Makefile

@@ -3,21 +3,8 @@ obj-m += libusbMod.o
 KDIR := /lib/modules/$(shell uname -r)/build
 PWD  := $(shell pwd)
 
-# 默认目标：只编译内核模块
-all: libusbMod.ko
-
-# 编译内核模块
-libusbMod.ko:
+all:
 	make -C $(KDIR) M=$(PWD) modules
 
-# 清理所有生成文件
 clean:
 	make -C $(KDIR) M=$(PWD) clean
-
-# 加载模块
-load:
-	sudo insmod libusbMod.ko
-
-# 卸载模块
-unload:
-	sudo rmmod libusbMod

libusbMod.c

@@ -1,105 +1,44 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
+#include <linux/usbdevice_fs.h>
 #include <linux/kprobes.h>
 #include <linux/sched.h>
-#include <linux/uaccess.h>
-#include <linux/usb.h>
-#include <linux/slab.h>
-#include <linux/version.h>
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Leo");
-MODULE_DESCRIPTION("Monitor usb_submit_urb() data submission only");
+MODULE_DESCRIPTION("Hook USBDEVFS_SUBMITURB ioctl on arm64");
 
 static struct kprobe kp;
 
-// 兼容 x86_64 和 arm64 获取第一个参数
-static struct urb *get_urb_from_regs(struct pt_regs *regs)
-{
-#if defined(CONFIG_ARM64)
-    return (struct urb *)regs->regs[0];
-#elif defined(CONFIG_X86_64)
-    return (struct urb *)regs->di;
-#else
-#error "Unsupported architecture"
-#endif
-}
-
 static int handler_pre(struct kprobe *p, struct pt_regs *regs)
 {
-    struct urb *urb_kern = get_urb_from_regs(regs);
+    unsigned int cmd = 0;
 
-    if (!urb_kern)
-        return 0;
+    cmd = (unsigned int)regs->regs[1]; // ioctl 的第二个参数
 
-    pr_info("[usbFilter] 提交URB进程: %s (pid: %d)\n", current->comm, current->pid);
-
-    if (urb_kern->dev) {
-        pr_info("[usbFilter] USB设备: busnum=%d, devnum=%d, VID=0x%04x, PID=0x%04x\n",
-                urb_kern->dev->bus->busnum,
-                urb_kern->dev->devnum,
-                urb_kern->dev->descriptor.idVendor,
-                urb_kern->dev->descriptor.idProduct);
+    if (cmd == USBDEVFS_SUBMITURB) {
+        pr_info("[usbFilter] process: %s, pid: %d, called USBDEVFS_SUBMITURB ioctl\n", current->comm, current->pid);
     }
-
-    pr_info("[usbFilter] URB: %p, pipe=0x%x, flags=0x%x\n",
-            urb_kern, urb_kern->pipe, urb_kern->transfer_flags);
-
-    pr_info("[usbFilter] pipe: 端点=%d, 方向=%s, 类型=%s\n",
-            usb_pipeendpoint(urb_kern->pipe),
-            usb_pipein(urb_kern->pipe) ? "IN" : "OUT",
-            usb_pipetype(urb_kern->pipe) == PIPE_CONTROL ? "CONTROL" :
-            usb_pipetype(urb_kern->pipe) == PIPE_ISOCHRONOUS ? "ISO" :
-            usb_pipetype(urb_kern->pipe) == PIPE_BULK ? "BULK" :
-            usb_pipetype(urb_kern->pipe) == PIPE_INTERRUPT ? "INTERRUPT" : "UNKNOWN");
-
-    // 打印控制传输的setup包内容
-    if (usb_pipetype(urb_kern->pipe) == PIPE_CONTROL && urb_kern->setup_packet) {
-        char setup_hex[3 * 8 + 1] = {0};
-        int i;
-        unsigned char *setup = (unsigned char *)urb_kern->setup_packet;
-        for (i = 0; i < 8; ++i) {
-            snprintf(setup_hex + i * 3, sizeof(setup_hex) - i * 3, "%02X ", setup[i]);
-        }
-        pr_info("[usbFilter] 控制传输setup包(8字节hex): %s\n", setup_hex);
-    }
-
-    // 打印控制传输的数据内容
-    if (urb_kern->transfer_buffer && urb_kern->transfer_buffer_length > 0) {
-        unsigned int to_copy = min(32U, (unsigned int)urb_kern->transfer_buffer_length);
-        unsigned char data[32] = {0};
-        memcpy(data, urb_kern->transfer_buffer, to_copy);
-
-        char hex[3 * 32 + 1] = {0};
-        int i;
-        for (i = 0; i < to_copy; ++i) {
-            snprintf(hex + i * 3, sizeof(hex) - i * 3, "%02X ", data[i]);
-        }
-        pr_info("[usbFilter] 提交数据(前32字节hex): %s\n", hex);
-    }
-
     return 0;
 }
 
 static int __init usb_hook_init(void)
 {
-    kp.symbol_name = "usb_submit_urb";
+    kp.symbol_name = "usbdev_do_ioctl";
     kp.pre_handler = handler_pre;
 
-    if (register_kprobe(&kp) < 0)
-    {
-        pr_err("[usbFilter] 无法注册 kprobe\n");
+    if (register_kprobe(&kp) < 0) {
+        pr_err("[usbFilter] register_kprobe failed\n");
         return -1;
     }
-
-    pr_info("[usbFilter] 成功 hook usb_submit_urb()\n");
+    pr_info("[usbFilter] kprobe registered for %s\n", kp.symbol_name);
     return 0;
 }
 
 static void __exit usb_hook_exit(void)
 {
     unregister_kprobe(&kp);
-    pr_info("[usbFilter] 已卸载 usb_submit_urb hook\n");
+    pr_info("[usbFilter] kprobe unregistered\n");
 }
 
 module_init(usb_hook_init);