Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

file operation function #1

Closed
jhong3842 opened this issue Jun 4, 2017 · 2 comments
Closed

file operation function #1

jhong3842 opened this issue Jun 4, 2017 · 2 comments

Comments

@jhong3842
Copy link

jhong3842 commented Jun 4, 2017

Hi
I'm a student to study rootkit
i have a question
after file operation hooking, i am not find root_iterate or root_xxxx function content
because i am making rootkit for study..
after inline function hooking, origin function in root_xxxx is error... --> my code..
please teach me..

i am testing in kernel 3.19

@nurupo
Copy link
Owner

nurupo commented Jun 4, 2017

The original_*_filldir, *_iterate and *_readdir functions (e.g. root_iterate) are defined using these macros.

@nurupo
Copy link
Owner

nurupo commented Jun 14, 2017

Closing the issue due to no replies for longer than 1 week.

Hopefully you figured out the issue you were having. Sorry for the macros, I know they can make symbol searching hard. I'd advise you to tell gcc to generate a .c file with all macros preprocessed/expanded, that might be easier to deal with.

@nurupo nurupo closed this as completed Jun 14, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants