4 files changed, 262 insertions, 5 deletions

diff --git a/.gitignore b/.gitignore
index 6cff91d..8bbe3e4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,3 @@
 .vscode/*
-godo
\ No newline at end of file
+godo
+
diff --git a/go.mod b/go.mod
index c73fc4f..2969b32 100644
--- a/go.mod
+++ b/go.mod
@@ -4,6 +4,7 @@ go 1.21.5
 
 require (
         github.com/elastic/go-libaudit/v2 v2.5.0
+        github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826
         gopkg.in/yaml.v3 v3.0.1
 )
 
diff --git a/go.sum b/go.sum
index 6880c39..7ce498a 100644
--- a/go.sum
+++ b/go.sum
@@ -7,6 +7,8 @@ github.com/elastic/go-licenser v0.4.1 h1:1xDURsc8pL5zYT9R29425J3vkHdt4RT5TNEMeRN
 github.com/elastic/go-licenser v0.4.1/go.mod h1:V56wHMpmdURfibNBggaSBfqgPxyT1Tldns1i87iTEvU=
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNUXsshfwJMBgNA0RU6/i7WVaAegv3PtuIHPMs=
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8=
+github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 h1:RWengNIwukTxcDr9M+97sNutRR1RKhG96O6jWumTTnw=
+github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826/go.mod h1:TaXosZuwdSHYgviHp1DAtfrULt5eUgsSMsZf+YrPgl8=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
diff --git a/godo.go b/godo.go
index 6b6f48f..2ba97d1 100644
--- a/godo.go
+++ b/godo.go
@@ -9,12 +9,15 @@ import (
         "os"
         "os/exec"
         "path/filepath"
+        "regexp"
         "strconv"
         "strings"
         "sync"
+        "time"
 
         "github.com/elastic/go-libaudit/v2"
         "github.com/elastic/go-libaudit/v2/auparse"
+        "github.com/mohae/deepcopy"
 )
 
 var (
@@ -26,8 +29,19 @@ var (
         receiveOnly = fs.Bool("ro", false, "receive only using multicast, requires kernel 3.16+")
 )
 
+type Event struct {
+        timestamp time.Time
+        pid, ppid int
+        syscall   int
+        argc      int
+        args      []string
+        cwd       string
+}
+
 type process struct {
         cmdline  string
+        argv     []string
+        cwd      string
         rootfs   string
         children []int
 }
@@ -35,6 +49,10 @@ type process struct {
 var pids map[int]*process     //古希腊掌管进程的神
 var containers map[string]int // 古希腊掌管容器的神
 var wg sync.WaitGroup         // 掌管协程
+var rawChan chan interface{}  // 从接收到整理的管道，这里不是原始数据类型，下文解释
+var cookedChan chan Event     // 整理好的信息的管道
+
+var syscallTable [500]string //记录一下系统调用
 
 func main() {
         // 检查用户身份，并添加auditd规则，监听所有syscall
@@ -42,7 +60,14 @@ func main() {
                 fmt.Printf("Err: Please run me as root, %d!\n", os.Getegid())
                 return
         }
-        syscall := [5]string{"fork", "vfork", "execve", "exit", "exit_group"}
+
+        // 所有的系统调用号与名称的关系
+        err := figureOutSyscalls()
+        if err != nil {
+                fmt.Printf("Error figuring out syscall numbers: %v\n", err)
+        }
+
+        syscall := [6]string{"fork", "vfork", "clone", "execve", "exit", "exit_group"}
         var auditCmd *exec.Cmd
         auditCmd = exec.Command("auditctl", "-D") // 清空所有规则
         auditCmd.Run()
@@ -58,9 +83,14 @@ func main() {
                 fmt.Printf("Error finding containerd: %v\n", err)
                 return
         }
-
+        // 数据结构初始化
         pids = make(map[int]*process)
         containers = make(map[string]int)
+
+        // 创世之神，1号进程
+        pids[1] = &process{rootfs: "/", children: make([]int, 0)}
+        pids[1].children = append(pids[1].children, containerdPid)
+        // /usr/bin/containerd，也就是我们最关注的进程
         pids[containerdPid] = &process{cmdline: "/usr/bin/cmdline", rootfs: "/", children: make([]int, 0)}
 
         // 开始运行，解析命令行参数后监听
@@ -73,6 +103,29 @@ func main() {
         }
 }
 
+func figureOutSyscalls() error {
+        NRRegex := regexp.MustCompile(`#define __NR_(.*?) (\d+)$`)
+        file, err := os.Open("/usr/include/asm/unistd_64.h")
+        if err != nil {
+                return err
+        }
+        defer file.Close()
+
+        scanner := bufio.NewScanner(file)
+        for scanner.Scan() {
+                line := scanner.Text()
+                if NRRegex.MatchString(line) {
+                        match := NRRegex.FindStringSubmatch(line)
+                        num, err := strconv.Atoi(match[2])
+                        if err != nil {
+                                return err
+                        }
+                        syscallTable[num] = match[1]
+                }
+        }
+        return nil
+}
+
 func getPid() (int, error) {
         // 指定要搜索的关键词
         keyword := "/usr/bin/containerd"
@@ -122,6 +175,37 @@ func containsKeyword(pid int, keyword string) bool {
         return false
 }
 
+func getTimeFromStr(timeStr string) (time.Time, error) {
+        timestampFloat, err := strconv.ParseFloat(timeStr, 64)
+        if err != nil {
+                return time.Unix(0, 0), err
+        }
+        secs := int64(timestampFloat)
+        nsecs := int64((timestampFloat - float64(secs)) * 1e9)
+
+        // 只精确到毫秒就够了
+        t := time.Unix(secs, nsecs).Truncate(time.Millisecond)
+        return t, nil
+}
+
+func hexToAscii(hexString string) string {
+        bytes := []byte{}
+        for i := 0; i < len(hexString); i += 2 {
+                hexPair := hexString[i : i+2]
+                // 将十六进制数转换为十进制数
+                decimal, err := strconv.ParseInt(hexPair, 16, 8)
+                if err != nil {
+                        return "Invalid hex string"
+                }
+                char := byte(decimal)
+                bytes = append(bytes, char)
+        }
+
+        asciiString := strings.ReplaceAll(string(bytes), "\000", " ")
+
+        return asciiString
+}
+
 func read() error {
         // Write netlink response to a file for further analysis or for writing
         // tests cases.
@@ -192,10 +276,25 @@ func read() error {
                 }
         }
 
-        return receive(client)
+        // 各协程至此开始
+        // return receive(client)
+        rawChan = make(chan interface{})
+        cookedChan = make(chan Event)
+        wg.Add(1)
+        go receive(client)
+        wg.Add(1)
+        go orgnaze()
+        wg.Add(1)
+        go deal()
+
+        wg.Wait()
+        time.Sleep(2 * time.Second)
+        return nil
 }
 
 func receive(r *libaudit.AuditClient) error {
+        defer wg.Done()
+        defer close(rawChan)
         for {
                 rawEvent, err := r.Receive(false)
                 if err != nil {
@@ -208,6 +307,160 @@ func receive(r *libaudit.AuditClient) error {
                         continue
                 }
 
-                fmt.Printf("type=%v msg=%s\n", rawEvent.Type, rawEvent.Data)
+                rawEventMessage := deepcopy.Copy(*rawEvent)
+                rawChan <- rawEventMessage
+        }
+}
+
+func orgnaze() {
+        defer wg.Done()
+        defer close(cookedChan)
+        // 接收信息
+        var raw interface{}
+        var ok bool
+        var rawEvent libaudit.RawAuditMessage
+        // 事件信息
+        var eventId, argc int
+        var err [6]error
+        var event, cooked Event
+        // 为每个事务id存储其信息，事务id在操作系统运行期间是唯一的
+        eventTable := make(map[int]*Event)
+        // 要用的正则匹配列表
+        syscallRegex := regexp.MustCompile(`audit\((\d+\.\d+):(\d+)\).*?syscall=(\d+).*?ppid=(\d+) pid=(\d+).*?$`)
+        execveRegex := regexp.MustCompile(`audit\(\d+\.\d+:(\d+)\): argc=(\d+)`)
+        argsRegex := regexp.MustCompile(`a\d+=("(.*?)"|([0-9a-fA-F]+))`)
+        cwdRegex := regexp.MustCompile(`audit\(\d+\.\d+:(\d+)\):  cwd="(.*?)"`)
+        proctitleRegex := regexp.MustCompile(`audit\(\d+\.\d+:(\d+)\): proctitle=("(.*?)"|([0-9a-fA-F]+))$`)
+        eoeRegex := regexp.MustCompile(`audit\(\d+\.\d+:(\d+)\)`)
+        for {
+                raw, ok = <-rawChan
+                if !ok {
+                        break
+                }
+                rawEvent = raw.(libaudit.RawAuditMessage)
+
+                // type Event struct {
+                //      timestamp time.Time
+                //      pid, ppid int
+                //      syscall   int
+                //      argc      int
+                //      args      []string
+                //      cwd       string
+                // }
+                switch rawEvent.Type {
+                case auparse.AUDIT_SYSCALL:
+                        if syscallRegex.Match(rawEvent.Data) {
+                                match := syscallRegex.FindSubmatch(rawEvent.Data)
+                                event.timestamp, err[0] = getTimeFromStr(string(match[1]))
+                                eventId, err[1] = strconv.Atoi(string(match[2]))
+                                event.syscall, err[2] = strconv.Atoi(string(match[3]))
+                                event.ppid, err[3] = strconv.Atoi(string(match[4]))
+                                event.pid, err[4] = strconv.Atoi(string(match[5]))
+                                eventTable[eventId] = &Event{
+                                        timestamp: event.timestamp,
+                                        syscall:   event.syscall,
+                                        ppid:      event.ppid,
+                                        pid:       event.pid,
+                                        argc:      0,
+                                        args:      make([]string, 0),
+                                        cwd:       "",
+                                }
+                        }
+                case auparse.AUDIT_EXECVE:
+                        if execveRegex.Match(rawEvent.Data) {
+                                match := execveRegex.FindSubmatch(rawEvent.Data)
+                                eventId, err[0] = strconv.Atoi(string(match[1]))
+                                argc, err[1] = strconv.Atoi(string(match[2]))
+                                if err[0] == nil && err[1] == nil && argsRegex.Match(rawEvent.Data) {
+                                        match := argsRegex.FindAllSubmatch(rawEvent.Data, -1)
+                                        for i := 0; i < argc; i++ {
+                                                if len(match[i][2]) == 0 {
+                                                        // 代表着匹配到的是十六进制数
+                                                        str := hexToAscii(string(match[i][3]))
+                                                        eventTable[eventId].args = append(eventTable[eventId].args, str)
+                                                        fmt.Printf("Origin: \"%s\", Res: \"%s\"\n", match[i][3], str)
+                                                } else {
+                                                        eventTable[eventId].args = append(eventTable[eventId].args, string(match[i][2]))
+                                                }
+                                        }
+                                        eventTable[eventId].argc = argc
+                                }
+                        }
+                // case auparse.AUDIT_PATH:
+                case auparse.AUDIT_CWD:
+                        if cwdRegex.Match(rawEvent.Data) {
+                                match := cwdRegex.FindSubmatch(rawEvent.Data)
+                                eventId, err[0] = strconv.Atoi(string(match[1]))
+                                eventTable[eventId].cwd = string(match[2])
+                        }
+                case auparse.AUDIT_PROCTITLE:
+                        if proctitleRegex.Match(rawEvent.Data) {
+                                var cmdline string
+                                var pEvent *Event
+                                match := proctitleRegex.FindSubmatch(rawEvent.Data)
+                                eventId, err[0] = strconv.Atoi(string(match[1]))
+                                pEvent = eventTable[eventId]
+                                if pEvent.argc == 0 {
+                                        // 只有等于0，才证明没经过EXECVE提取参数，才允许使用PROCTITLE提取参数
+                                        if match[3] == nil {
+                                                // PROCTITLE写的是十六进制，转换为字符串
+                                                cmdline = hexToAscii(string(match[4]))
+                                        } else {
+                                                cmdline = string(match[3])
+                                        }
+                                        pEvent.args = strings.Split(cmdline, " ")
+                                        pEvent.argc = len(eventTable[eventId].args)
+                                }
+                                // 当读到proctitle的时候，而且是个新进程最好检查一下cwd，如果还为空，找proc
+                                if pEvent.cwd == "" && (pEvent.syscall == 57 || pEvent.syscall == 58 || pEvent.syscall == 59) {
+                                        cwdFilePath := fmt.Sprintf("/proc/%d/cwd", pEvent.pid)
+                                        pEvent.cwd, err[1] = os.Readlink(cwdFilePath)
+                                        if err[1] != nil {
+                                                pEvent.cwd = ""
+                                                break
+                                        }
+                                }
+                        }
+                case auparse.AUDIT_EOE:
+                        if eoeRegex.Match(rawEvent.Data) {
+                                match := eoeRegex.FindSubmatch(rawEvent.Data)
+                                eventId, err[0] = strconv.Atoi(string(match[1]))
+                                // TODO: 事件整理完毕，即刻发出，是否合理呢？
+                                cooked = *eventTable[eventId] // 应当采用深拷贝吗？有待实验
+                                cookedChan <- cooked
+                                delete(eventTable, eventId) //发出之后就从信息表扔掉，死人别占地
+                        }
+                default:
+                        // TODO: 这里也需要做防护
+                }
+        }
+}
+
+func deal() {
+        defer wg.Done()
+        var cooked Event
+        var ok bool
+        for {
+                cooked, ok = <-cookedChan
+                if !ok {
+                        break
+                }
+                // type Event struct {
+                //      timestamp time.Time
+                //      pid, ppid int
+                //      syscall   int
+                //      argc      int
+                //      args      []string
+                //      cwd       string
+                // }
+                fmt.Printf("recv: %v syscall=%d, ppid=%d, pid=%d, cwd=\"%s\", argc=%d, ", cooked.timestamp, cooked.syscall, cooked.ppid, cooked.pid, cooked.cwd, cooked.argc)
+                if len(cooked.args) != cooked.argc {
+                        fmt.Printf("Fuck!\n")
+                        continue
+                }
+                for i := 0; i < cooked.argc; i++ {
+                        fmt.Printf("arg[%d]=\"%s\", ", i, cooked.args[i])
+                }
+                fmt.Printf("\n")
         }
 }