title: Hijack Syscall: Access system call arguments from struct pt_regs (64bit-x86)
body: <p>Using kprobes pre_handler, I am trying to access the system call arguments from struct pt_regs and modify them(which is the main goal), before calling the actual system call itself.</p>
  
  <p>Say I am probing <code>sys_link</code>.</p>
  
  <pre><code>asmlinkage long sys_link(const char __user *oldname, const char __user *newname);
  </code></pre>
  
  <p>The pre_handler is defined as follows:(from <a href="http://www-users.cs.umn.edu/~boutcher/kprobes/" rel="nofollow">here</a>) </p>
  
  <pre><code>static int handler_pre(struct kprobe *p, struct pt_regs *regs)
  {
       printk(KERN_INFO "eax: %08lx   ebx: %08lx   ecx: %08lx   edx: %08lx\n",
              regs-&gt;orig_ax, regs-&gt;bx, regs-&gt;cx, regs-&gt;dx);
       printk(KERN_INFO "esi: %08lx   edi: %08lx   ebp: %08lx   esp: %08lx\n",
              regs-&gt;si, regs-&gt;di, regs-&gt;bp, regs-&gt;sp);
       printk(KERN_INFO "Process %s (pid: %d, threadinfo=%p task=%p)",
               current-&gt;comm, current-&gt;pid, current_thread_info(), current);
  return 0;
  }
  </code></pre>
  
  <p>When I run <code>link file1 file2</code> on the terminal, dmesg gives the following output:</p>
  
  <pre><code>[15105.691463] eax: ffffffffffffffff   ebx: 7fff3e2e71c8   ecx: 7fff3e2e6e50   edx: 00000003
  [15105.691467] esi: 7fff3e2e9478   edi: 7fff3e2e9472   ebp: 00000003   esp: ffff880022b0ff80
  [15105.691472] Process link (pid: 9448, threadinfo=ffff880022b0e000 task=ffff880018b72e00)Pid: 9448, comm: link Tainted: P         C O 3.2.0-53-generic #81-Ubuntu
  </code></pre>
  
  <p>The first two arguments go to registers <code>edi</code> and <code>esi</code>, therefore in this case, <code>edi</code> must contain address of <code>file1</code> and <code>esi</code> must contain address of <code>file2</code>.</p>
  
  <p>I want to modify these register values, say change the value in <code>esi</code> to point to <code>file3</code> (therefore the char __user *newname is now pointing to <code>file3</code>), before I return from the pre_handler. Given such a modification, now <code>sys_link</code> should work with <code>file1</code> and <code>file3</code> as its arguments.
  Is this possible? If so, how? </p>