From c77316a0f2695651f6e0343831c0590d29e2e4b4 Mon Sep 17 00:00:00 2001 From: kylin_bg Date: Sat, 31 May 2025 16:24:11 +0800 Subject: [PATCH] initial commit of libusbMod module for hooking USBDEVFS_SUBMITURB ioctl --- Makefile | 10 ++++++++++ libusbMod.c | 45 +++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 55 insertions(+) create mode 100644 Makefile create mode 100644 libusbMod.c diff --git a/Makefile b/Makefile new file mode 100644 index 0000000..1d91fde --- /dev/null +++ b/Makefile @@ -0,0 +1,10 @@ +obj-m += libusbMod.o + +KDIR := /lib/modules/$(shell uname -r)/build +PWD := $(shell pwd) + +all: + make -C $(KDIR) M=$(PWD) modules + +clean: + make -C $(KDIR) M=$(PWD) clean \ No newline at end of file diff --git a/libusbMod.c b/libusbMod.c new file mode 100644 index 0000000..22eb6ad --- /dev/null +++ b/libusbMod.c @@ -0,0 +1,45 @@ +#include +#include +#include +#include +#include + +MODULE_LICENSE("GPL"); +MODULE_AUTHOR("Leo"); +MODULE_DESCRIPTION("Hook USBDEVFS_SUBMITURB ioctl on arm64"); + +static struct kprobe kp; + +static int handler_pre(struct kprobe *p, struct pt_regs *regs) +{ + unsigned int cmd = 0; + + cmd = (unsigned int)regs->regs[1]; // ioctl 的第二个参数 + + if (cmd == USBDEVFS_SUBMITURB) { + pr_info("[usbFilter] process: %s, pid: %d, called USBDEVFS_SUBMITURB ioctl\n", current->comm, current->pid); + } + return 0; +} + +static int __init usb_hook_init(void) +{ + kp.symbol_name = "usbdev_do_ioctl"; + kp.pre_handler = handler_pre; + + if (register_kprobe(&kp) < 0) { + pr_err("[usbFilter] register_kprobe failed\n"); + return -1; + } + pr_info("[usbFilter] kprobe registered for %s\n", kp.symbol_name); + return 0; +} + +static void __exit usb_hook_exit(void) +{ + unregister_kprobe(&kp); + pr_info("[usbFilter] kprobe unregistered\n"); +} + +module_init(usb_hook_init); +module_exit(usb_hook_exit); \ No newline at end of file