diff --git a/plugins/epan/tracee-event/enrichments.c b/plugins/epan/tracee-event/enrichments.c index 54ac856..8463a2b 100644 --- a/plugins/epan/tracee-event/enrichments.c +++ b/plugins/epan/tracee-event/enrichments.c @@ -156,12 +156,37 @@ static int enrich_security_socket_connect(tvbuff_t *tvb _U_, packet_info *pinfo, return enrich_security_socket_bind_connect(pinfo, "Connect"); } +static const gchar *get_mem_prot_alert_str(guint alert) +{ + switch (alert) { + case 1: + return "Mmaped region with W+E permissions!"; + case 2: + return "Protection changed to Executable!"; + case 3: + return "Protection changed from E to W+E!"; + case 4: + return "Protection changed from W to E!"; + default: + return "Unknown alert"; + } +} + static int enrich_dynamic_code_loading(tvbuff_t *tvb _U_, packet_info *pinfo, proto_tree *tree _U_, void *data _U_) { - const gchar *alert = wanted_field_get_str("tracee.args.dynamic_code_loading.triggered_by.alert"); + const struct field_value *alert; + const gchar *alert_str = NULL; + + if ((alert = wanted_field_get_one("tracee.args.dynamic_code_loading.triggered_by.alert")) == NULL) + return 0; + + if (alert->type == FIELD_TYPE_STRING) + alert_str = alert->val.val_string; + else if (alert->type == FIELD_TYPE_UINT) + alert_str = get_mem_prot_alert_str(alert->val.val_uint); - if (alert) - col_append_str(pinfo->cinfo, COL_INFO, alert); + if (alert_str != NULL) + col_append_str(pinfo->cinfo, COL_INFO, alert_str); return 0; } @@ -178,7 +203,7 @@ static int enrich_fileless_execution(tvbuff_t *tvb _U_, packet_info *pinfo, prot static int enrich_stdio_over_socket(tvbuff_t *tvb _U_, packet_info *pinfo, proto_tree *tree _U_, void *data _U_) { - gint *fd; + const gint *fd; const gchar *addr, *port, *stream; fd = wanted_field_get_int("tracee.args.stdio_over_socket.File_descriptor"); diff --git a/plugins/epan/tracee-event/process_tree.c b/plugins/epan/tracee-event/process_tree.c index 8a59df7..6b87f19 100644 --- a/plugins/epan/tracee-event/process_tree.c +++ b/plugins/epan/tracee-event/process_tree.c @@ -31,7 +31,7 @@ static struct container_info *dup_container_info(const struct container_info *co void process_tree_update(struct tracee_dissector_data *data) { - gint *fork_child_pid, *fork_child_tid; + const gint *fork_child_pid, *fork_child_tid; gint *pid_key, *pid_val; struct process_info *process; diff --git a/plugins/epan/tracee-event/tracee.h b/plugins/epan/tracee-event/tracee.h index 6fb662f..41a6ddb 100644 --- a/plugins/epan/tracee-event/tracee.h +++ b/plugins/epan/tracee-event/tracee.h @@ -67,10 +67,10 @@ struct field_value { }; void register_wanted_field(const gchar *filter_name); -wmem_array_t *wanted_field_get(const gchar *filter_name); -struct field_value *wanted_field_get_one(const gchar *filter_name); +const wmem_array_t *wanted_field_get(const gchar *filter_name); +const struct field_value *wanted_field_get_one(const gchar *filter_name); const gchar *wanted_field_get_str(const gchar *filter_name); -gint *wanted_field_get_int(const gchar *filter_name); +const gint *wanted_field_get_int(const gchar *filter_name); proto_item *proto_tree_add_int_wanted(proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, gint32 value); proto_item *proto_tree_add_uint_wanted(proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, guint32 value); diff --git a/plugins/epan/tracee-event/wanted_fields.c b/plugins/epan/tracee-event/wanted_fields.c index 9dee8b6..4fcdf71 100644 --- a/plugins/epan/tracee-event/wanted_fields.c +++ b/plugins/epan/tracee-event/wanted_fields.c @@ -26,24 +26,24 @@ void register_wanted_field(const gchar *filter_name) wmem_map_insert(wanted_fields, key, NULL); } -wmem_array_t *wanted_field_get(const gchar *filter_name) +const wmem_array_t *wanted_field_get(const gchar *filter_name) { return wmem_map_lookup(wanted_field_values, filter_name); } -struct field_value *wanted_field_get_one(const gchar *filter_name) +const struct field_value *wanted_field_get_one(const gchar *filter_name) { - wmem_array_t *values = wanted_field_get(filter_name); + const wmem_array_t *values = wanted_field_get(filter_name); - if (values && wmem_array_get_count(values) >= 1) - return *((struct field_value **)wmem_array_index(values, 0)); + if (values && wmem_array_get_count((wmem_array_t *)values) >= 1) + return *((struct field_value **)wmem_array_index((wmem_array_t *)values, 0)); return NULL; } const gchar *wanted_field_get_str(const gchar *filter_name) { - struct field_value *fv; + const struct field_value *fv; if ((fv = wanted_field_get_one(filter_name)) == NULL) return NULL; @@ -52,9 +52,9 @@ const gchar *wanted_field_get_str(const gchar *filter_name) return fv->val.val_string; } -gint *wanted_field_get_int(const gchar *filter_name) +const gint *wanted_field_get_int(const gchar *filter_name) { - struct field_value *fv; + const struct field_value *fv; if ((fv = wanted_field_get_one(filter_name)) == NULL) return NULL;