#include <stdio.h>
#include <string.h>

int main(int argc, char *argv[])
{
    if( strcmp(argv[1], "test") )
    {
        printf("Incorrect password\n");
    }
    else
    {
        printf("Correct password\n");
    }
    return 0;
}

#include <stdio.h>
#include <string.h>
#include <dlfcn.h>
/*
hook的目標是strcmp，所以typedef了一個STRCMP函數(shù)指針
hook的目的是要控制函數(shù)行為，從原庫libc.so.6中拿到strcmp指針，保存成old_strcmp以備調(diào)用
*/
typedef int(*STRCMP)(const char*, const char*);

int strcmp(const char *s1, const char *s2)
{
    static void *handle = NULL;
    static STRCMP old_strcmp = NULL;

    if( !handle )
    {
        handle = dlopen("libc.so.6", RTLD_LAZY);
        old_strcmp = (STRCMP)dlsym(handle, "strcmp");
    }
    printf("oops!!! hack function invoked. s1=<%s> s2=<%s>\n", s1, s2);
    return old_strcmp(s1, s2);
}

gcc -o test main.c 
gcc -fPIC -shared -o hook.so hook.c -ldl

LD_PRELOAD=./hook.so ./test 123

1. Hook函數(shù)的覆蓋完備性
對于Linux下的指令執(zhí)行來說，有7個Glibc API都可是實現(xiàn)指令執(zhí)行功能，對這些API對要進行Hook
/*
#include <unistd.h>
int execl(const char *pathname， const char *arg0， ... /* (char *)0 */ );
int execv(const char *pathname， char *const argv[]);
int execle(const char *pathname， const char *arg0， .../* (char *)0， char *const envp[] */ );
int execve(const char *pathname， char *const argv[]， char *const envp[]);
int execlp(const char *filename， const char *arg0， ... /* (char *)0 */ );
int execvp(const char *filename， char *const argv[]);
int fexecve(int fd， char *const argv[]， char *const envp[]);
http://www.2cto.com/os/201410/342362.html
*/

2. 當前系統(tǒng)中存在function hook的重名覆蓋問題
    1) /etc/ld.so.preload中填寫了多條.so加載條目
    2) 其他程序通過"export LD_PRELOAD=.."臨時指定了待加載so的路徑
在很多情況下，出于系統(tǒng)管理或者集群系統(tǒng)日志收集的目的，運維人員會向系統(tǒng)中注入.so文件，對特定function函數(shù)進行hook，這個時候，當我們注入的.so文件中的hook function和原有的hook function存在同名的情況，Linux會自動忽略之后載入了hook function，這種情況我們稱之為"共享對象全局符號介入"

3. 注入.so對特定function函數(shù)進行hook要保持原始業(yè)務(wù)的兼容性
典型的hook的做法應(yīng)該是
hook_function()
{
    save ori_function_address;
    /*
    do something in here
    span some time delay
    */
    call ori_function;
}
hook函數(shù)在執(zhí)行完自己的邏輯后，應(yīng)該要及時調(diào)用被hook前的"原始函數(shù)"，保持對原有業(yè)務(wù)邏輯的透明

4. 盡量減小hook函數(shù)對原有調(diào)用邏輯的延時
hook_function()
{
    save ori_function_address;
    /*
    do something in here
    span some time delay
    */
    call ori_function;
}
hook這個操作是一定會對原有的代碼調(diào)用執(zhí)行邏輯產(chǎn)生延時的，我們需要盡量減少從函數(shù)入口到"call ori_function"這塊的代碼邏輯，讓代碼邏輯盡可能早的去"call ori_function"
在一些極端特殊的場景下，存在對單次API調(diào)用延時極其嚴格的情況，如果延時過長可能會導(dǎo)致原始業(yè)務(wù)邏輯代碼執(zhí)行失敗

當調(diào)用dlsym的時候傳入RTLD_NEXT參數(shù)，gcc的共享庫加載器會按照"裝載順序(load order)(即先來后到的順序)"獲取"下一個共享庫"中的符號地址
/*
Specifies the next object after this one that defines name. This one refers to the object containing the invocation of dlsym(). The next object is the one found upon the application of a load order symbol resolution algorithm (see dlopen()). The next object is either one of global scope (because it was introduced as part of the original process image or because it was added with a dlopen() operation including the RTLD_GLOBAL flag), or is an object that was included in the same dlopen() operation that loaded this one.
The RTLD_NEXT flag is useful to navigate an intentionally created hierarchy of multiply-defined symbols created through interposition. For example, if a program wished to create an implementation of malloc() that embedded some statistics gathering about memory allocations, such an implementation could use the real malloc() definition to perform the memory allocation-and itself only embed the necessary logic to implement the statistics gathering function.
http://pubs.opengroup.org/onlinepubs/009695399/functions/dlsym.html
http://www.newsmth.net/nForum/#!article/KernelTech/413
*/

// used for getting the orginal exported function address
#if defined(RTLD_NEXT)
#  define REAL_LIBC RTLD_NEXT
#else
#  define REAL_LIBC ((void *) -1L)
#endif

//REAL_LIBC代表當前調(diào)用鏈中緊接著下一個共享庫，從調(diào)用方鏈接映射列表中的下一個關(guān)聯(lián)目標文件獲取符號
#define FN(ptr,type,name,args)  ptr = (type (*)args)dlsym (REAL_LIBC, name)

...
FN(func,int,"execve",(const char *, char **const, char **const));

1. 指令執(zhí)行
    1) execve
    2) execv
2. 網(wǎng)絡(luò)連接
    1) connect
3. LKM模塊加載
    1) init_module

#include <stdio.h>
#include <string.h>
#include <dlfcn.h>

#include <stdlib.h>
#include <sys/types.h>  
#include <string.h>
#include <unistd.h>
#include <limits.h>

#include <netinet/in.h> 
#include <linux/ip.h>
#include <linux/tcp.h>

#if defined(RTLD_NEXT)
#  define REAL_LIBC RTLD_NEXT
#else
#  define REAL_LIBC ((void *) -1L)
#endif

#define FN(ptr, type, name, args)  ptr = (type (*)args)dlsym (REAL_LIBC, name)

int execve(const char *filename, char *const argv[], char *const envp[])
{
    static int (*func)(const char *, char **, char **);
    FN(func,int,"execve",(const char *, char **const, char **const)); 

    //print the log
    printf("filename: %s, argv[0]: %s, envp:%s\n", filename, argv[0], envp);

    return (*func) (filename, (char**) argv, (char **) envp);
} 

int execv(const char *filename, char *const argv[]) 
{
    static int (*func)(const char *, char **);
    FN(func,int,"execv", (const char *, char **const)); 

    //print the log
    printf("filename: %s, argv[0]: %s\n", filename, argv[0]);

    return (*func) (filename, (char **) argv);
}  

int connect(int sockfd, const struct sockaddr *addr, socklen_t addrlen) 
{ 
    static int (*func)(int, const struct sockaddr *, socklen_t);
    FN(func,int,"connect", (int, const struct sockaddr *, socklen_t)); 

    /*
    print the log
    獲取、打印參數(shù)信息的時候需要注意
    1. 加鎖
    2. 拷貝到本地棧區(qū)變量中
    3. 然后再打印
    調(diào)試的時候發(fā)現(xiàn)直接獲取打印會導(dǎo)致core dump
    */
    printf("socket connect hooked!!\n");

    //return (*func) (sockfd, (const struct sockaddr *) addr, (socklen_t)addrlen);
    return (*func) (sockfd, addr, addrlen);
}  

int init_module(void *module_image, unsigned long len, const char *param_values) 
{ 
    static int (*func)(void *, unsigned long, const char *);
    FN(func,int,"init_module",(void *, unsigned long, const char *)); 

    /*
    print the log
    lkm的加載不需要取參數(shù)，只需要捕獲事件本身即可
    */
    printf("lkm load hooked!!\n");

    return (*func) ((void *)module_image, (unsigned long)len, (const char *)param_values);
}

//編譯出一個so文件
gcc -fPIC -shared -o hook.so hook.c -ldl

1. 臨時一次性添加(當條指令有效)
LD_PRELOAD=./hook.so nc www.baidu.com 80  
/*
LD_PRELOAD后面接的是具體的庫文件全路徑，可以連接多個路徑
程序加載時，LD_PRELOAD加載路徑優(yōu)先級高于/etc/ld.so.preload
*/

2. 添加到環(huán)境變量LD_PRELOAD中(當前會話SESSION有效)
export LD_PRELOAD=/zhenghan/snoopylog/hook.so
//"/zhenghan/snoopylog/"是編譯.so文件的目錄
unset LD_PRELOAD

3. 添加到環(huán)境變量LD_LIBRARY_PATH中
假如現(xiàn)在需要在已有的環(huán)境變量上添加新的路徑名，則采用如下方式
LD_LIBRARY_PATH=/zhenghan/snoopylog/hook.so:$LD_LIBRARY_PATH.（newdirs是新的路徑串）
/*
LD_LIBRARY_PATH指定查找路徑，這個路徑優(yōu)先級別高于系統(tǒng)預(yù)設(shè)的路徑
*/

4. 添加到系統(tǒng)配置文件中
vim /etc/ld.so.preload
add /zhenghan/snoopylog/hook.so

5. 添加到配置文件目錄中
cat /etc/ld.so.conf
//include ld.so.conf.d/*.conf

1. 指令執(zhí)行
在代碼中手動調(diào)用: execve(argv[1], newargv, newenviron);

2. 網(wǎng)絡(luò)連接
執(zhí)行: nc www.baidu.com 80

3. LKM模塊加載
編寫測試LKM模塊，執(zhí)行: insmod hello.ko

1. 區(qū)分IPv4、IPv6
根據(jù)connect參數(shù)中的(struct sockaddr *addr)->sa_family進行判斷

2. 區(qū)分執(zhí)行成功、執(zhí)行失敗
如果本次connect調(diào)用執(zhí)行失敗，則不應(yīng)該繼續(xù)進行參數(shù)獲取
int ret_code = (*func) (sockfd, addr, addrlen);
int tmp_errno = errno;
if (ret_code == -1 && tmp_errno != EINPROGRESS)
{
    return ret_code;
}

3. 區(qū)分TCP、UDP連接
對于TCP和UDP來說，它們都可以發(fā)起connect請求，我們需要從中過濾出TCP Connect請求
#include <sys/types.h>
#include <sys/socket.h>

int getsockopt(int sock, int level, int optname, void *optval, socklen_t *optlen);
int setsockopt(int sock, int level, int optname, const void *optval, socklen_t optlen);
/*
#include <sys/types.h>
#include <sys/socket.h>
main()
{
   int s;
   int optval;
   int optlen = sizeof(int);
   if((s = socket(AF_INET, SOCK_STREAM, 0)) < 0)
   perror("socket");
   getsockopt(s, SOL_SOCKET, SO_TYPE, &optval, &optlen);
   printf("optval = %d\n", optval);
   close(s);
}
*/
執(zhí)行：
optval = 1 //SOCK_STREAM 的定義正是此值

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

int main(int argc, char *argv[])
{
   char *newargv[] = { NULL, "hello", "world", NULL };
   char *newenviron[] = { NULL };

   if (argc != 2) 
   {
       fprintf(stderr, "Usage: %s <file-to-exec>\n", argv[0]);
       exit(EXIT_FAILURE);
   }

   newargv[0] = argv[1];

   execve(argv[1], newargv, newenviron);
   perror("execve");   /* execve() only returns on error */
   exit(EXIT_FAILURE);
}
//gcc -o execve execve.c

#include <stdio.h>
#include <stdlib.h>

int main(int argc, char *argv[])
{
    int j;

    for (j = 0; j < argc; j++)
        printf("argv[%d]: %s\n", j, argv[j]);

    exit(EXIT_SUCCESS);
}
//gcc -o myecho myecho.c

#include <linux/module.h>    // included for all kernel modules
#include <linux/kernel.h>    // included for KERN_INFO
#include <linux/init.h>        // included for __init and __exit macros
#include <linux/cred.h>
#include <linux/sched.h>

static int __init hello_init(void)
{ 
    struct cred *currentCred;
    currentCred = current->cred;    
    printk(KERN_INFO "uid = %d\n", currentCred->uid);
    printk(KERN_INFO "gid = %d\n", currentCred->gid);
    printk(KERN_INFO "suid = %d\n", currentCred->suid);
    printk(KERN_INFO "sgid = %d\n", currentCred->sgid);
    printk(KERN_INFO "euid = %d\n", currentCred->euid);
    printk(KERN_INFO "egid = %d\n", currentCred->egid);  

    printk(KERN_INFO "Hello world!\n"); 
    return 0;    // Non-zero return means that the module couldn't be loaded.
}

static void __exit hello_cleanup(void)
{
    printk(KERN_INFO "Cleaning up module.\n");
}

module_init(hello_init);
module_exit(hello_cleanup);

obj-m := hello.o
KDIR := /lib/modules/$(shell uname -r)/build
PWD := $(shell pwd)

all:
    $(MAKE) -C $(KDIR) M=$(PWD) modules

clean:
    $(MAKE) -C $(KDIR) M=$(PWD) clean

#cat /etc/ld.so.preload
/usr/local/snoopy/lib/snoopy.so

1. 強制指定LD_PRELOAD的環(huán)境變量    
export LD_PRELOAD=/lib64/libc.so.6
bash
/*
新啟動的bash終端默認會使用LD_PRELOAD的共享庫路徑
*/

2. LD_PRELOAD="/lib64/libc.so.6" bash 
/*
重新開啟一個加載了默認libc.so.6共享庫的bash session
因為對于libc.so.6來說，它沒有使用dlsym去動態(tài)獲取API Function調(diào)用鏈條的RTL_NEXT函數(shù)，即調(diào)用鏈是斷開的
*/

gcc -o test test.c -static

asm("movq $2, %%rax\n\t syscal:"=a"(ret));

asmlinkage ssize_t sys_read(unsigned int fd, char __user * buf, size_t count)
{
        struct file *file;
        ssize_t ret = -EBADF;
        int fput_needed;

        file = fget_light(fd, &fput_needed);
        if (file) 
    {
                loff_t pos = file_pos_read(file);
                ret = vfs_read(file, buf, count, &pos);
                file_pos_write(file, pos);
                fput_light(file, fput_needed);
        }

        return ret;
}
EXPORT_SYMBOL_GPL(sys_read);

call 0xc106d75c <vfs_read>

jmp offset(相對于sys_read()的基址偏移)

/*
參數(shù)：
1. handler是上層函數(shù)的地址，這里就是sys_read的地址
2. old_func是要替換的函數(shù)地址，這里就是vfs_read
3. new_func是新函數(shù)的地址，這里就是new_vfs_read的地址
*/
unsigned int patch_kernel_func(unsigned int handler, unsigned int old_func, 
        unsigned int new_func)
{
    unsigned char *p = (unsigned char *)handler;
    unsigned char buf[4] = "\x00\x00\x00\x00";
    unsigned int offset = 0;
    unsigned int orig = 0;
    int i = 0;

    DbgPrint("\n*** hook engine: start patch func at: 0x%08x\n", old_func);

    while (1) {
        if (i > 512)
            return 0;

        if (p[0] == 0xe8) {
            DbgPrint("*** hook engine: found opcode 0x%02x\n", p[0]);

            DbgPrint("*** hook engine: call addr: 0x%08x\n", 
                (unsigned int)p);
            buf[0] = p[1];
            buf[1] = p[2];
            buf[2] = p[3];
            buf[3] = p[4];

            DbgPrint("*** hook engine: 0x%02x 0x%02x 0x%02x 0x%02x\n", 
                p[1], p[2], p[3], p[4]);

                offset = *(unsigned int *)buf;
                DbgPrint("*** hook engine: offset: 0x%08x\n", offset);

                orig = offset + (unsigned int)p + 5;
                DbgPrint("*** hook engine: original func: 0x%08x\n", orig);

            if (orig == old_func) {
                DbgPrint("*** hook engine: found old func at"
                    " 0x%08x\n", 
                    old_func);

                DbgPrint("%d\n", i);
                break;
            }
        }
        p++;
        i++;
    }

    offset = new_func - (unsigned int)p - 5;
    DbgPrint("*** hook engine: new func offset: 0x%08x\n", offset);

    p[1] = (offset & 0x000000ff);
    p[2] = (offset & 0x0000ff00) >> 8;
    p[3] = (offset & 0x00ff0000) >> 16;
    p[4] = (offset & 0xff000000) >> 24;

    DbgPrint("*** hook engine: pachted new func offset.\n");

    return orig;
}

#include <linux/module.h>
#include <linux/kernel.h>

// 中斷描述符表寄存器結(jié)構(gòu)
struct 
{
    unsigned short limit;
    unsigned int base;
} __attribute__((packed)) idtr;


// 中斷描述符表結(jié)構(gòu)
struct 
{
    unsigned short off1;
    unsigned short sel;
    unsigned char none, flags;
    unsigned short off2;
} __attribute__((packed)) idt;

// 查找sys_call_table的地址
void disp_sys_call_table(void)
{
    unsigned int sys_call_off;
    unsigned int sys_call_table;
    char* p;
    int i;

    // 獲取中斷描述符表寄存器的地址
    asm("sidt %0":"=m"(idtr));
    printk("addr of idtr: %x\n", &idtr);

    // 獲取0x80中斷處理程序的地址
    memcpy(&idt, idtr.base+8*0x80, sizeof(idt));
    sys_call_off=((idt.off2<<16)|idt.off1);
    printk("addr of idt 0x80: %x\n", sys_call_off);

    // 從0x80中斷服務(wù)例程中搜索sys_call_table的地址
    p=sys_call_off;
    for (i=0; i<100; i++)
    {
        if (p=='\xff' && p[i+1]=='\x14' && p[i+2]=='\x85')
        {
            sys_call_table=*(unsigned int*)(p+i+3);
            printk("addr of sys_call_table: %x\n", sys_call_table);
            return ;
        }
    }
}

// 模塊載入時被調(diào)用
static int __init init_get_sys_call_table(void)
{
    disp_sys_call_table();
    return 0;
}

module_init(init_get_sys_call_table);

// 模塊卸載時被調(diào)用
static void __exit exit_get_sys_call_table(void)
{
}

module_exit(exit_get_sys_call_table);

// 模塊信息
MODULE_LICENSE("GPL2.0");
MODULE_AUTHOR("LittleHann");

obj-m := find_sys_call_table.o

make -C /usr/src/kernels/2.6.32-358.el6.i686 M=$(pwd) modules

#include <stdio.h>
void fun1()
{
        printf("fun1/n");
}
void fun2()
{
        printf("fun2/n");
}
unsigned int sys_call_table[2] = {fun1, fun2};
int main(int argc, char **argv)
{
        asm("call *sys_call_table(%eax,4");
}

編譯
gcc test.c -o test

objdump進行dump
objdump -D ./test | grep sys_call_table

cd /boot
grep sys_call_table System.map-2.6.32-358.el6.i686

#include <stdio.h>
#include <sys/types.h>
#include <fcntl.h>
#include <stdlib.h>

int kfd; 
struct
{
    unsigned short limit;
    unsigned int base;
} __attribute__ ((packed)) idtr;

struct
{
    unsigned short off1;
    unsigned short sel;
    unsigned char none, flags;
    unsigned short off2;
} __attribute__ ((packed)) idt;

int readkmem (unsigned char *mem,  unsigned off,  int bytes)
{
    if (lseek64 (kfd, (unsigned long long) off,  SEEK_SET) != off)
    {
        return -1;
    } 
    if (read (kfd, mem, bytes) != bytes) 
    {
        return -1;
    } 
}

int main (void)
{
    unsigned long sct_off;
    unsigned long sct;
    unsigned char *p, code[255];
    int i; 
    /* request IDT and fill struct */ 

    asm ("sidt %0":"=m" (idtr));

    if ((kfd = open ("/dev/kmem", O_RDONLY)) == -1)
    {
        perror("open");
        exit(-1);
    } 
    if (readkmem ((unsigned char *)&idt, idtr.base + 8 * 0x80, sizeof (idt)) == -1)
    {
        printf("Failed to read from /dev/kmem\n");
        exit(-1);
    } 

    sct_off = (idt.off2 << 16) | idt.off1; 

    if (readkmem (code, sct_off, 0x100) == -1)
    {
        printf("Failed to read from /dev/kmem\n");
        exit(-1);
    }

    /* find the code sequence that calls SCT */ 

    sct = 0;
    for (i = 0; i < 255; i++)
    {
        if (code[i] == 0xff && code[i+1] == 0x14 &&  code[i+2] == 0x85) 
        {
            sct = code[i+3] + (code[i+4] << 8) +  (code[i+5] << 16) + (code[i+6] << 24);
        }
    }
    if (sct)
    {
        printf ("sys_call_table: 0x%x\n", sct);
    }

    close (kfd);
}

unsigned long **find_sys_call_table() 
{ 
    unsigned long ptr;
    unsigned long *p;

    for (ptr = (unsigned long)sys_close; ptr < (unsigned long)&loops_per_jiffy; ptr += sizeof(void *)) 
    {    
        p = (unsigned long *)ptr;

        if (p[__NR_close] == (unsigned long)sys_close) 
    {
            printk(KERN_DEBUG "Found the sys_call_table!!!\n");
            return (unsigned long **)p;
        }
    }

    return NULL;
}

grep sys_close System.map-2.6.32-358.el6.i686
grep loops_per_jiffy System.map-2.6.32-358.el6.i686

//get symbol name by  "kprobe.addr"
//when register a kprobe on succefully return,the structure of kprobe save the symbol address at "kprobe.addr"
//just return this value
static void* aquire_symbol_by_kprobe(char* symbol_name)
{
    void *symbol_addr=NULL;
    struct kprobe kp;

    do
    {
       memset(&kp,0,sizeof(kp));
       kp.symbol_name=symbol_name;
       kp.pre_handler=kprobe_pre;
       if(register_kprobe(&kp)!=0)
       {
            break;
       }
       //this is the address of  "symbol_name"
       symbol_addr=(void*)kp.addr;

       //now kprobe is not used any more,so unregister it
       unregister_kprobe(&kp);

    }while(false);

    return symbol_addr;
}

//調(diào)用之
tmp_lookup_func = aquire_symbol_by_kprobe("kallsyms_lookup_name");

(void**)kallsyms_lookup_name("sys_call_table");

#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/syscalls.h>

// 保存原來的系統(tǒng)調(diào)用函數(shù)指針
asmlinkage long (*original_sys_open)(const char __user *, int, umode_t);

// 自定義的Hook函數(shù)
asmlinkage long my_sys_open(const char __user *filename, int flags, umode_t mode) {
    printk(KERN_INFO "MyHook: Opening file: %s\n", filename);
    // 調(diào)用原來的系統(tǒng)調(diào)用函數(shù)
    return original_sys_open(filename, flags, mode);
}

static int __init my_init(void) {
    // 獲取系統(tǒng)調(diào)用表地址
    unsigned long *sys_call_table = (unsigned long *)sys_call_table;
    // 保存原來的系統(tǒng)調(diào)用函數(shù)指針
    original_sys_open = (void *)sys_call_table[__NR_open];
    // 修改系統(tǒng)調(diào)用表中的函數(shù)指針
    sys_call_table[__NR_open] = (unsigned long)my_sys_open;
    return 0;
}

static void __exit my_exit(void) {
    // 恢復(fù)原來的系統(tǒng)調(diào)用函數(shù)指針
    unsigned long *sys_call_table = (unsigned long *)sys_call_table;
    sys_call_table[__NR_open] = (unsigned long)original_sys_open;
}

module_init(my_init);
module_exit(my_exit);
MODULE_LICENSE("GPL");

#include <stdio.h>
#include <stdlib.h>
#include <dlfcn.h>

// 自定義的Hook函數(shù)
int my_open(const char *pathname, int flags, mode_t mode) {
    printf("MyHook: Opening file: %s\n", pathname);
    // 獲取原來的open函數(shù)指針
    int (*original_open)(const char *, int, mode_t) = dlsym(RTLD_NEXT, "open");
    // 調(diào)用原來的open函數(shù)
    return original_open(pathname, flags, mode);
}

// 通過環(huán)境變量LD_PRELOAD加載這個庫時，會優(yōu)先使用這個函數(shù)
__attribute__((constructor)) void my_init(void) {
    void *handle = dlopen(NULL, RTLD_NOW);
    if (!handle) {
        fprintf(stderr, "Error opening library: %s\n", dlerror());
        exit(EXIT_FAILURE);
    }
    // 使用dlsym獲取原來的open函數(shù)指針（這里只是示例，實際可能需要更復(fù)雜的處理）
    int (*original_open)(const char *, int, mode_t) = dlsym(handle, "open");
    if (!original_open) {
        fprintf(stderr, "Error getting original open function: %s\n", dlerror());
        dlclose(handle);
        exit(EXIT_FAILURE);
    }
    // 這里可以通過一些技巧修改GOT表中open函數(shù)的地址，使其指向my_open函數(shù)
    // 具體實現(xiàn)因不同系統(tǒng)和編譯器而異，此處簡化示意
}

#include <linux/module.h>
#include <linux/kprobes.h>

// 定義一個Kprobe結(jié)構(gòu)體
static struct kprobe my_kprobe = {
  .symbol_name = "__x64_sys_open",  // 要Hook的系統(tǒng)調(diào)用函數(shù)名
};

// 函數(shù)執(zhí)行前的回調(diào)函數(shù)
static int pre_handler(struct kprobe *p, struct pt_regs *regs) {
    printk(KERN_INFO "MyHook: Before open system call\n");
    return 0;
}

// 函數(shù)執(zhí)行后的回調(diào)函數(shù)
static void post_handler(struct kprobe *p, struct pt_regs *regs, unsigned long flags) {
    printk(KERN_INFO "MyHook: After open system call\n");
}

// 發(fā)生異常時的回調(diào)函數(shù)
static void fault_handler(struct kprobe *p, struct pt_regs *regs, int trapnr) {
    printk(KERN_INFO "MyHook: Fault in open system call\n");
}

static int __init my_init(void) {
    // 設(shè)置回調(diào)函數(shù)
    my_kprobe.pre_handler = pre_handler;
    my_kprobe.post_handler = post_handler;
    my_kprobe.fault_handler = fault_handler;
    // 注冊Kprobe
    if (register_kprobe(&my_kprobe) < 0) {
        printk(KERN_INFO "Failed to register kprobe\n");
        return -1;
    }
    return 0;
}

static void __exit my_exit(void) {
    // 注銷Kprobe
    unregister_kprobe(&my_kprobe);
    printk(KERN_INFO "Kprobe unregistered\n");
}

module_init(my_init);
module_exit(my_exit);
MODULE_LICENSE("GPL");