hook the execve system call how to find the file path from the const char __user*

danielhaish · 01-13-2020, 09:29 AM

hi i hooked the execve system call with lkm and when i wrote a code that print alert each time process is been execute it work fine but when i tried to print the file name paramter it crashed my computer

Code:

asmlinkage long our_execl( const char __user* filename, const char __user* const __user* argv,
                    const char __user* const __user* envp )
{
    printk(filename);
    return orignal_execl( filename, argv, envp );
}

pan64 · 01-14-2020, 01:36 AM

duplicate of https://www.linuxquestions.org/quest...2A-4175667628/