www.pudn.com > code.rar > acd_check.c

 
 
 
int find_canshuo(struct canshuo *canshuo_a,struct canshuo *canshuo_b); 
int find_systemcall(exe_acd_struct *exe_acd_struct_a,exe_acd_struct *exe_acd_struct_b); 
int find_feifa_xinxi_node(exe_acd_struct *exe_acd_struct_a,exe_acd_struct *exe_acd_struct_b); 
int check_acd(); 
 
int find_canshuo(struct canshuo *canshuo_a,struct canshuo *canshuo_b) 
{ 
  while(1) 
  { 
	  if(canshuo_a!=NULL&&canshuo_b!=NULL) 
	  { 
		  if(strcmp(canshuo_a->canshuo_name,canshuo_b->canshuo_name)==0) 
		  { 
			  canshuo_a=canshuo_a->next; 
			  canshuo_b=canshuo_b->next; 
		  } 
		  else 
		 {       return 0; 
			  break; 
		  } 
	  } 
	  else 
	  { 
		  if(canshuo_a==NULL&&canshuo_b==NULL) 
		  { 
			  return 1; 
		  } 
		  else 
		  { 
			  return 0; 
		  } 
	  } 
	   
  } 
} 
int find_systemcall(exe_acd_struct *exe_acd_struct_a,exe_acd_struct *exe_acd_struct_b) 
{ 
	int i,flag; 
	i=0; 
	flag=1; 
	for(i=0;isystemcall_list[i].systemcall_name,"$")==0) 
		{ 
			if(strcmp(exe_acd_struct_b->systemcall_list[i].systemcall_name,"$")!=0) 
			{ 
				flag=0; 
				break; 
			} 
		else 
			{ 
				break; 
			} 
		} 
		if(strcmp(exe_acd_struct_b->systemcall_list[i].systemcall_name,"$")==0) 
		{ 
			if(strcmp(exe_acd_struct_a->systemcall_list[i].systemcall_name,"$")!=0) 
			{ 
				flag=0; 
				break; 
			}  
		} 
		if(exe_acd_struct_a->systemcall_list[i].process_number==exe_acd_struct_b->systemcall_list[i].process_number) 
		{	 
			if(exe_acd_struct_a->systemcall_list[i].count==exe_acd_struct_b->systemcall_list[i].count) 
			{ 
				if(find_canshuo(exe_acd_struct_a->systemcall_list[i].head,exe_acd_struct_b->systemcall_list[i].head)) 
				{ 
					continue; 
				} 
				else 
				{ 
					flag=0; 
					break; 
				} 
			} 
			else 
			{ 
				flag=0; 
				break; 
				 
			} 
		} 
		else 
		{ 
			flag=0; 
			break; 
		} 
	} 
	return flag; 
} 
 
int find_feifa_xinxi_node(exe_acd_struct *exe_acd_struct_a,exe_acd_struct *exe_acd_struct_b) 
{ 
	int flag; 
	flag=0; 
	if(exe_acd_struct_a!=NULL&&exe_acd_struct_b!=NULL) 
	{ 
		if(exe_acd_struct_a->exe_file_name_node.right>=exe_acd_struct_b->exe_file_name_node.right) 
		{ 
			if(find_systemcall(exe_acd_struct_a,exe_acd_struct_b)) 
			{ 
				flag=1; 
			} 
		} 
	} 
	return flag; 
 
} 
 
 
int check_acd(exe_acd_struct *	feifa_diaoyong_file) 
{  
		 
	int flag=0; 
	int i=0; 
	struct feifa_xinxi_struct *p1,*p2; 
     
	p1=(struct feifa_xinxi_struct * )kmalloc(sizeof(struct feifa_xinxi_struct),0); 
	p2=(struct feifa_xinxi_struct * )kmalloc(sizeof(struct feifa_xinxi_struct),0); 
	p1->feifa_xinxi_node=(struct exe_acd_struct * )kmalloc(sizeof(struct exe_acd_struct),0); 
	 
 
	acd_head1=(struct feifa_xinxi_struct * )kmalloc(sizeof(struct feifa_xinxi_struct),0); 
	acd_head1->feifa_xinxi_node=(struct exe_acd_struct * )kmalloc(sizeof(struct exe_acd_struct),0); 
	 
 
       
      strcpy(acd_head1->feifa_xinxi_node->exe_file_name_node.exe_file_name,"aaaa"); 
	  strcpy(acd_head1->feifa_xinxi_node->feifa_xinxi,"Possibility buffer overflow! Stop runing."); 
      acd_head1->feifa_xinxi_node->exe_file_name_node.right=4; 
	  for(i=0;ifeifa_xinxi_node->systemcall_list[i].systemcall_name,"aa"); 
	  acd_head1->feifa_xinxi_node->systemcall_list[i].count=11;  
	  acd_head1->feifa_xinxi_node->systemcall_list[i].process_number=1; 
	  acd_head1->feifa_xinxi_node->systemcall_list[i].head=(struct canshuo *)kmalloc(sizeof(struct canshuo),0); 
	  strcpy(acd_head1->feifa_xinxi_node->systemcall_list[i].head->canshuo_name,"/bin/sh"); 
	  acd_head1->feifa_xinxi_node->systemcall_list[i].head->next=NULL; 
	  break; 
	  } 
	  strcpy(acd_head1->feifa_xinxi_node->systemcall_list[i+1].systemcall_name,"$"); 
	  acd_head1->next=NULL; 
	  p1=acd_head1; 
	while(p1!=NULL) 
	{ 
		 
                if(strcmp(feifa_diaoyong_file->exe_file_name_node.exe_file_name,"/bin/su")==0) 
                   { 
                       
					  break; 
 
                   }    
                if(find_feifa_xinxi_node(p1->feifa_xinxi_node,feifa_diaoyong_file)) 
		{ 
			flag=-1; 
			printk(" | %-61s|\n",p1->feifa_xinxi_node->feifa_xinxi); 
			printk(" +--------------------------------------------------------------+\n"); 
			break; 
			 
		} 
		else 
		{ 
			//printk("has been checked!\n"); 
			p1=p1->next; 
		} 
	} 
	return flag; 
}