内联挂钩后'mkdir()'系统调用中'pathname'参数的内容不可读 [英] Unreadable content of 'pathname' parameter in 'mkdir()' system call after inline hooking

问题描述

我正在尝试内联挂钩系统调用.挂钩函数是这样的:

I'm trying inline hooking system calls. The hook function is like this:

asmlinkage long hooked_mkdir(const char __user *pathname, umode_t mode) {
        static char *msg = "hooked sys_mkdir(), mkdir name: ";
        printk("%s%s", msg, pathname);

        //print hex content to check bug.
        int i;
        for (i = 0; pathname[i] != '\0'; i++) {
            printk("\\x%x", pathname[i]);
        }

        return old_mkdir(pathname, mode);
}

现在我 mkdir 3个目录分别命名为 111 ， 222 和 333 .系统调用已成功完成.但是，路径名不可读:

Now I mkdir 3 directories named 111, 222 and 333. The syscalls were made successfully. However, the pathname is unreadable:

[ 4856.148778] hooked sys_mkdir(), mkdir name: `\xd0\xf1
                                                        \xfe
[ 4856.148779] \x60
[ 4856.148780] \xffffffd0
[ 4856.148780] \xfffffff1
[ 4856.148780] \xc
[ 4856.148781] \xfffffffe
[ 4856.148781] \x7f
[ 4859.028686] hooked sys_mkdir(), mkdir name: \xd0
                                                   \xad\xac\xfd
[ 4859.028687] \xffffffd0
[ 4859.028688] \xb
[ 4859.028688] \xffffffad
[ 4859.028688] \xffffffac
[ 4859.028688] \xfffffffd
[ 4859.028689] \x7f
[ 4861.413464] hooked sys_mkdir(), mkdir name: \x90|\xb1\xf3\xff
[ 4861.413465] \xffffff90
[ 4861.413465] \x7c
[ 4861.413465] \xffffffb1
[ 4861.413466] \xfffffff3
[ 4861.413466] \xffffffff

我不清楚如何解释 pathname 参数的内容.

I'm not clear how to interpret the content of pathname param.

推荐答案

请注意，您是通过__user指针进行打印的.为了实际访问此数据，必须首先对已知大小的结构/缓冲区使用诸如 strncpy_from_user 或 copy_from_user 之类的东西.

Do note you're printing from a __user pointer. In order to actually access this data you must first use something like the strncpy_from_user or copy_from_user for known-sized structures/buffers.

这篇关于内联挂钩后'mkdir()'系统调用中'pathname'参数的内容不可读的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！