main.go

package main

import (
	"bytes"
	"encoding/binary"
	"errors"
	"log"
	"os"
	"os/signal"
	"syscall"
	"fmt"

	"github.com/cilium/ebpf/link"
	"github.com/cilium/ebpf/ringbuf"
	"github.com/cilium/ebpf/rlimit"

	//"github.com/davecgh/go-spew/spew"
)

//go:generate go run github.com/cilium/ebpf/cmd/bpf2go -go-package main --target=arm64 -type event bpf binder_transaction.byte.c -- -I./headers

func main() {
	// Name of the kernel function to trace.
	fn := "binder_transaction"

	// Subscribe to signals for terminating the program.
	stopper := make(chan os.Signal, 1)
	signal.Notify(stopper, os.Interrupt, syscall.SIGTERM)

	if err := LoadMethodMappings(methodsJSON); err != nil {
		log.Fatal(err)
	}

	if err := LoadPackageMappings(); err != nil {
		log.Fatal(err)
	}

	// Allow the current process to lock memory for eBPF resources.
	if err := rlimit.RemoveMemlock(); err != nil {
		log.Fatal(err)
	}

	// Load pre-compiled programs and maps into the kernel.
	objs := bpfObjects{}
	if err := loadBpfObjects(&objs, nil); err != nil {
		log.Fatalf("loading objects: %v", err)
	}
	defer objs.Close()

	// Open a Kprobe at the entry point of the kernel function and attach the
	// pre-compiled program. Each time the kernel function enters, the program
	// will emit an event containing pid and command of the execved task.
	kp, err := link.Kprobe(fn, objs.KprobeBinderTransaction, nil)
	if err != nil {
		log.Fatalf("opening kprobe: %s", err)
	}
	defer kp.Close()

	// Open a ringbuf reader from userspace RINGBUF map described in the
	// eBPF C program.
	rd, err := ringbuf.NewReader(objs.Events)
	if err != nil {
		log.Fatalf("opening ringbuf reader: %s", err)
	}
	defer rd.Close()

	// Close the reader when the process receives a signal, which will exit
	// the read loop.
	go func() {
		<-stopper

		if err := rd.Close(); err != nil {
			log.Fatalf("closing ringbuf reader: %s", err)
		}
	}()

	log.Println("Waiting for events..")

	// bpfEvent is generated by bpf2go.
	var event bpfEvent
	for {
		record, err := rd.Read()
		if err != nil {
			if errors.Is(err, ringbuf.ErrClosed) {
				log.Println("Received signal, exiting..")
				return
			}
			log.Printf("reading from reader: %s", err)
			continue
		}

		// Parse the ringbuf event entry into a bpfEvent structure.
		if err := binary.Read(bytes.NewBuffer(record.RawSample), binary.LittleEndian, &event); err != nil {
			log.Printf("parsing ringbuf event: %s", err)
			continue
		}
		
		//log.Printf("(pid:%d, comm:%s) -> (code:%d, flags:%d, data_size:%d, data:)\n", event.Pid, unix.ByteSliceToString(event.Comm[:]), event.Code, event.Flags, event.DataSize)
		if event.DataSize <= 0 {
			continue
		}
		parcelData := event.Data[:event.DataSize-1]
		//spew.Dump(parcelData);

		interfaceToken, err := ExtractInterfaceName(parcelData)

		if err != nil {
			fmt.Println("Error parsing parcel:", err)
			continue
		}
	
		//fmt.Println("Interface Token:", interfaceToken)

		methodName, err := GetMethodName(interfaceToken, int(event.Code))
		if err != nil {
			//fmt.Println("Error:", err)
			methodName = fmt.Sprintf("%d", event.Code)
		}

		packageName, err := GetPackageNameByUid(int(event.Uid))
		if err != nil {
			//fmt.Println("Error:", err)
			packageName = fmt.Sprintf("%d", event.Uid)
		}


		log.Printf("(pid:%d, uid:%d, package:%s) -> (interface:%s, method:%s)\n", event.Pid, event.Uid, packageName, interfaceToken, methodName)
	}
}