_fd)
+        /*let file = (*fdd).add(args.dfd as usize * 8);
+        let mut pat = (*file).f_path;
+        //info!(&ctx, "path: {}", &pat)
+        let aya_bpf_path_ptr: *mut aya_bpf::bindings::path = unsafe {
+            mem::transmute::<&mut vmlinux::path, *mut aya_bpf::bindings::path>(&mut pat)
+        };
+
+        let mut buff = [0i8; 120];
+    bpf_d_path( aya_bpf_path_ptr , &mut buff as *mut i8, 120);*/
+
+        /*let pathname = pat.dentry;
         let mut huh = [0u8; 64];
         let xxxx = (*pathname).d_name.name;
         let aa = core::slice::from_raw_parts(xxxx, 10);
-        info!(&ctx, "dawdwa: {}", str::from_utf8_unchecked(aa))
+        info!(&ctx, "dawdwa: {}", str::from_utf8_unchecked(aa))*/
         //let filename = bpf_probe_read_kernel_str_bytes(xxxx.name, &mut huh);
     }
 
+
     let _ = bpf_probe_read_user_str_bytes(args.filename, &mut buf);
     let xd = &buf;
     info!(
@@ -63,7 +80,7 @@ unsafe fn handle_sys_open_enter(ctx: TracePointContext) -> Result<u32, u32> {
 }
 
 unsafe fn handle_sys_open_exit(ctx: TracePointContext) -> Result<u32, u32> {
-    info!(&ctx, "handle_sys_open_exit start");
+    //info!(&ctx, "handle_sys_open_exit start");
     let ret = *ptr_at::<i64>(&ctx, 16).unwrap_unchecked(); //TODO: We cant use unwrap, thats why we couldnt use the aya helper fns
 
     let tgid = ctx.tgid();
diff --git a/fs-tracer/src/main.rs b/fs-tracer/src/main.rs
index 7dfd44a..414a68b 100644
--- a/fs-tracer/src/main.rs
+++ b/fs-tracer/src/main.rs
@@ -49,7 +49,7 @@ async fn main() -> Result<(), anyhow::Error> {
 
     let trace_exits_program: &mut TracePoint = bpf.program_mut("fs_tracer_exit").unwrap().try_into()?;
     trace_exits_program.load()?;
-    trace_exits_program.attach("syscalls", "sys_exit_open")?;
+    trace_exits_program.attach("syscalls", "sys_exit_openat")?;
     //program2.attach("syscalls", "sys_exit_write")?;
 
     println!("Num of cpus: {}", online_cpus()?.len());