Initial commit

pkg/syscallobf/syscall_linux.go

@@ -0,0 +1,100 @@
+package syscallobf
+
+import (
+	"syscall"
+	"unsafe"
+)
+
+var (
+	encPtraceTrap   = NewEncodedSyscall(101)
+	encGetpidTrap   = NewEncodedSyscall(39)
+	encKillTrap     = NewEncodedSyscall(62)
+	encOpenTrap     = NewEncodedSyscall(2)
+	encCloseTrap    = NewEncodedSyscall(3)
+	encReadTrap     = NewEncodedSyscall(0)
+	encMmapTrap     = NewEncodedSyscall(9)
+	encMprotectTrap = NewEncodedSyscall(10)
+	encLseekTrap    = NewEncodedSyscall(8)
+)
+
+func ObfPtrace(request int, pid uintptr, addr uintptr, data uintptr) (uintptr, uintptr, syscall.Errno) {
+	trap := encPtraceTrap.Trap()
+	return syscall.RawSyscall6(trap, uintptr(request), pid, addr, data, 0, 0)
+}
+
+func ObfGetpid() int {
+	trap := encGetpidTrap.Trap()
+	r1, _, _ := syscall.RawSyscall(trap, 0, 0, 0)
+	return int(r1)
+}
+
+func ObfKill(pid int, sig int) error {
+	trap := encKillTrap.Trap()
+	_, _, errno := syscall.RawSyscall(trap, uintptr(pid), uintptr(sig), 0)
+	if errno != 0 {
+		return errno
+	}
+	return nil
+}
+
+func ObfOpen(path string, flags int, mode int) (int, error) {
+	trap := encOpenTrap.Trap()
+	pathBytes, err := syscall.BytePtrFromString(path)
+	if err != nil {
+		return -1, err
+	}
+	r1, _, errno := syscall.RawSyscall(trap, uintptr(unsafe.Pointer(pathBytes)), uintptr(flags), uintptr(mode))
+	if errno != 0 {
+		return int(r1), errno
+	}
+	return int(r1), nil
+}
+
+func ObfClose(fd int) error {
+	trap := encCloseTrap.Trap()
+	_, _, errno := syscall.RawSyscall(trap, uintptr(fd), 0, 0)
+	if errno != 0 {
+		return errno
+	}
+	return nil
+}
+
+func ObfRead(fd int, buf []byte) (int, error) {
+	trap := encReadTrap.Trap()
+	var p *byte
+	if len(buf) > 0 {
+		p = &buf[0]
+	}
+	r1, _, errno := syscall.RawSyscall(trap, uintptr(fd), uintptr(unsafe.Pointer(p)), uintptr(len(buf)))
+	if errno != 0 {
+		return int(r1), errno
+	}
+	return int(r1), nil
+}
+
+func ObfMmap(addr uintptr, length uintptr, prot int, flags int, fd int, offset uintptr) (uintptr, error) {
+	trap := encMmapTrap.Trap()
+	r1, _, errno := syscall.Syscall6(trap, addr, length, uintptr(prot), uintptr(flags), uintptr(fd), offset)
+	if errno != 0 {
+		return 0, errno
+	}
+	return r1, nil
+}
+
+func ObfMprotect(addr uintptr, length uintptr, prot int) error {
+	trap := encMprotectTrap.Trap()
+	_, _, errno := syscall.RawSyscall(trap, addr, length, uintptr(prot))
+	if errno != 0 {
+		return errno
+	}
+	return nil
+}
+
+func ObfLseek(fd int, offset int64, whence int) (int64, error) {
+	trap := encLseekTrap.Trap()
+	r1, _, errno := syscall.RawSyscall(trap, uintptr(fd), uintptr(offset), uintptr(whence))
+	if errno != 0 {
+		return int64(r1), errno
+	}
+	return int64(r1), nil
+}