diff options
Diffstat (limited to 'tapset/LKET/hookid_defs.stp')
| -rwxr-xr-x | tapset/LKET/hookid_defs.stp | 155 |
1 files changed, 154 insertions, 1 deletions
diff --git a/tapset/LKET/hookid_defs.stp b/tapset/LKET/hookid_defs.stp index 70801484..9f919938 100755 --- a/tapset/LKET/hookid_defs.stp +++ b/tapset/LKET/hookid_defs.stp @@ -33,7 +33,61 @@ global /* network device */ GROUP_NETDEV, - HOOKID_NETDEV_RECEIVE, HOOKID_NETDEV_TRANSMIT + HOOKID_NETDEV_RECEIVE, HOOKID_NETDEV_TRANSMIT, + + /* io related syscall */ + GROUP_IOSYSCALL, + + HOOKID_IOSYSCALL_OPEN_ENTRY, + HOOKID_IOSYSCALL_OPEN_RETURN, + + HOOKID_IOSYSCALL_CLOSE_ENTRY, + HOOKID_IOSYSCALL_CLOSE_RETURN, + + HOOKID_IOSYSCALL_READ_ENTRY, + HOOKID_IOSYSCALL_READ_RETURN, + + HOOKID_IOSYSCALL_WRITE_ENTRY, + HOOKID_IOSYSCALL_WRITE_RETURN, + + HOOKID_IOSYSCALL_READV_ENTRY, + HOOKID_IOSYSCALL_READV_RETURN, + + HOOKID_IOSYSCALL_WRITEV_ENTRY, + HOOKID_IOSYSCALL_WRITEV_RETURN, + + HOOKID_IOSYSCALL_PREAD64_ENTRY, + HOOKID_IOSYSCALL_PREAD64_RETURN, + + HOOKID_IOSYSCALL_PWRITE64_ENTRY, + HOOKID_IOSYSCALL_PWRITE64_RETURN, + + HOOKID_IOSYSCALL_READAHEAD_ENTRY, + HOOKID_IOSYSCALL_READAHEAD_RETURN, + + HOOKID_IOSYSCALL_SENDFILE_ENTRY, + HOOKID_IOSYSCALL_SENDFILE_RETURN, + + HOOKID_IOSYSCALL_SENDFILE64_ENTRY, + HOOKID_IOSYSCALL_SENDFILE64_RETURN, + + HOOKID_IOSYSCALL_LSEEK_ENTRY, + HOOKID_IOSYSCALL_LSEEK_RETURN, + + HOOKID_IOSYSCALL_LLSEEK_ENTRY, + HOOKID_IOSYSCALL_LLSEEK_RETURN, + + HOOKID_IOSYSCALL_SYNC_ENTRY, + HOOKID_IOSYSCALL_SYNC_RETURN, + + HOOKID_IOSYSCALL_FSYNC_ENTRY, + HOOKID_IOSYSCALL_FSYNC_RETURN, + + HOOKID_IOSYSCALL_FDATASYNC_ENTRY, + HOOKID_IOSYSCALL_FDATASYNC_RETURN, + + HOOKID_IOSYSCALL_FLOCK_ENTRY, + HOOKID_IOSYSCALL_FLOCK_RETURN %{ /* used in embedded c codes */ @@ -46,6 +100,7 @@ int _GROUP_TASK = 5; int _GROUP_SCSI = 6; int _GROUP_PAGEFAULT = 7; int _GROUP_NETDEV = 8; +int _GROUP_IOSYSCALL = 9; /* hookIDs defined inside each group */ int _HOOKID_REGSYSEVT = 1; @@ -75,6 +130,54 @@ int _HOOKID_PAGEFAULT = 1; int _HOOKID_NETDEV_RECEIVE = 1; int _HOOKID_NETDEV_TRANSMIT = 2; +int _HOOKID_IOSYSCALL_OPEN_ENTRY = 1; +int _HOOKID_IOSYSCALL_OPEN_RETURN = 2; + +int _HOOKID_IOSYSCALL_CLOSE_ENTRY = 3; +int _HOOKID_IOSYSCALL_CLOSE_RETURN = 4; + +int _HOOKID_IOSYSCALL_READ_ENTRY = 5; +int _HOOKID_IOSYSCALL_READ_RETURN = 6; + +int _HOOKID_IOSYSCALL_WRITE_ENTRY = 7; +int _HOOKID_IOSYSCALL_WRITE_RETURN = 8; + +int _HOOKID_IOSYSCALL_READV_ENTRY = 9; +int _HOOKID_IOSYSCALL_READV_RETURN = 10; + +int _HOOKID_IOSYSCALL_WRITEV_ENTRY = 11; +int _HOOKID_IOSYSCALL_WRITEV_RETURN = 12; + +int _HOOKID_IOSYSCALL_PREAD64_ENTRY = 13; +int _HOOKID_IOSYSCALL_PREAD64_RETURN = 14; + +int _HOOKID_IOSYSCALL_PWRITE64_ENTRY = 15; +int _HOOKID_IOSYSCALL_PWRITE64_RETURN = 16; + +int _HOOKID_IOSYSCALL_READAHEAD_ENTRY = 17; +int _HOOKID_IOSYSCALL_READAHEAD_RETURN = 18; + +int _HOOKID_IOSYSCALL_SENDFILE_ENTRY = 19; +int _HOOKID_IOSYSCALL_SENDFILE_RETURN = 20; + +int _HOOKID_IOSYSCALL_LSEEK_ENTRY = 21; +int _HOOKID_IOSYSCALL_LSEEK_RETURN = 22; + +int _HOOKID_IOSYSCALL_LLSEEK_ENTRY = 23; +int _HOOKID_IOSYSCALL_LLSEEK_RETURN = 24; + +int _HOOKID_IOSYSCALL_SYNC_ENTRY = 25; +int _HOOKID_IOSYSCALL_SYNC_RETURN = 26; + +int _HOOKID_IOSYSCALL_FSYNC_ENTRY = 27; +int _HOOKID_IOSYSCALL_FSYNC_RETURN = 28; + +int _HOOKID_IOSYSCALL_FDATASYNC_ENTRY = 29; +int _HOOKID_IOSYSCALL_FDATASYNC_RETURN = 30; + +int _HOOKID_IOSYSCALL_FLOCK_ENTRY = 31; +int _HOOKID_IOSYSCALL_FLOCK_RETURN = 32; + %} function hookid_init() @@ -113,6 +216,56 @@ function hookid_init() GROUP_NETDEV = 8 HOOKID_NETDEV_RECEIVE = 1 HOOKID_NETDEV_TRANSMIT = 2 + + GROUP_IOSYSCALL = 9 + + HOOKID_IOSYSCALL_OPEN_ENTRY = 1 + HOOKID_IOSYSCALL_OPEN_RETURN = 2 + + HOOKID_IOSYSCALL_CLOSE_ENTRY = 3 + HOOKID_IOSYSCALL_CLOSE_RETURN = 4 + + HOOKID_IOSYSCALL_READ_ENTRY = 5 + HOOKID_IOSYSCALL_READ_RETURN = 6 + + HOOKID_IOSYSCALL_WRITE_ENTRY = 7 + HOOKID_IOSYSCALL_WRITE_RETURN = 8 + + HOOKID_IOSYSCALL_READV_ENTRY = 9 + HOOKID_IOSYSCALL_READV_RETURN = 10 + + HOOKID_IOSYSCALL_WRITEV_ENTRY = 11 + HOOKID_IOSYSCALL_WRITEV_RETURN = 12 + + HOOKID_IOSYSCALL_PREAD64_ENTRY = 13 + HOOKID_IOSYSCALL_PREAD64_RETURN = 14 + + HOOKID_IOSYSCALL_PWRITE64_ENTRY = 15 + HOOKID_IOSYSCALL_PWRITE64_RETURN = 16 + + HOOKID_IOSYSCALL_READAHEAD_ENTRY = 17 + HOOKID_IOSYSCALL_READAHEAD_RETURN = 18 + + HOOKID_IOSYSCALL_SENDFILE_ENTRY = 19 + HOOKID_IOSYSCALL_SENDFILE_RETURN = 20 + + HOOKID_IOSYSCALL_LSEEK_ENTRY = 21 + HOOKID_IOSYSCALL_LSEEK_RETURN = 22 + + HOOKID_IOSYSCALL_LLSEEK_ENTRY = 23 + HOOKID_IOSYSCALL_LLSEEK_RETURN = 24 + + HOOKID_IOSYSCALL_SYNC_ENTRY = 25 + HOOKID_IOSYSCALL_SYNC_RETURN = 26 + + HOOKID_IOSYSCALL_FSYNC_ENTRY = 27 + HOOKID_IOSYSCALL_FSYNC_RETURN = 28 + + HOOKID_IOSYSCALL_FDATASYNC_ENTRY = 29 + HOOKID_IOSYSCALL_FDATASYNC_RETURN = 30 + + HOOKID_IOSYSCALL_FLOCK_ENTRY = 31 + HOOKID_IOSYSCALL_FLOCK_RETURN = 32 } |