hooks_syscalls.json

{
    "hookConfigs": {
        "api": [
        ],
        "syscalls": [
            {
                "name": "execve"
            },
            {
                "name": "execveat"
            },
            {
                "name": "fork"
            },
            {
                "name": "vfork"
            },
            {
                "name": "clone"
            },
            {
                "name": "open"
            },
            {
                "name": "openat"
            },
            {
                "name": "stat"
            },
            {
                "name": "lstat"
            },
            {
                "name": "bpf"
            },
            {
                "name": "perf_event_open"
            },
            {
                "name": "access"
            },
            {
                "name": "faccessat"
            },
            {
                "name": "unlink"
            },
            {
                "name": "unlinkat"
            },
            {
                "name": "symlink"
            },
            {
                "name": "symlinkat"
            },
            {
                "name": "chmod"
            },
            {
                "name": "fchmod"
            },
            {
                "name": "fchmodat"
            },
            {
                "name": "chown"
            },
            {
                "name": "fchown"
            },
            {
                "name": "fchownat"
            },
            {
                "name": "lchown"
            },
            {
                "name": "ptrace"
            },
            {
                "name": "setuid"
            },
            {
                "name": "setgid"
            },
            {
                "name": "setreuid"
            },
            {
                "name": "setregid"
            },
            {
                "name": "setfsuid"
            },
            {
                "name": "setfsgid"
            },
            {
                "name": "kill"
            },
            {
                "name": "mknod"
            },
            {
                "name": "mknodat"
            },
            {
                "name": "mount"
            },
            {
                "name": "umount"
            },
            {
                "name": "init_module"
            },
            {
                "name": "finit_module"
            },
            {
                "name": "delete_module"
            },
            {
                "name": "connect"
            },
            {
                "name": "accept"
            },
            {
                "name": "accept4"
            },
            {
                "name": "listen"
            },
            {
                "name": "process_vm_readv"
            },
            {
                "name": "process_vm_writev"
            },
            {
                "name": "memfd_create"
            }
        ],
        "kprobes": [
            {
                "name": "sched_process_exit"
            },
            {
                "name": "security_file_open"
            },
            {
                "name": "security_bprm_check"
            }
        ],
        "uprobes": [
            {
                "lib_path": "/apex/com.android.runtime/lib64/libart.so",
                "sym_name": "_ZN3artL25DexFile_openDex",
                "offset": "0x496a00",
                "args_types": [ "char*", "int" ]
            },
            {
                "lib_path": "/apex/com.android.runtime/lib64/bionic/libc.so",
                "sym_name": "sigismember64",
                "offset": "",
                "args_types": [ "void*", "int" ]
            },
            {
                "lib_path": "/system/lib64/liblog.so",
                "sym_name": "android_log_write_string8_len",
                "offset": "",
                "args_types": [ "void*", "char*", "size_t" ]
            },
            {
                "lib_path": "/system/lib64/liblog.so",
                "sym_name": "create_android_log_parser",
                "offset": "",
                "args_types": [ "char*", "size_t" ]
            },
            {
                "lib_path": "/apex/com.android.runtime/lib64/bionic/libc.so",
                "sym_name": "access",
                "offset": "",
                "args_types": [ "char*", "int" ]
            }

        ]
    },
    "trace": true
}