linux - Kprobe/Jprobe in the middle of a function -

i want intercept load_elf_binary function in fs/binfmt_elf.c file, read few custom section headers file passed via argument , set few registers(eax, ebx, ecx, edx) before returning function.

now read jprobes way access arguments of target function problem once control returns jprobes function register , stack values restored per it's specifications, looking way around , inserting probe in middle of function (preferably towards end) idea. please correct me if wrong , this.

so, let me see if understand you're doing properly.

you've modified cpu (running in emulator?) instruction 0xf1 sort of cryptographic thing. want arrange load_elf_binary invoke instruction on return, registers set instruction magic. somehow custom sections involved.

this going difficult in way state. there few major problems:

1. i'm not sure threat model is, if magic cpu instruction decrypts mapped data directly you'll modify pages in linux page cache, , decrypted code or data visible other processes mmap these pages.
2. moreover, if kernel frees pages later, encrypted data reloaded memory, resulting in crashes @ unpredictable times.
3. if process makes pages dirty, decrypted data flushed disk, leaving mix of decrypted , encrypted data on disk.
4. if use jprobe, callback invoked on entry function, way anyway.

all in all, isn't going work way state it.

a better approach might define own binfmt (or replace load_binary callback in elf_format). binfmt load binary in whatever way needs to. if want leverage existing elf loader, delegate load_elf_binary, , on return whatever need manipulate loaded process, without of jprobe stuff.

in either case, sure remap of pages you're encrypting/decrypting map_private , mark them dirty before changing contents.