diff --git a/kern/bash_kern.c b/kern/bash_kern.c index 5a08000c9..5f95c4cd1 100644 --- a/kern/bash_kern.c +++ b/kern/bash_kern.c @@ -2,7 +2,7 @@ struct event { u32 pid; - u8 line[80]; + u8 line[MAX_DATA_SIZE_BASH]; u32 retval; char comm[TASK_COMM_LEN]; }; @@ -60,4 +60,4 @@ int uretprobe_bash_retval(struct pt_regs *ctx){ sizeof(struct event)); } return 0; -} \ No newline at end of file +} diff --git a/kern/common.h b/kern/common.h index 41d763533..123011b1e 100644 --- a/kern/common.h +++ b/kern/common.h @@ -15,6 +15,7 @@ #define MAX_DATA_SIZE_OPENSSL 1024 * 4 #define MAX_DATA_SIZE_MYSQL 256 #define MAX_DATA_SIZE_POSTGRES 256 +#define MAX_DATA_SIZE_BASH 256 // enum_server_command, via // https://dev.mysql.com/doc/internals/en/com-query.html COM_QUERT command 03 @@ -35,4 +36,4 @@ const volatile u64 target_pid = 0; char __license[] SEC("license") = "Dual MIT/GPL"; __u32 _version SEC("version") = 0xFFFFFFFE; -#endif \ No newline at end of file +#endif diff --git a/user/event_bash.go b/user/event_bash.go index cd925fb0f..e59f6a24a 100644 --- a/user/event_bash.go +++ b/user/event_bash.go @@ -8,10 +8,19 @@ import ( "golang.org/x/sys/unix" ) +/* + u32 pid; + u8 line[MAX_DATE_SIZE_BASH]; + u32 retval; + char comm[TASK_COMM_LEN]; +*/ + +const MAX_DATA_SIZE_BASH = 256 + type bashEvent struct { module IModule Pid uint32 - Line [80]uint8 + Line [MAX_DATA_SIZE_BASH]uint8 Retval uint32 Comm [16]byte }