Hooking read syscall

Question

I have a kernel module that is hooking the read syscall. One of the things I have to do, is capture the contents of the read syscall that is doing an external program submitted by my teacher.

With the strace, I was able to see how the program of my teacher is doing the read:

read(6, "\v\0\0\0\tExercise1", 14)

And the read hooking is working, the problem is, I don't know how to read the contents from inside the new read function because if I am correctly *buf is empty and is not filled until the original syscall read is called. So, in theory I should read directly from the file descriptor, but without using read syscall I don't know how to do that.

Any ideas? Thanks!

Answer 1

Basically, your hooking function should be something like the following :

size_t my_hooked_read(int fildes, void *buf, size_t nbytes)
{
  size_t ret;

  //Do something before original call

  ret = original_read(fildes, buf, nbytes); //call the original read !

  //Do something after original call
  //buf is correctly filled here !

  return ret;
}

If you want to read the content of buf, read it after the original call.