External/pmg
1
0
Fork 0
mirror of https://github.com/safedep/pmg.git synced 2026-08-03 07:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix main.go

Browse Source
This commit is contained in:
Sahilb315
2026-07-24 22:54:20 +05:30
parent da6e10d2ad
commit b8e12c27ae
1 changed files with 86 additions and 69 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ebpf-poc/main.go
+86 -69
View File
@@ -2,88 +2,105 @@
package main
import (
"bytes"
"context"
"encoding/binary"
"errors"
"fmt"
"net"
"os"
"os/signal"
"syscall"
"github.com/cilium/ebpf"
"github.com/cilium/ebpf/link"
"github.com/cilium/ebpf/ringbuf"
"github.com/cilium/ebpf/rlimit"
)
func main() {
// err := rlimit.RemoveMemlock()
// if err != nil {
// fmt.Printf("Failed to remove mem lock: %v\n", err)
// return
// }
err := rlimit.RemoveMemlock()
if err != nil {
fmt.Printf("Failed to remove mem lock: %v\n", err)
return
}
// var objs bpfObjects
// err = loadBpfObjects(&objs, nil)
// if err != nil {
// fmt.Printf("Failed to load bpf objects: %v\n", err)
// return
// }
var objs bpfObjects
err = loadBpfObjects(&objs, nil)
if err != nil {
fmt.Printf("Failed to load bpf objects: %v\n", err)
return
}
// defer objs.Close()
defer objs.Close()
// rootCgroup := "/sys/fs/cgroup"
rootCgroup := "/sys/fs/cgroup"
// l, err := link.AttachCgroup(link.CgroupOptions{
// Path: rootCgroup,
// Attach: ebpf.AttachCGroupInet4Connect,
// Program: objs.Connect4,
// })
// if err != nil {
// fmt.Printf("Failed to attach cgroup: %v\n", err)
// return
// }
// defer l.Close()
l, err := link.AttachCgroup(link.CgroupOptions{
Path: rootCgroup,
Attach: ebpf.AttachCGroupInet4Connect,
Program: objs.Connect4,
})
if err != nil {
fmt.Printf("Failed to attach cgroup: %v\n", err)
return
}
defer l.Close()
// rd, err := ringbuf.NewReader(objs.Events)
// if err != nil {
// fmt.Printf("Failed to create ringbuf reader: %v\n", err)
// return
// }
// defer rd.Close()
rd, err := ringbuf.NewReader(objs.Events)
if err != nil {
fmt.Printf("Failed to create ringbuf reader: %v\n", err)
return
}
defer rd.Close()
// ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
// defer stop() // Cleans up resources allocated by the signal package
ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
defer stop() // Cleans up resources allocated by the signal package
// fmt.Println("Application started. Press Ctrl+C to exit.")
fmt.Println("Application started. Press Ctrl+C to exit.")
// go func() {
// <-ctx.Done()
// fmt.Println("\nSignal received, detaching and cleaning up...")
// rd.Close()
// }()
go func() {
<-ctx.Done()
fmt.Println("\nSignal received, detaching and cleaning up...")
rd.Close()
}()
// var e bpfEvent
// for {
// rec, err := rd.Read()
// if err != nil {
// if errors.Is(err, ringbuf.ErrClosed) {
// return
// }
// fmt.Printf("failed to read raw event: %v\n", err)
// continue
// }
var e bpfEvent
for {
rec, err := rd.Read()
if err != nil {
if errors.Is(err, ringbuf.ErrClosed) {
return
}
fmt.Printf("failed to read raw event: %v\n", err)
continue
}
// err = binary.Read(bytes.NewReader(rec.RawSample), binary.LittleEndian, &e)
// if err != nil {
// fmt.Printf("failed to read event: %v\n", err)
// continue
// }
err = binary.Read(bytes.NewReader(rec.RawSample), binary.LittleEndian, &e)
if err != nil {
fmt.Printf("failed to read event: %v\n", err)
continue
}
// ip := make(net.IP, 4)
// binary.LittleEndian.PutUint32(ip, e.Daddr)
ip := make(net.IP, 4)
binary.LittleEndian.PutUint32(ip, e.Daddr)
// name := e.Comm[:]
// if i := bytes.IndexByte(name, 0); i != -1 {
// name = name[:i] // keep bytes before the first NUL
// }
// comm := string(name)
name := e.Comm[:]
if i := bytes.IndexByte(name, 0); i != -1 {
name = name[:i] // keep bytes before the first NUL
}
comm := string(name)
// proto := ""
// switch e.Proto {
// case syscall.IPPROTO_TCP:
// proto = "TCP"
// case syscall.IPPROTO_UDP:
// proto = "UDP"
// }
proto := ""
switch e.Proto {
case syscall.IPPROTO_TCP:
proto = "TCP"
case syscall.IPPROTO_UDP:
proto = "UDP"
}
// fmt.Println()
// fmt.Printf("PID: %v\nUID: %v\ndAddr: %v\ndPort: %v\nProto: %v\nCommand: %v\n", e.Pid, e.Uid, ip, e.Dport, proto, comm)
// }
fmt.Println()
fmt.Printf("PID: %v\nUID: %v\ndAddr: %v\ndPort: %v\nProto: %v\nCommand: %v\n", e.Pid, e.Uid, ip, e.Dport, proto, comm)
}
}