Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

* : Makefile shell running,with a unexcepted result: lost DKERNEL_LESS_5_2 on kernel 4.15 #129 #132

Merged
merged 1 commit into from
Jul 8, 2022
Merged

* : Makefile shell running,with a unexcepted result: lost DKERNEL_LESS_5_2 on kernel 4.15 #129 #132

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ nocore: ebpf_nocore assets build_nocore
@echo $(shell date)

.ONESHELL:
SHELL = /bin/sh
SHELL = /bin/bash

PARALLEL = $(shell $(CMD_GREP) -c ^processor /proc/cpuinfo)
MAKE = make
Expand Down
5 changes: 3 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@
## use ELF binary file
Download ELF zip file [release](https://github.com/ehids/ecapture/releases) , unzip and use by command `./ecapture --help`.

* Linux kernel version >= 4.18
* Linux kernel version >= 4.15 is required.
* Enable BTF [BPF Type Format (BTF)](https://www.kernel.org/doc/html/latest/bpf/btf.html) (Optional, 2022-04-17)

### check your server BTF config：
Expand Down Expand Up @@ -122,7 +122,8 @@ Probes: []*manager.Probe{
hook `/bin/bash` symbol name `readline`.

# How to compile
Linux Kernel: >= 4.18.

Linux Kernel: >= 4.15.

## Tools
* golang 1.16
Expand Down
5 changes: 3 additions & 2 deletions README_CN.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ eBPF HOOK uprobe实现的各种用户态进程的数据捕获，无需改动原
下载 [release](https://github.com/ehids/ecapture/releases) 的二进制包，可直接使用。

系统配置要求
* 系统linux kernel版本必须高于4.18。
* 系统linux kernel版本必须高于4.15。
* 开启BTF [BPF Type Format (BTF)](https://www.kernel.org/doc/html/latest/bpf/btf.html) 支持。 (可选, 2022-04-17)

### 验证方法：
Expand Down Expand Up @@ -135,8 +135,9 @@ Probes: []*manager.Probe{
hook了`/bin/bash`的`readline`函数。

# 编译方法

针对个别程序使用的openssl类库是静态编译，也可以自行修改源码实现。若函数名不在符号表里，也可以自行反编译找到函数的offset偏移地址，填写到`UprobeOffset`属性上，进行编译。
笔者环境`ubuntu 21.04`， Linux Kernel 4.18以上通用。
笔者环境`ubuntu 21.04`， Linux Kernel 4.15以上通用。
**推荐使用`UBUNTU 21.04`版本的Linux测试。**

## 工具链版本
Expand Down
2 changes: 1 addition & 1 deletion builder/Makefile.release
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -166,7 +166,7 @@ publish: \
.check_$(CMD_GITHUB)
#
# release it!
$(CMD_GITHUB) release create $(SNAPSHOT_VERSION) $(OUT_ARCHIVE) $(OUT_CHECKSUMS) --title "eCapture $(SNAPSHOT_VERSION) release (Linux x86_64/aarch64, Android kernel 4.18+)." --notes-file $(TAR_DIR)/release_notes.txt
$(CMD_GITHUB) release create $(SNAPSHOT_VERSION) $(OUT_ARCHIVE) $(OUT_CHECKSUMS) --title "eCapture $(SNAPSHOT_VERSION) release (Linux x86_64/aarch64, Android kernel 5.5+)." --notes-file $(TAR_DIR)/release_notes.txt

.PHONY: clean
clean:
Expand Down
3 changes: 2 additions & 1 deletion kern/bash_kern.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,7 +78,8 @@ int uretprobe_bash_retval(struct pt_regs *ctx) {

if (event_p) {
event_p->retval = retval;
bpf_map_update_elem(&events_t, &pid, event_p, BPF_ANY);
// bpf_map_update_elem(&events_t, &pid, event_p, BPF_ANY);
bpf_map_delete_elem(&events_t, &pid);
bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU, event_p,
sizeof(struct event));
}
Expand Down
4 changes: 2 additions & 2 deletions main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,8 +23,8 @@ func main() {
if err != nil {
log.Fatal(err)
}
if kv < kernel.VersionCode(4, 18, 0) {
log.Fatalf("Linux Kernel version %v is not supported. Need > 4.18 .", kv)
if kv < kernel.VersionCode(4, 15, 0) {
log.Fatalf("Linux Kernel version %v is not supported. Need > 4.15 .", kv)
}

enable, e := ebpf.IsEnableBPF()
Expand Down
1 change: 0 additions & 1 deletion user/iconfig.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,7 +76,6 @@ func (this *eConfig) EnableGlobalVar() bool {
return true
}
if kv < kernel.VersionCode(5, 2, 0) {
//log.Fatalf("Linux Kernel version %v is not supported. Need > 4.18 .", kv)
return false
}
return true
Expand Down