More solid check of blacklisted binaries

palera1n · Jan 15, 2024 · c28f5cd · c28f5cd
1 parent ed3bfd9
commit c28f5cd
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 10 deletions.
diff --git a/src/payload/loader/load_etc_rc_d.c b/src/payload/loader/load_etc_rc_d.c
@@ -43,9 +43,6 @@ int load_etc_rc_d(uint64_t pflags) {
     struct dirent* d;
     while ((d = readdir(dir))) {
         if (!strcmp(d->d_name, ".") || !strcmp(d->d_name, "..")) continue;
-        if (!strcmp(d->d_name, "libhooker") 
-        || !strcmp(d->d_name, "ellekit-loader")
-        || !strcmp(d->d_name, "substitute-launcher")) continue;
         char path[PATH_MAX];
         snprintf(path, PATH_MAX, "%s/%s", etcRcD, d->d_name);
         struct stat st;

diff --git a/src/systemhook/common.c b/src/systemhook/common.c
@@ -431,14 +431,16 @@ int spawn_hook_common(pid_t *restrict pid, const char *restrict path,
 		return pspawn_orig(pid, path, file_actions, attrp, argv, envp);
 	}
 
+	char realPath[PATH_MAX];
+	realpath(path, realPath);
 	if (
-		!strcmp(path, "/var/jb/etc/rc.d/ellekit-loader") ||
-		!strcmp(path, "/etc/rc.d/ellekit-loader") ||
-		!strcmp(path, "/var/jb/etc/rc.d/libhooker") ||
-		!strcmp(path, "/etc/rc.d/libhooker") ||
-		!strcmp(path, "/etc/rc.d/substitute-launcher") ||
-		!strcmp(path, "/usr/libexec/ellekit/loader") ||
-		!strcmp(path, "/var/jb/usr/libexec/ellekit/loader")
+		!strcmp(realPath, "/etc/rc.d/libhooker") ||
+		!strcmp(realPath, "/etc/rc.d/substitute-launcher") ||
+		!strcmp(realPath, "/usr/libexec/ellekit/loader") ||
+		!strcmp(realPath, "/etc/rc.d/ellekit-loader") ||
+		!strcmp(realPath, JB_ROOT_PATH("/usr/libexec/ellekit/loader")) ||
+		!strcmp(realPath, JB_ROOT_PATH("/etc/rc.d/ellekit-loader")) ||
+		!strcmp(realPath, JB_ROOT_PATH("/etc/rc.d/libhooker"))
 	) { 
 		if (access(path, X_OK) == 0) {
 			path = "/cores/binpack/usr/bin/true";