Yu1709$!%yuyu!$%wutu!5=126+

                
____  ___       .__                 
\   \/  /  _____|  |   ______  _  __
 \     /  /  ___/  |  /  _ \ \/ \/ /
 /     \  \___ \|  |_(  <_> )     / 
/___/\  \/____  >____/\____/ \/\_/  
      \_/     \/    @ligmakokz

Editing: sysc_finit_module.stp

# finit_module ________________________________________________
# SYSCALL_DEFINE3(finit_module, int, fd, const char __user *, uargs,
#		  int, flags)
#

@define _SYSCALL_FINIT_MODULE_NAME
%(
	name = "finit_module"
%)

@define _SYSCALL_FINIT_MODULE_ARGSTR
%(
	argstr = sprintf("%d, %s, %s", fd, uargs, flags_str)
%)

@define _SYSCALL_FINIT_MODULE_REGARGS
%(
	fd = int_arg(1)
	uargs = user_string_quoted(pointer_arg(2))
	uargs_unquoted = user_string_nofault(pointer_arg(2))
	flags = int_arg(3)
	flags_str = _finit_module_flags_str(flags)
%)

@define _SYSCALL_FINIT_MODULE_REGARGS_STORE
%(
        if (@probewrite(fd))
          set_int_arg(1, fd)

if (@probewrite(uargs_unquoted))
	  set_user_string_arg(pointer_arg(2), uargs_unquoted)

if (@probewrite(flags))
	  set_int_arg(3, flags)
%)

probe syscall.finit_module = dw_syscall.finit_module !, nd_syscall.finit_module ? {}
probe syscall.finit_module.return = dw_syscall.finit_module.return !, nd_syscall.finit_module.return ? {}

# dw_finit_module _____________________________________________________

probe dw_syscall.finit_module = kernel.function("sys_finit_module").call ?
{
	@_SYSCALL_FINIT_MODULE_NAME
	fd = __int32($fd)
	uargs = user_string_quoted($uargs)
	flags = __int32($flags)
	flags_str = _finit_module_flags_str(__int32($flags))
	@_SYSCALL_FINIT_MODULE_ARGSTR
}
probe dw_syscall.finit_module.return = kernel.function("sys_finit_module").return ?
{
	@_SYSCALL_FINIT_MODULE_NAME
	@SYSC_RETVALSTR($return)
}

# nd_finit_module _____________________________________________________

probe nd_syscall.finit_module = nd1_syscall.finit_module!, nd2_syscall.finit_module!, tp_syscall.finit_module
  { }

probe nd1_syscall.finit_module = kprobe.function("sys_finit_module").call ?
{
	@_SYSCALL_FINIT_MODULE_NAME
	asmlinkage()
	@_SYSCALL_FINIT_MODULE_REGARGS
	@_SYSCALL_FINIT_MODULE_ARGSTR
}

/* kernel 4.17+ */
probe nd2_syscall.finit_module = kprobe.function(@arch_syscall_prefix "sys_finit_module") ?
{
	__set_syscall_pt_regs(pointer_arg(1))
	@_SYSCALL_FINIT_MODULE_NAME
	@_SYSCALL_FINIT_MODULE_REGARGS
	@_SYSCALL_FINIT_MODULE_ARGSTR
},
{
        %( @_IS_SREG_KERNEL %? @_SYSCALL_FINIT_MODULE_REGARGS_STORE %)
}

/* kernel 3.5+, but undesirable because it affects all syscalls */
probe tp_syscall.finit_module = kernel.trace("sys_enter")
{
	__set_syscall_pt_regs($regs)
	@__syscall_compat_gate(@const("__NR_finit_module"), @const("__NR_compat_finit_module"))
	@_SYSCALL_FINIT_MODULE_NAME
	@_SYSCALL_FINIT_MODULE_REGARGS
	@_SYSCALL_FINIT_MODULE_ARGSTR
},
{
        %( @_IS_SREG_KERNEL %? @_SYSCALL_FINIT_MODULE_REGARGS_STORE %)
}

probe nd_syscall.finit_module.return = nd1_syscall.finit_module.return!, nd2_syscall.finit_module.return!, tp_syscall.finit_module.return
  { }
  
probe nd1_syscall.finit_module.return =
	kprobe.function("sys_finit_module").return ?
{
	@_SYSCALL_FINIT_MODULE_NAME
	@SYSC_RETVALSTR(returnval())
}

/* kernel 4.17+ */
probe nd2_syscall.finit_module.return = kprobe.function(@arch_syscall_prefix "sys_finit_module").return ?
{
	@_SYSCALL_FINIT_MODULE_NAME
	@SYSC_RETVALSTR(returnval())
}
 
/* kernel 3.5+, but undesirable because it affects all syscalls */
probe tp_syscall.finit_module.return = kernel.trace("sys_exit")
{
	__set_syscall_pt_regs($regs)
	@__syscall_compat_gate(@const("__NR_finit_module"), @const("__NR_compat_finit_module"))
	@_SYSCALL_FINIT_MODULE_NAME
	@SYSC_RETVALSTR($ret)
}

Name	Type	Actions
arm	Directory
arm64	Directory
i386	Directory
ia64	Directory
mips	Directory
powerpc	Directory
riscv	Directory
s390	Directory
x86_64	Directory
atomic.stp	File
aux_syscalls.stp	File
context-caller.stp	File
context-envvar.stp	File
context-symbols.stp	File
context-unwind.stp	File
context.stp	File
context.stpm	File
conversions-guru.stp	File
conversions.stp	File
ctime.stp	File
dentry.stp	File
dev.stp	File
endian.stp	File
errno.stpm	File
guru-delay.stp	File
guru-signal.stp	File
inet.stp	File
inet.stpm	File
inet_sock.stp	File
ioblock.stp	File
ioscheduler.stp	File
ip.stp	File
ipmib-filter-default.stp	File
ipmib.stp	File
irq.stp	File
json.stp	File
json.stpm	File
kprocess.stp	File
kretprobe.stp	File
linuxmib-filter-default.stp	File
linuxmib.stp	File
loadavg.stp	File
logging.stp	File
memory.stp	File
netfilter.stp	File
networking.stp	File
nfs.stp	File
nfs_proc.stp	File
nfs_proc.stpm	File
nfsd.stp	File
nfsderrno.stp	File
panic.stp	File
perf.stp	File
proc_mem.stp	File
pstrace.stp	File
rcu.stp	File
rlimit.stp	File
rpc.stp	File
scheduler.stp	File
scsi.stp	File
signal.stp	File
socket.stp	File
sysc_accept.stp	File
sysc_accept4.stp	File
sysc_access.stp	File
sysc_acct.stp	File
sysc_add_key.stp	File
sysc_adjtimex.stp	File
sysc_alarm.stp	File
sysc_bdflush.stp	File
sysc_bind.stp	File
sysc_bpf.stp	File
sysc_brk.stp	File
sysc_capget.stp	File
sysc_capset.stp	File
sysc_chdir.stp	File
sysc_chmod.stp	File
sysc_chown.stp	File
sysc_chown16.stp	File
sysc_chroot.stp	File
sysc_clock_adjtime.stp	File
sysc_clock_getres.stp	File
sysc_clock_gettime.stp	File
sysc_clock_nanosleep.stp	File
sysc_clock_settime.stp	File
sysc_clone.stp	File
sysc_close.stp	File
sysc_connect.stp	File
sysc_copy_file_range.stp	File
sysc_creat.stp	File
sysc_delete_module.stp	File
sysc_dup.stp	File
sysc_dup2.stp	File
sysc_dup3.stp	File
sysc_epoll_create.stp	File
sysc_epoll_ctl.stp	File
sysc_epoll_pwait.stp	File
sysc_epoll_wait.stp	File
sysc_eventfd.stp	File
sysc_execve.stp	File
sysc_execveat.stp	File
sysc_exit.stp	File
sysc_exit_group.stp	File
sysc_faccessat.stp	File
sysc_faccessat2.stp	File
sysc_fadvise64.stp	File
sysc_fallocate.stp	File
sysc_fanotify_init.stp	File
sysc_fanotify_mark.stp	File
sysc_fchdir.stp	File
sysc_fchmod.stp	File
sysc_fchmodat.stp	File
sysc_fchown.stp	File
sysc_fchown16.stp	File
sysc_fchownat.stp	File
sysc_fcntl.stp	File
sysc_fdatasync.stp	File
sysc_fgetxattr.stp	File
sysc_finit_module.stp	File
sysc_flistxattr.stp	File
sysc_flock.stp	File
sysc_fork.stp	File
sysc_fremovexattr.stp	File
sysc_fsetxattr.stp	File
sysc_fstat.stp	File
sysc_fstatat.stp	File
sysc_fstatfs.stp	File
sysc_fstatfs64.stp	File
sysc_fsync.stp	File
sysc_ftruncate.stp	File
sysc_futex.stp	File
sysc_futimesat.stp	File
sysc_get_mempolicy.stp	File
sysc_get_robust_list.stp	File
sysc_getcpu.stp	File
sysc_getcwd.stp	File
sysc_getdents.stp	File
sysc_getegid.stp	File
sysc_geteuid.stp	File
sysc_getgid.stp	File
sysc_getgroups.stp	File
sysc_gethostname.stp	File
sysc_getitimer.stp	File
sysc_getpeername.stp	File
sysc_getpgid.stp	File
sysc_getpgrp.stp	File
sysc_getpid.stp	File
sysc_getppid.stp	File
sysc_getpriority.stp	File
sysc_getrandom.stp	File
sysc_getresgid.stp	File
sysc_getresuid.stp	File
sysc_getrlimit.stp	File
sysc_getrusage.stp	File
sysc_getsid.stp	File
sysc_getsockname.stp	File
sysc_getsockopt.stp	File
sysc_gettid.stp	File
sysc_gettimeofday.stp	File
sysc_getuid.stp	File
sysc_getxattr.stp	File
sysc_init_module.stp	File
sysc_inotify_add_watch.stp	File
sysc_inotify_init.stp	File
sysc_inotify_rm_watch.stp	File
sysc_io_cancel.stp	File
sysc_io_destroy.stp	File
sysc_io_getevents.stp	File
sysc_io_setup.stp	File
sysc_io_submit.stp	File
sysc_ioctl.stp	File
sysc_ioperm.stp	File
sysc_ioprio_get.stp	File
sysc_ioprio_set.stp	File
sysc_kcmp.stp	File
sysc_kexec_file_load.stp	File
sysc_kexec_load.stp	File
sysc_keyctl.stp	File
sysc_kill.stp	File
sysc_lchown.stp	File
sysc_lchown16.stp	File
sysc_lgetxattr.stp	File
sysc_link.stp	File
sysc_linkat.stp	File
sysc_listen.stp	File
sysc_listxattr.stp	File
sysc_llistxattr.stp	File
sysc_llseek.stp	File
sysc_lookup_dcookie.stp	File
sysc_lremovexattr.stp	File
sysc_lseek.stp	File
sysc_lsetxattr.stp	File
sysc_lstat.stp	File
sysc_madvise.stp	File
sysc_mbind.stp	File
sysc_membarrier.stp	File
sysc_memfd_create.stp	File
sysc_memfd_secret.stp	File
sysc_migrate_pages.stp	File
sysc_mincore.stp	File
sysc_mkdir.stp	File
sysc_mkdirat.stp	File
sysc_mknod.stp	File
sysc_mknodat.stp	File
sysc_mlock.stp	File
sysc_mlock2.stp	File
sysc_mlockall.stp	File
sysc_mmap2.stp	File
sysc_modify_ldt.stp	File
sysc_mount.stp	File
sysc_move_pages.stp	File
sysc_mprotect.stp	File
sysc_mq_getsetattr.stp	File
sysc_mq_notify.stp	File
sysc_mq_open.stp	File
sysc_mq_timedreceive.stp	File
sysc_mq_timedsend.stp	File
sysc_mq_unlink.stp	File
sysc_mremap.stp	File
sysc_msgctl.stp	File
sysc_msgget.stp	File
sysc_msgrcv.stp	File
sysc_msgsnd.stp	File
sysc_msync.stp	File
sysc_munlock.stp	File
sysc_munlockall.stp	File
sysc_munmap.stp	File
sysc_name_to_handle_at.stp	File
sysc_nanosleep.stp	File
sysc_nfsservctl.stp	File
sysc_ni_syscall.stp	File
sysc_nice.stp	File
sysc_open.stp	File
sysc_open_by_handle_at.stp	File
sysc_openat.stp	File
sysc_pause.stp	File
sysc_perf_event_open.stp	File
sysc_personality.stp	File
sysc_pipe.stp	File
sysc_pivot_root.stp	File
sysc_pkey_alloc.stp	File
sysc_pkey_free.stp	File
sysc_pkey_mprotect.stp	File
sysc_poll.stp	File
sysc_ppoll.stp	File
sysc_prctl.stp	File
sysc_pread.stp	File
sysc_preadv.stp	File
sysc_preadv2.stp	File
sysc_prlimit64.stp	File
sysc_process_vm_readv.stp	File
sysc_process_vm_writev.stp	File
sysc_pselect6.stp	File
sysc_pselect7.stp	File
sysc_ptrace.stp	File
sysc_pwrite.stp	File
sysc_pwritev.stp	File
sysc_pwritev2.stp	File
sysc_quotactl.stp	File
sysc_read.stp	File
sysc_readahead.stp	File
sysc_readdir.stp	File
sysc_readlink.stp	File
sysc_readlinkat.stp	File
sysc_readv.stp	File
sysc_reboot.stp	File
sysc_recv.stp	File
sysc_recvfrom.stp	File
sysc_recvmmsg.stp	File
sysc_recvmsg.stp	File
sysc_remap_file_pages.stp	File
sysc_removexattr.stp	File
sysc_rename.stp	File
sysc_renameat.stp	File
sysc_renameat2.stp	File
sysc_request_key.stp	File
sysc_restart_syscall.stp	File
sysc_rmdir.stp	File
sysc_rt_sigaction.stp	File
sysc_rt_sigpending.stp	File
sysc_rt_sigprocmask.stp	File
sysc_rt_sigqueueinfo.stp	File
sysc_rt_sigreturn.stp	File
sysc_rt_sigsuspend.stp	File
sysc_rt_sigtimedwait.stp	File
sysc_rt_tgsigqueueinfo.stp	File
sysc_sched_get_priority_max.stp	File
sysc_sched_get_priority_min.stp	File
sysc_sched_getaffinity.stp	File
sysc_sched_getattr.stp	File
sysc_sched_getparam.stp	File
sysc_sched_getscheduler.stp	File
sysc_sched_rr_get_interval.stp	File
sysc_sched_setaffinity.stp	File
sysc_sched_setattr.stp	File
sysc_sched_setparam.stp	File
sysc_sched_setscheduler.stp	File
sysc_sched_yield.stp	File
sysc_seccomp.stp	File
sysc_select.stp	File
sysc_semctl.stp	File
sysc_semget.stp	File
sysc_semop.stp	File
sysc_semtimedop.stp	File
sysc_send.stp	File
sysc_sendfile.stp	File
sysc_sendmmsg.stp	File
sysc_sendmsg.stp	File
sysc_sendto.stp	File
sysc_set_mempolicy.stp	File
sysc_set_robust_list.stp	File
sysc_set_tid_address.stp	File
sysc_setdomainname.stp	File
sysc_setfsgid.stp	File
sysc_setfsuid.stp	File
sysc_setgid.stp	File
sysc_setgroups.stp	File
sysc_sethostname.stp	File
sysc_setitimer.stp	File
sysc_setns.stp	File
sysc_setpgid.stp	File
sysc_setpriority.stp	File
sysc_setregid.stp	File
sysc_setresgid.stp	File
sysc_setresuid.stp	File
sysc_setreuid.stp	File
sysc_setrlimit.stp	File
sysc_setsid.stp	File
sysc_setsockopt.stp	File
sysc_settimeofday.stp	File
sysc_setuid.stp	File
sysc_setxattr.stp	File
sysc_sgetmask.stp	File
sysc_shmat.stp	File
sysc_shmctl.stp	File
sysc_shmdt.stp	File
sysc_shmget.stp	File
sysc_shutdown.stp	File
sysc_sigaction.stp	File
sysc_sigaltstack.stp	File
sysc_signal.stp	File
sysc_signalfd.stp	File
sysc_sigpending.stp	File
sysc_sigprocmask.stp	File
sysc_sigreturn.stp	File
sysc_sigsuspend.stp	File
sysc_socket.stp	File
sysc_socketpair.stp	File
sysc_splice.stp	File
sysc_ssetmask.stp	File
sysc_stat.stp	File
sysc_statfs.stp	File
sysc_statfs64.stp	File
sysc_statx.stp	File
sysc_stime.stp	File
sysc_swapoff.stp	File
sysc_swapon.stp	File
sysc_symlink.stp	File
sysc_symlinkat.stp	File
sysc_sync.stp	File
sysc_sync_file_range.stp	File
sysc_syncfs.stp	File
sysc_sysctl.stp	File
sysc_sysfs.stp	File
sysc_sysinfo.stp	File
sysc_syslog.stp	File
sysc_tee.stp	File
sysc_tgkill.stp	File
sysc_time.stp	File
sysc_timer_create.stp	File
sysc_timer_delete.stp	File
sysc_timer_getoverrun.stp	File
sysc_timer_gettime.stp	File
sysc_timer_settime.stp	File
sysc_timerfd.stp	File
sysc_timerfd_create.stp	File
sysc_timerfd_gettime.stp	File
sysc_timerfd_settime.stp	File
sysc_times.stp	File
sysc_tkill.stp	File
sysc_truncate.stp	File
sysc_tux.stp	File
sysc_umask.stp	File
sysc_umount.stp	File
sysc_uname.stp	File
sysc_unlink.stp	File
sysc_unlinkat.stp	File
sysc_unshare.stp	File
sysc_uselib.stp	File
sysc_userfaultfd.stp	File
sysc_ustat.stp	File
sysc_utime.stp	File
sysc_utimensat.stp	File
sysc_utimes.stp	File
sysc_vfork.stp	File
sysc_vhangup.stp	File
sysc_vmsplice.stp	File
sysc_wait4.stp	File
sysc_waitid.stp	File
sysc_waitpid.stp	File
sysc_write.stp	File
sysc_writev.stp	File
syscall_any.stp	File
syscall_table.stp	File
syscalls.stpm	File
syscalls_cfg_trunc.stp	File
target_set.stp	File
task.stp	File
task.stpm	File
task_ancestry.stp	File
task_time.stp	File
tcp.stp	File
tcpmib-filter-default.stp	File
tcpmib.stp	File
timestamp.stp	File
timestamp_gtod.stp	File
timestamp_monotonic.stp	File
tty.stp	File
tzinfo.stp	File
ucontext-symbols.stp	File
ucontext-unwind.stp	File
ucontext.stp	File
udp.stp	File
utrace.stp	File
vfs.stp	File