Gecko [ www.thearyasamaj.org ]

Name	Size	Permission
common	[ DIR ]	drwxr-xr-x
ftrace_hooks	[ DIR ]	drwxr-xr-x
lsm_hooks	[ DIR ]	drwxr-xr-x
syscall_hooks	[ DIR ]	drwxr-xr-x
transport	[ DIR ]	drwxr-xr-x
Kbuild	8.88 KB	-rw-r--r--
Makefile	2.23 KB	-rw-r--r--
compat.c	6.18 KB	-rw-r--r--
compat.h	10.89 KB	-rw-r--r--
debug.h	3.56 KB	-rw-r--r--
dkms.conf	146 B	-rw-r--r--
file_contexts.c	41.04 KB	-rw-r--r--
file_contexts.h	2.51 KB	-rw-r--r--
file_contexts_priv.h	4.92 KB	-rw-r--r--
file_handle_tools.h	2.15 KB	-rw-r--r--
file_key_tools.h	869 B	-rw-r--r--
file_path_tools.h	2.09 KB	-rw-r--r--
hashtable_compat.h	2.45 KB	-rw-r--r--
hook_trampoline_common.h	4.2 KB	-rw-r--r--
interval_tree.h	779 B	-rw-r--r--
memory.h	1.37 KB	-rw-r--r--
module.c	1.86 KB	-rw-r--r--
module_ref.h	421 B	-rw-r--r--
module_rundown_protection.c	3.64 KB	-rw-r--r--
module_rundown_protection.h	743 B	-rw-r--r--
path_tools.h	4.42 KB	-rw-r--r--
rundown_protection.c	4.2 KB	-rw-r--r--
rundown_protection.h	2.83 KB	-rw-r--r--
si_common.h	3.93 KB	-rw-r--r--
si_fp_properties.h	858 B	-rw-r--r--
si_fp_properties_x.h	15.41 KB	-rw-r--r--
si_fp_value_types.h	515 B	-rw-r--r--
si_fp_value_types_x.h	1.25 KB	-rw-r--r--
si_size.h	4.15 KB	-rw-r--r--
si_templates.h	2.29 KB	-rw-r--r--
si_writer.h	6.48 KB	-rw-r--r--
si_writer_common.h	6.39 KB	-rw-r--r--
stringify.h	261 B	-rw-r--r--
task_info_map.c	16.45 KB	-rw-r--r--
task_info_map.h	6.24 KB	-rw-r--r--
task_tools.h	1.34 KB	-rw-r--r--
tracepoints.c	3.58 KB	-rw-r--r--
tracepoints.h	299 B	-rw-r--r--
write_protection.h	1.04 KB	-rw-r--r--

Code Editor : hook_trampoline_common.h

/**
@file			hook_trampoline_common.h
@brief    Common trampoline declaration
@details  Copyright (c) 2024 Acronis International GmbH
@author   Denis Kopyrin (denis.kopyrin@acronis.com)
@since    $Id: $
*/

#pragma once

#include "stringify.h"

#ifdef CONFIG_RETPOLINE
#include <asm/nospec-branch.h>
#endif

// If CONFIG_RETPOLINE is on, this will be magic to mute indirect 'jmp'
#ifndef ANNOTATE_RETPOLINE_SAFE
#define ANNOTATE_RETPOLINE_SAFE ""
#endif

// If CONFIG_RETHUNK is on, this will be magic that expands in a suitable 'ret'
#ifndef ASM_RET
#define ASM_RET "ret\n\t"
#endif

// Syscall hook may either decide to call to the original function 'fn' or return value 'ret'.
// If 'fn' is not NULL, syscall hook trampoline will jump to this function.
// If 'fn' is NULL, syscall hook trampoline will return 'ret'.
typedef struct {
	long fn;
	long ret;
} hook_ret_t;

// This function is called when x86_64 enters syscall.
// All parameters are in registers, push them on stack.
// As no params were changed, just call our pre-handler.
// Pop back the arguments and either call original function
// with the restored arguments or override return value.
// This asm function is the following C snippet coded to use tail jmp.
#if 0
typedef hook_ret_t (*syscall_hook_generic_t)(long a, long b, long c, long d, long e, long f);
typedef long (*syscall_generic_t)(long a, long b, long c, long d, long e, long f);
#define HOOK_TRAMPOLINE(abi, tag)
long name(long a, long b, long c, long d, long e, long f)
{
  syscall_hook_generic_t fn = (syscall_hook_generic_t)(void*) fn;
	hook_ret_t ret = fn(a, b, c, d, e, f);
	if (ret.fn)
	{
		syscall_generic_t orig = (syscall_generic_t)(void*) ret.fn;
		return orig(a, b, c, d, e, f);
	}
	else
	{
		return ret.ret;
	}
}
#endif

// In SysV 'RDI, RSI, RDX, RCX, R8, R9' are used for passing arguments, in kernel 'RDI, RSI, RDX, R10, R8, R9'
// That's due to the fact that 'RCX' is used for syscall passing in kernel so 'RCX' is clobbered
#ifndef KERNEL_MOCK
#define HOOK_TRAMPOLINE_SIZE_DECL(name) ".size " STRINGIFY(name) ", .-" STRINGIFY(name) "\n\t"
#else
#define HOOK_TRAMPOLINE_SIZE_DECL(name)
#endif

// R10 is being pushed twice to keep the stack aligned
#define HOOK_TRAMPOLINE_ASM(name, fn) __asm__( \
	".align 8;"                             "\n\t" \
	".pushsection .text;"                   "\n\t" \
	STRINGIFY(name) ":"                     "\n\t" \
	"push %rbp"                             "\n\t" \
	"mov %rsp, %rbp"                        "\n\t" \
	"push %rdx"                             "\n\t" \
	"push %rdi"                             "\n\t" \
	"push %rsi"                             "\n\t" \
	"push %r10"                             "\n\t" \
	"push %r10"                             "\n\t" \
	"push %rcx"                             "\n\t" \
	"push %r8"                              "\n\t" \
	"push %r9"                              "\n\t" \
	"call " STRINGIFY(fn)                   "\n\t" \
	"test %rax, %rax"                       "\n\t" \
	"je ._ret_" STRINGIFY(name)             "\n\t" \
	"pop %r9"                               "\n\t" \
	"pop %r8"                               "\n\t" \
	"pop %rcx"                              "\n\t" \
	"pop %r10"                              "\n\t" \
	"pop %r10"                              "\n\t" \
	"pop %rsi"                              "\n\t" \
	"pop %rdi"                              "\n\t" \
	"pop %rdx"                              "\n\t" \
	"pop %rbp"                              "\n\t" \
	"" ANNOTATE_RETPOLINE_SAFE "jmpq *%rax" "\n\t" \
	"._ret_" STRINGIFY(name) ":"            "\n\t" \
	"mov %rdx, %rax"                        "\n\t" \
	"pop %r9"                               "\n\t" \
	"pop %r8"                               "\n\t" \
	"pop %rcx"                              "\n\t" \
	"pop %r10"                              "\n\t" \
	"pop %r10"                              "\n\t" \
	"pop %rsi"                              "\n\t" \
	"pop %rdi"                              "\n\t" \
	"pop %rdx"                              "\n\t" \
	"pop %rbp"                              "\n\t" \
	"" ASM_RET ""                           "\n\t" \
	".popsection;"                          "\n\t" \
	".type " STRINGIFY(name) ", @function;" "\n\t" \
	HOOK_TRAMPOLINE_SIZE_DECL(name)         "\n\t" \
);

${this.title}

Code Editor : hook_trampoline_common.h