DragonFlyBSD Kernel Audit
DF-2898 / libcind.c
← back to finding ↓ download raw
/*
 * libc-based indirect syscall matrix on the instrumented kernel.
 * usage: libcind <p|w|m> [count]
 */
#include <sys/syscall.h>
#include <sys/mman.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

int main(int argc, char **argv)
{
	char m = argc > 1 ? argv[1][0] : 'p';
	long n = argc > 2 ? atol(argv[2]) : 1;
	long i, r = 0;
	char buf[2] = "X\n";

	for (i = 0; i < n; i++) {
		switch (m) {
		case 'p':
			r = syscall(SYS_syscall, 20);
			break;
		case 'w':
			r = syscall(SYS_syscall, 4, 1, buf, 2);
			break;
		case 'm':
			r = syscall(SYS_syscall, 197, 0, 4096,
				    PROT_READ|PROT_WRITE,
				    MAP_ANON|MAP_PRIVATE, -1, 0);
			break;
		case 'M':	/* via SYS___syscall (198) */
			r = syscall(SYS___syscall, 197, 0, 4096,
				    PROT_READ|PROT_WRITE,
				    MAP_ANON|MAP_PRIVATE, -1, 0);
			break;
		}
		if ((m == 'm' || m == 'M') && r > 0)
			munmap((void *)r, 4096);
	}
	printf("%c done %ld iters (last=0x%lx)\n", m, n, (unsigned long)r);
	return 0;
}