Skip to content

ilammy/ftrace-hook

master
Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?
Code

Latest commit

 

Git stats

Files

Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
 
 
 
 
 
 
 
 

ftrace-hook

Linux kernel module demonstrating usage of ftrace framework for function hooking: as in executing arbitrary code around the hooked function.

The code is licensed under GPLv2.

How to build

Please consider using a virtual machine (VirtulBox, VMWare, QEMU, etc.) for experiments. The (unchanged) module is totally harmless and should not affect your system stability. But just in case: you are loading it at your own risk. Don't kill your own machine or production environment by accident.

Make sure you have installed GCC and Linux kernel headers for your kernel. For Debian-based systems:

$ sudo apt install build-essential linux-headers-$(uname -r)

Build the kernel module:

$ cd ftrace-hook
$ make
make -C /lib/modules/4.9.0-5-amd64/build M=/home/ilammy/dev/ftrace-hook modules
make[1]: Entering directory '/usr/src/linux-headers-4.9.0-5-amd64'
  CC [M]  /home/ilammy/dev/ftrace-hook/ftrace_hook.o
  Building modules, stage 2.
  MODPOST 1 modules
  CC      /home/ilammy/dev/ftrace-hook/ftrace_hook.mod.o
  LD [M]  /home/ilammy/dev/ftrace-hook/ftrace_hook.ko
make[1]: Leaving directory '/usr/src/linux-headers-4.9.0-5-amd64'

This should build the module for the kernel you are currently running. You can load it into your system, experiment, and unload the module like this:

$ sudo insmod ftrace_hook.ko

$ ls -l
total 736
-rw-r--r-- 1 ilammy ilammy   6765 Jun  3 11:22 ftrace_hook.c
-rw-r--r-- 1 ilammy ilammy 349152 Jun  3 15:27 ftrace_hook.ko
-rw-r--r-- 1 ilammy ilammy   1245 Jun  3 15:27 ftrace_hook.mod.c
-rw-r--r-- 1 ilammy ilammy 144600 Jun  3 15:27 ftrace_hook.mod.o
-rw-r--r-- 1 ilammy ilammy 208360 Jun  3 15:27 ftrace_hook.o
-rw-r--r-- 1 ilammy ilammy  18092 Jun  3 09:34 LICENSE
-rw-r--r-- 1 ilammy ilammy    170 Jun  3 09:34 Makefile
-rw-r--r-- 1 ilammy ilammy     51 Jun  3 15:27 modules.order
-rw-r--r-- 1 ilammy ilammy      0 Jun  3 15:27 Module.symvers
-rw-r--r-- 1 ilammy ilammy   1081 Jun  3 15:26 README.rst

$ sudo rmmod ftrace_hook

Kernel logs can be viewed like this:

$ sudo dmesg --follow
[  239.217934] ftrace_hook: module loaded
[  242.531043] ftrace_hook: clone() before
[  242.531253] ftrace_hook: clone() after: 2674
[  242.531665] ftrace_hook: execve() before: /bin/ls
[  242.532150] ftrace_hook: execve() after: 0
[  257.522832] ftrace_hook: clone() before
[  257.523087] ftrace_hook: clone() after: 2675
[  257.523522] ftrace_hook: execve() before: /usr/bin/sudo
[  257.524002] ftrace_hook: execve() after: 0
[  257.531963] ftrace_hook: clone() before
[  257.532194] ftrace_hook: clone() after: 2676
[  257.533332] ftrace_hook: execve() before: /sbin/rmmod
[  257.533714] ftrace_hook: execve() after: 0
[  257.560086] ftrace_hook: module unloaded