Linux内核跟踪：ftrace hook入门手册（上）

#ifndef LIB_FTRACE_HOOK#define LIB_FTRACE_HOOK
#include <linux/version.h>#include <linux/ftrace.h>#include <linux/kprobes.h>#include <linux/kallsyms.h>#include <asm/unwind.h>
//关于系统调用符号解析的版本差异处理#if LINUX_VERSION_CODE>=KERNEL_VERSION(5,7,0)static size_t kallsyms_lookup_name(const char *name){    struct kprobe kp = { .symbol_name = name };    size_t retval;
    if (register_kprobe(&kp) < 0)        return 0;    retval = (size_t)kp.addr;    unregister_kprobe(&kp);    return retval;}#endif
//关于ftrace框架的版本差异处理#if LINUX_VERSION_CODE<KERNEL_VERSION(5,11,0)#define FTRACE_OPS_FL_RECURSION 0#define ftrace_regs pt_regsstatic __always_inline struct pt_regs *ftrace_get_regs(struct ftrace_regs *fregs){    return fregs;}#endif
//关于系统调用函数签名的版本差异处理#if defined(CONFIG_X86_64)&&(LINUX_VERSION_CODE>=KERNEL_VERSION(4,17,0))#define PTREGS_SYSCALL_STUBS 1#define SYSCALL_NAME(name) ("__x64_" name)#else#define PTREGS_SYSCALL_STUBS 0#define SYSCALL_NAME(name) (name)#endif
//关于ret指令机器码的架构差异处理#if defined(CONFIG_X86_64)||defined(CONFIG_X86_32)#define RET_CODE 0xC3#else#error Unsupported architecture config?#endif
struct FTraceHook;struct FTraceHookContext;
struct FTraceHook{    const char *Symbol;    bool (*Handler)(struct FTraceHookContext *);    size_t SysCallEntry;    struct ftrace_ops FTraceOPS;};struct FTraceHookContext{    struct FTraceHook *const Hook;    struct pt_regs *const KernelRegisters;    struct pt_regs *const UserRegisters;    size_t *const SysCallNR;    const size_t *const Arguments[6];    size_t *const ReturnValue;};
#define FTRACE_HOOK(_symbol,_handler) {.Symbol=SYSCALL_NAME(_symbol),.Handler=(_handler)}
struct pt_regs *GetUserRegisters(struct task_struct *task);size_t FTraceHookCallOriginal(struct FTraceHookContext *context);int FTraceHookInstall(struct FTraceHook *hook);int FTraceHookUninstall(struct FTraceHook *hook);int FTraceHookInitialize(struct FTraceHook *hooks, size_t hooks_size);int FTraceHookFinalize(struct FTraceHook *hooks, size_t hooks_size);
#endif

#include "FTraceHook.h"
static size_t RET_ADDRESS;
//获取用户线程原本的寄存器保存位置struct pt_regs *GetUserRegisters(struct task_struct *task){    //用户线程原本的寄存器保存在内核栈地址最高处，为pt_regs结构体    //实际上，我们只是想要unwind_state里面的stack_info，但有些编译环境中不知为何会报错：ERROR: modpost: "get_stack_info" undefined!，有知情的读者还请不吝赐教，非常感谢    struct unwind_state state;    task = task ? : current;    unwind_start(&state, task, NULL, NULL);    return (struct pt_regs *)(((size_t)state.stack_info.end) - sizeof(struct pt_regs));}
//代理调用原始函数size_t FTraceHookCallOriginal(struct FTraceHookContext *context){#if PTREGS_SYSCALL_STUBS    return ((asmlinkage size_t (*)(struct pt_regs *)) context->Hook->SysCallEntry)(context->UserRegisters);#else    //asmlinkage的参数，传多了似乎没什么影响，有switch的功夫还不如多push几个参数咧    return ((asmlinkage size_t (*)(size_t, size_t, size_t, size_t, size_t, size_t)) context->Hook->SysCallEntry)(*context->Arguments[0], *context->Arguments[1], *context->Arguments[2], *context->Arguments[3], *context->Arguments[4], *context->Arguments[5]);#endif}
static void notrace FTraceHookHandler(size_t ip, size_t parent_ip, struct ftrace_ops *ops, struct ftrace_regs *fregs){    struct pt_regs *kernel_regs = ftrace_get_regs(fregs);    struct pt_regs *user_regs = GetUserRegisters(NULL);#if PTREGS_SYSCALL_STUBS#define argument_regs user_regs#else#define argument_regs kernel_regs#endif#if defined(CONFIG_X86_64)#define INSTRUCTION_POINTER kernel_regs->ip    struct FTraceHookContext context =    {        .Hook = container_of(ops, struct FTraceHook, FTraceOPS),        .KernelRegisters = kernel_regs,        .UserRegisters = user_regs,        .SysCallNR = &argument_regs->ax,        .Arguments =        {            &argument_regs->di,            &argument_regs->si,            &argument_regs->dx,            &argument_regs->r10,            &argument_regs->r8,            &argument_regs->r9        },        .ReturnValue = &argument_regs->ax    };#elif defined(CONFIG_X86_32)#define INSTRUCTION_POINTER kernel_regs->ip    struct FTraceHookContext context =    {        .Hook = container_of(ops, struct FTraceHook, FTraceOPS),        .KernelRegisters = kernel_regs,        .UserRegisters = user_regs,        .SysCallNR = &argument_regs->ax,        .Arguments =        {            &argument_regs->bx,            &argument_regs->cx,            &argument_regs->dx,            &argument_regs->si,            &argument_regs->di,            &argument_regs->bp        },        .ReturnValue = &argument_regs->ax    };#else#error Unsupported architecture config?#endif    if (!context.Hook->Handler(&context)) //返回false则阻止原始函数执行（直接返回到原始函数的调用方），其余情况不需要特殊操作，任由ftrace框架恢复执行流程即可        INSTRUCTION_POINTER = RET_ADDRESS;}
int FTraceHookInstall(struct FTraceHook *hook){    int err;
    //使用kallsyms_lookup_name()在内核内存中查找地址。    hook->SysCallEntry = kallsyms_lookup_name(hook->Symbol);    if (!hook->SysCallEntry)    {        pr_err("[FTraceHook] Unresolved symbol: %sn", hook->Symbol);        return ENOENT;    }    //我们的hook子程并不是通过修改ip跳转过去的，可以使用ftrace自带的防递归，而且实测效率还不错    hook->FTraceOPS.func = FTraceHookHandler;    hook->FTraceOPS.flags = FTRACE_OPS_FL_SAVE_REGS | FTRACE_OPS_FL_IPMODIFY | FTRACE_OPS_FL_RECURSION;
    err = ftrace_set_filter_ip(&hook->FTraceOPS, hook->SysCallEntry, 0, 0);    if (err)    {        pr_err("[FTraceHook] ftrace_set_filter_ip() failed: %dn", err);        return err;    }
    err = register_ftrace_function(&hook->FTraceOPS);    if (err)    {        pr_err("[FTraceHook] register_ftrace_function() failed: %dn", err);        return err;    }
    pr_info("[FTraceHook] Installed hook '%s': %dn", hook->Symbol, err);    return err;}
int FTraceHookUninstall(struct FTraceHook *hook){    int err;
    //注意与安装过程相反的顺序    err = unregister_ftrace_function(&hook->FTraceOPS);    if (err)    {        pr_err("[FTraceHook] unregister_ftrace_function() failed: %dn", err);        return err;    }
    err = ftrace_set_filter_ip(&hook->FTraceOPS, hook->SysCallEntry, 1, 0);    if (err)    {        pr_err("[FTraceHook] ftrace_set_filter_ip() failed: %dn", err);        return err;    }
    pr_info("[FTraceHook] Uninstalled hook '%s': %dn", hook->Symbol, err);    return err;}
int FTraceHookInitialize(struct FTraceHook *hooks, size_t hooks_size){    int err = 0;    size_t i;
    //随便找一个ret指令的地址，基本上就用当前函数尾部的ret就好；如果求稳（比如担心当前函数内存在复杂的跳转等），可以另外定义一个空函数，注意避免选取内联函数    RET_ADDRESS = (size_t)FTraceHookInitialize;    while (* (unsigned char *) RET_ADDRESS != RET_CODE)        ++RET_ADDRESS;
    //安装钩子    for (i = 0; i < hooks_size && !err; ++i)        err = FTraceHookInstall(hooks + i);
    return err;}int FTraceHookFinalize(struct FTraceHook *hooks, size_t hooks_size){    int err = 0;    size_t i;
    for (i = 0; i < hooks_size; ++i)        err = FTraceHookUninstall(hooks + i);
    return err;}

#include <linux/kernel.h>#include <linux/module.h>
#include "FTraceHook.h"
MODULE_LICENSE("GPL");//使用ftrace的模块必须是GPL License，不然不能编译MODULE_VERSION("0.01");
static int ReturnSwitch = 0;static bool MySysExecve(struct FTraceHookContext *context){    char filename[256];//用kmalloc+kfree也是可以的，但栈容量允许的情况下，时间效率还是局部变量比较快        //输出第一个参数值    if (strncpy_from_user(filename, (char *)*context->Arguments[0], sizeof(filename)) >= 0)        pr_info("[FTraceHook] PID %u calling sys_execve: %sn", current->pid, filename);
    //轮流测试两种方法来恢复原系统调用流程    if (++ReturnSwitch % 2)    {        //模拟经典方案的机制，代理调用原始函数        *context->ReturnValue = FTraceHookCallOriginal(context);        pr_info("[FTraceHook] execve() return: %ldn", *context->ReturnValue);        return false;//中止系统调用    }    else    {        //优化方案的新机制，不重新push参数而直接恢复原系统调用流程，但此时无法获取原系统调用流程的返回值        return true;    }}
static struct FTraceHook GlobalHooks[] ={    FTRACE_HOOK("sys_execve", MySysExecve)};
static int __init Initialize(void){    int err = FTraceHookInitialize(GlobalHooks, ARRAY_SIZE(GlobalHooks));    if(err)        pr_err("[FTraceHook] Failed to initialize ftrace hooks...n");    return err;}static void __exit Finalize(void){    if(FTraceHookFinalize(GlobalHooks, ARRAY_SIZE(GlobalHooks)))        pr_err("[FTraceHook] Failed to finalize ftrace hooks...n");}
module_init(Initialize);module_exit(Finalize);

obj-m += FTraceHookExample.oFTraceHookExample-objs := Entry.o FTraceHook.o
all:    make -C /lib/modules/$(shell uname -r)/build M=$(PWD) modules
clean:    make -C /lib/modules/$(shell uname -r)/build M=$(PWD) clean