diff --git a/index.html b/index.html
index 38fcef5..d700d86 100644
--- a/index.html
+++ b/index.html
@@ -3616,154 +3616,154 @@ dry run of this example, you will have to patch your current kernel in order to
93 .symbol_name = "__x64_sys_openat",
94 .pre_handler = sys_call_kprobe_pre_handler,
95};
-96#else
-97
-98static unsigned long **sys_call_table_stolen;
-99
-100/* A pointer to the original system call. The reason we keep this, rather
-101 * than call the original function (sys_openat), is because somebody else
-102 * might have replaced the system call before us. Note that this is not
-103 * 100% safe, because if another module replaced sys_openat before us,
-104 * then when we are inserted, we will call the function in that module -
-105 * and it might be removed before we are.
-106 *
-107 * Another reason for this is that we can not get sys_openat.
-108 * It is a static variable, so it is not exported.
-109 */
-110#ifdef CONFIG_ARCH_HAS_SYSCALL_WRAPPER
-111static asmlinkage long (*original_call)(const struct pt_regs *);
-112#else
-113static asmlinkage long (*original_call)(int, const char __user *, int, umode_t);
-114#endif
-115
-116/* The function we will replace sys_openat (the function called when you
-117 * call the open system call) with. To find the exact prototype, with
-118 * the number and type of arguments, we find the original function first
-119 * (it is at fs/open.c).
-120 *
-121 * In theory, this means that we are tied to the current version of the
-122 * kernel. In practice, the system calls almost never change (it would
-123 * wreck havoc and require programs to be recompiled, since the system
-124 * calls are the interface between the kernel and the processes).
-125 */
-126#ifdef CONFIG_ARCH_HAS_SYSCALL_WRAPPER
-127static asmlinkage long our_sys_openat(const struct pt_regs *regs)
-128#else
-129static asmlinkage long our_sys_openat(int dfd, const char __user *filename,
-130 int flags, umode_t mode)
-131#endif
-132{
-133 int i = 0;
-134 char ch;
-135
-136 if (__kuid_val(current_uid()) != uid)
-137 goto orig_call;
-138
-139 /* Report the file, if relevant */
-140 pr_info("Opened file by %d: ", uid);
-141 do {
-142#ifdef CONFIG_ARCH_HAS_SYSCALL_WRAPPER
-143 get_user(ch, (char __user *)regs->si + i);
-144#else
-145 get_user(ch, (char __user *)filename + i);
-146#endif
-147 i++;
-148 pr_info("%c", ch);
-149 } while (ch != 0);
-150 pr_info("\n");
-151
-152orig_call:
-153 /* Call the original sys_openat - otherwise, we lose the ability to
-154 * open files.
-155 */
-156#ifdef CONFIG_ARCH_HAS_SYSCALL_WRAPPER
-157 return original_call(regs);
-158#else
-159 return original_call(dfd, filename, flags, mode);
-160#endif
-161}
-162
-163static unsigned long **acquire_sys_call_table(void)
-164{
-165#ifdef HAVE_KSYS_CLOSE
-166 unsigned long int offset = PAGE_OFFSET;
-167 unsigned long **sct;
-168
-169 while (offset < ULLONG_MAX) {
-170 sct = (unsigned long **)offset;
-171
-172 if (sct[__NR_close] == (unsigned long *)ksys_close)
-173 return sct;
-174
-175 offset += sizeof(void *);
-176 }
-177
-178 return NULL;
-179#endif
-180
-181#ifdef HAVE_PARAM
-182 const char sct_name[15] = "sys_call_table";
-183 char symbol[40] = { 0 };
-184
-185 if (sym == 0) {
-186 pr_alert("For Linux v5.7+, Kprobes is the preferable way to get "
-187 "symbol.\n");
-188 pr_info("If Kprobes is absent, you have to specify the address of "
-189 "sys_call_table symbol\n");
-190 pr_info("by /boot/System.map or /proc/kallsyms, which contains all the "
-191 "symbol addresses, into sym parameter.\n");
-192 return NULL;
-193 }
-194 sprint_symbol(symbol, sym);
-195 if (!strncmp(sct_name, symbol, sizeof(sct_name) - 1))
-196 return (unsigned long **)sym;
-197
-198 return NULL;
-199#endif
-200
-201#ifdef HAVE_KPROBES
-202 unsigned long (*kallsyms_lookup_name)(const char *name);
-203 struct kprobe kp = {
-204 .symbol_name = "kallsyms_lookup_name",
-205 };
-206
-207 if (register_kprobe(&kp) < 0)
-208 return NULL;
-209 kallsyms_lookup_name = (unsigned long (*)(const char *name))kp.addr;
-210 unregister_kprobe(&kp);
-211#endif
-212
-213 return (unsigned long **)kallsyms_lookup_name("sys_call_table");
-214}
-215
-216#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0)
-217static inline void __write_cr0(unsigned long cr0)
-218{
-219 asm volatile("mov %0,%%cr0" : "+r"(cr0) : : "memory");
-220}
-221#else
-222#define __write_cr0 write_cr0
-223#endif
-224
-225static void enable_write_protection(void)
-226{
-227 unsigned long cr0 = read_cr0();
-228 set_bit(16, &cr0);
-229 __write_cr0(cr0);
-230}
-231
-232static void disable_write_protection(void)
-233{
-234 unsigned long cr0 = read_cr0();
-235 clear_bit(16, &cr0);
-236 __write_cr0(cr0);
-237}
-238#endif
-239
-240static int __init syscall_steal_start(void)
-241{
-242#if USE_KPROBES_PRE_HANDLER_BEFORE_SYSCALL
-243
+96
+97#else
+98
+99static unsigned long **sys_call_table_stolen;
+100
+101/* A pointer to the original system call. The reason we keep this, rather
+102 * than call the original function (sys_openat), is because somebody else
+103 * might have replaced the system call before us. Note that this is not
+104 * 100% safe, because if another module replaced sys_openat before us,
+105 * then when we are inserted, we will call the function in that module -
+106 * and it might be removed before we are.
+107 *
+108 * Another reason for this is that we can not get sys_openat.
+109 * It is a static variable, so it is not exported.
+110 */
+111#ifdef CONFIG_ARCH_HAS_SYSCALL_WRAPPER
+112static asmlinkage long (*original_call)(const struct pt_regs *);
+113#else
+114static asmlinkage long (*original_call)(int, const char __user *, int, umode_t);
+115#endif
+116
+117/* The function we will replace sys_openat (the function called when you
+118 * call the open system call) with. To find the exact prototype, with
+119 * the number and type of arguments, we find the original function first
+120 * (it is at fs/open.c).
+121 *
+122 * In theory, this means that we are tied to the current version of the
+123 * kernel. In practice, the system calls almost never change (it would
+124 * wreck havoc and require programs to be recompiled, since the system
+125 * calls are the interface between the kernel and the processes).
+126 */
+127#ifdef CONFIG_ARCH_HAS_SYSCALL_WRAPPER
+128static asmlinkage long our_sys_openat(const struct pt_regs *regs)
+129#else
+130static asmlinkage long our_sys_openat(int dfd, const char __user *filename,
+131 int flags, umode_t mode)
+132#endif
+133{
+134 int i = 0;
+135 char ch;
+136
+137 if (__kuid_val(current_uid()) != uid)
+138 goto orig_call;
+139
+140 /* Report the file, if relevant */
+141 pr_info("Opened file by %d: ", uid);
+142 do {
+143#ifdef CONFIG_ARCH_HAS_SYSCALL_WRAPPER
+144 get_user(ch, (char __user *)regs->si + i);
+145#else
+146 get_user(ch, (char __user *)filename + i);
+147#endif
+148 i++;
+149 pr_info("%c", ch);
+150 } while (ch != 0);
+151 pr_info("\n");
+152
+153orig_call:
+154 /* Call the original sys_openat - otherwise, we lose the ability to
+155 * open files.
+156 */
+157#ifdef CONFIG_ARCH_HAS_SYSCALL_WRAPPER
+158 return original_call(regs);
+159#else
+160 return original_call(dfd, filename, flags, mode);
+161#endif
+162}
+163
+164static unsigned long **acquire_sys_call_table(void)
+165{
+166#ifdef HAVE_KSYS_CLOSE
+167 unsigned long int offset = PAGE_OFFSET;
+168 unsigned long **sct;
+169
+170 while (offset < ULLONG_MAX) {
+171 sct = (unsigned long **)offset;
+172
+173 if (sct[__NR_close] == (unsigned long *)ksys_close)
+174 return sct;
+175
+176 offset += sizeof(void *);
+177 }
+178
+179 return NULL;
+180#endif
+181
+182#ifdef HAVE_PARAM
+183 const char sct_name[15] = "sys_call_table";
+184 char symbol[40] = { 0 };
+185
+186 if (sym == 0) {
+187 pr_alert("For Linux v5.7+, Kprobes is the preferable way to get "
+188 "symbol.\n");
+189 pr_info("If Kprobes is absent, you have to specify the address of "
+190 "sys_call_table symbol\n");
+191 pr_info("by /boot/System.map or /proc/kallsyms, which contains all the "
+192 "symbol addresses, into sym parameter.\n");
+193 return NULL;
+194 }
+195 sprint_symbol(symbol, sym);
+196 if (!strncmp(sct_name, symbol, sizeof(sct_name) - 1))
+197 return (unsigned long **)sym;
+198
+199 return NULL;
+200#endif
+201
+202#ifdef HAVE_KPROBES
+203 unsigned long (*kallsyms_lookup_name)(const char *name);
+204 struct kprobe kp = {
+205 .symbol_name = "kallsyms_lookup_name",
+206 };
+207
+208 if (register_kprobe(&kp) < 0)
+209 return NULL;
+210 kallsyms_lookup_name = (unsigned long (*)(const char *name))kp.addr;
+211 unregister_kprobe(&kp);
+212#endif
+213
+214 return (unsigned long **)kallsyms_lookup_name("sys_call_table");
+215}
+216
+217#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0)
+218static inline void __write_cr0(unsigned long cr0)
+219{
+220 asm volatile("mov %0,%%cr0" : "+r"(cr0) : : "memory");
+221}
+222#else
+223#define __write_cr0 write_cr0
+224#endif
+225
+226static void enable_write_protection(void)
+227{
+228 unsigned long cr0 = read_cr0();
+229 set_bit(16, &cr0);
+230 __write_cr0(cr0);
+231}
+232
+233static void disable_write_protection(void)
+234{
+235 unsigned long cr0 = read_cr0();
+236 clear_bit(16, &cr0);
+237 __write_cr0(cr0);
+238}
+239#endif
+240
+241static int __init syscall_steal_start(void)
+242{
+243#if USE_KPROBES_PRE_HANDLER_BEFORE_SYSCALL
244 int err;
245 /* use symbol name from the module parameter */
246 syscall_kprobe.symbol_name = syscall_sym;
@@ -3773,55 +3773,53 @@ dry run of this example, you will have to patch your current kernel in order to
250 pr_err("Please check the symbol name from 'syscall_sym' parameter.\n");
251 return err;
252 }
-253
-254#else
-255 if (!(sys_call_table_stolen = acquire_sys_call_table()))
-256 return -1;
-257
-258 disable_write_protection();
-259
-260 /* keep track of the original open function */
-261 original_call = (void *)sys_call_table_stolen[__NR_openat];
-262
-263 /* use our openat function instead */
-264 sys_call_table_stolen[__NR_openat] = (unsigned long *)our_sys_openat;
-265
-266 enable_write_protection();
+253#else
+254 if (!(sys_call_table_stolen = acquire_sys_call_table()))
+255 return -1;
+256
+257 disable_write_protection();
+258
+259 /* keep track of the original open function */
+260 original_call = (void *)sys_call_table_stolen[__NR_openat];
+261
+262 /* use our openat function instead */
+263 sys_call_table_stolen[__NR_openat] = (unsigned long *)our_sys_openat;
+264
+265 enable_write_protection();
+266#endif
267
-268#endif
-269
-270 pr_info("Spying on UID:%d\n", uid);
-271 return 0;
-272}
-273
-274static void __exit syscall_steal_end(void)
-275{
-276#if USE_KPROBES_PRE_HANDLER_BEFORE_SYSCALL
-277 unregister_kprobe(&syscall_kprobe);
-278#else
-279 if (!sys_call_table_stolen)
-280 return;
-281
-282 /* Return the system call back to normal */
-283 if (sys_call_table_stolen[__NR_openat] != (unsigned long *)our_sys_openat) {
-284 pr_alert("Somebody else also played with the ");
-285 pr_alert("open system call\n");
-286 pr_alert("The system may be left in ");
-287 pr_alert("an unstable state.\n");
-288 }
-289
-290 disable_write_protection();
-291 sys_call_table_stolen[__NR_openat] = (unsigned long *)original_call;
-292 enable_write_protection();
-293#endif
-294
-295 msleep(2000);
-296}
-297
-298module_init(syscall_steal_start);
-299module_exit(syscall_steal_end);
-300
-301MODULE_LICENSE("GPL");
+268 pr_info("Spying on UID:%d\n", uid);
+269 return 0;
+270}
+271
+272static void __exit syscall_steal_end(void)
+273{
+274#if USE_KPROBES_PRE_HANDLER_BEFORE_SYSCALL
+275 unregister_kprobe(&syscall_kprobe);
+276#else
+277 if (!sys_call_table_stolen)
+278 return;
+279
+280 /* Return the system call back to normal */
+281 if (sys_call_table_stolen[__NR_openat] != (unsigned long *)our_sys_openat) {
+282 pr_alert("Somebody else also played with the ");
+283 pr_alert("open system call\n");
+284 pr_alert("The system may be left in ");
+285 pr_alert("an unstable state.\n");
+286 }
+287
+288 disable_write_protection();
+289 sys_call_table_stolen[__NR_openat] = (unsigned long *)original_call;
+290 enable_write_protection();
+291#endif
+292
+293 msleep(2000);
+294}
+295
+296module_init(syscall_steal_start);
+297module_exit(syscall_steal_end);
+298
+299MODULE_LICENSE("GPL");
11 Blocking Processes and threads
diff --git a/lkmpg-for-ht.html b/lkmpg-for-ht.html
index 38fcef5..d700d86 100644
--- a/lkmpg-for-ht.html
+++ b/lkmpg-for-ht.html
@@ -3616,154 +3616,154 @@ dry run of this example, you will have to patch your current kernel in order to
93 .symbol_name = "__x64_sys_openat",
94 .pre_handler = sys_call_kprobe_pre_handler,
95};
-96#else
-97
-98static unsigned long **sys_call_table_stolen;
-99
-100/* A pointer to the original system call. The reason we keep this, rather
-101 * than call the original function (sys_openat), is because somebody else
-102 * might have replaced the system call before us. Note that this is not
-103 * 100% safe, because if another module replaced sys_openat before us,
-104 * then when we are inserted, we will call the function in that module -
-105 * and it might be removed before we are.
-106 *
-107 * Another reason for this is that we can not get sys_openat.
-108 * It is a static variable, so it is not exported.
-109 */
-110#ifdef CONFIG_ARCH_HAS_SYSCALL_WRAPPER
-111static asmlinkage long (*original_call)(const struct pt_regs *);
-112#else
-113static asmlinkage long (*original_call)(int, const char __user *, int, umode_t);
-114#endif
-115
-116/* The function we will replace sys_openat (the function called when you
-117 * call the open system call) with. To find the exact prototype, with
-118 * the number and type of arguments, we find the original function first
-119 * (it is at fs/open.c).
-120 *
-121 * In theory, this means that we are tied to the current version of the
-122 * kernel. In practice, the system calls almost never change (it would
-123 * wreck havoc and require programs to be recompiled, since the system
-124 * calls are the interface between the kernel and the processes).
-125 */
-126#ifdef CONFIG_ARCH_HAS_SYSCALL_WRAPPER
-127static asmlinkage long our_sys_openat(const struct pt_regs *regs)
-128#else
-129static asmlinkage long our_sys_openat(int dfd, const char __user *filename,
-130 int flags, umode_t mode)
-131#endif
-132{
-133 int i = 0;
-134 char ch;
-135
-136 if (__kuid_val(current_uid()) != uid)
-137 goto orig_call;
-138
-139 /* Report the file, if relevant */
-140 pr_info("Opened file by %d: ", uid);
-141 do {
-142#ifdef CONFIG_ARCH_HAS_SYSCALL_WRAPPER
-143 get_user(ch, (char __user *)regs->si + i);
-144#else
-145 get_user(ch, (char __user *)filename + i);
-146#endif
-147 i++;
-148 pr_info("%c", ch);
-149 } while (ch != 0);
-150 pr_info("\n");
-151
-152orig_call:
-153 /* Call the original sys_openat - otherwise, we lose the ability to
-154 * open files.
-155 */
-156#ifdef CONFIG_ARCH_HAS_SYSCALL_WRAPPER
-157 return original_call(regs);
-158#else
-159 return original_call(dfd, filename, flags, mode);
-160#endif
-161}
-162
-163static unsigned long **acquire_sys_call_table(void)
-164{
-165#ifdef HAVE_KSYS_CLOSE
-166 unsigned long int offset = PAGE_OFFSET;
-167 unsigned long **sct;
-168
-169 while (offset < ULLONG_MAX) {
-170 sct = (unsigned long **)offset;
-171
-172 if (sct[__NR_close] == (unsigned long *)ksys_close)
-173 return sct;
-174
-175 offset += sizeof(void *);
-176 }
-177
-178 return NULL;
-179#endif
-180
-181#ifdef HAVE_PARAM
-182 const char sct_name[15] = "sys_call_table";
-183 char symbol[40] = { 0 };
-184
-185 if (sym == 0) {
-186 pr_alert("For Linux v5.7+, Kprobes is the preferable way to get "
-187 "symbol.\n");
-188 pr_info("If Kprobes is absent, you have to specify the address of "
-189 "sys_call_table symbol\n");
-190 pr_info("by /boot/System.map or /proc/kallsyms, which contains all the "
-191 "symbol addresses, into sym parameter.\n");
-192 return NULL;
-193 }
-194 sprint_symbol(symbol, sym);
-195 if (!strncmp(sct_name, symbol, sizeof(sct_name) - 1))
-196 return (unsigned long **)sym;
-197
-198 return NULL;
-199#endif
-200
-201#ifdef HAVE_KPROBES
-202 unsigned long (*kallsyms_lookup_name)(const char *name);
-203 struct kprobe kp = {
-204 .symbol_name = "kallsyms_lookup_name",
-205 };
-206
-207 if (register_kprobe(&kp) < 0)
-208 return NULL;
-209 kallsyms_lookup_name = (unsigned long (*)(const char *name))kp.addr;
-210 unregister_kprobe(&kp);
-211#endif
-212
-213 return (unsigned long **)kallsyms_lookup_name("sys_call_table");
-214}
-215
-216#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0)
-217static inline void __write_cr0(unsigned long cr0)
-218{
-219 asm volatile("mov %0,%%cr0" : "+r"(cr0) : : "memory");
-220}
-221#else
-222#define __write_cr0 write_cr0
-223#endif
-224
-225static void enable_write_protection(void)
-226{
-227 unsigned long cr0 = read_cr0();
-228 set_bit(16, &cr0);
-229 __write_cr0(cr0);
-230}
-231
-232static void disable_write_protection(void)
-233{
-234 unsigned long cr0 = read_cr0();
-235 clear_bit(16, &cr0);
-236 __write_cr0(cr0);
-237}
-238#endif
-239
-240static int __init syscall_steal_start(void)
-241{
-242#if USE_KPROBES_PRE_HANDLER_BEFORE_SYSCALL
-243
+96
+97#else
+98
+99static unsigned long **sys_call_table_stolen;
+100
+101/* A pointer to the original system call. The reason we keep this, rather
+102 * than call the original function (sys_openat), is because somebody else
+103 * might have replaced the system call before us. Note that this is not
+104 * 100% safe, because if another module replaced sys_openat before us,
+105 * then when we are inserted, we will call the function in that module -
+106 * and it might be removed before we are.
+107 *
+108 * Another reason for this is that we can not get sys_openat.
+109 * It is a static variable, so it is not exported.
+110 */
+111#ifdef CONFIG_ARCH_HAS_SYSCALL_WRAPPER
+112static asmlinkage long (*original_call)(const struct pt_regs *);
+113#else
+114static asmlinkage long (*original_call)(int, const char __user *, int, umode_t);
+115#endif
+116
+117/* The function we will replace sys_openat (the function called when you
+118 * call the open system call) with. To find the exact prototype, with
+119 * the number and type of arguments, we find the original function first
+120 * (it is at fs/open.c).
+121 *
+122 * In theory, this means that we are tied to the current version of the
+123 * kernel. In practice, the system calls almost never change (it would
+124 * wreck havoc and require programs to be recompiled, since the system
+125 * calls are the interface between the kernel and the processes).
+126 */
+127#ifdef CONFIG_ARCH_HAS_SYSCALL_WRAPPER
+128static asmlinkage long our_sys_openat(const struct pt_regs *regs)
+129#else
+130static asmlinkage long our_sys_openat(int dfd, const char __user *filename,
+131 int flags, umode_t mode)
+132#endif
+133{
+134 int i = 0;
+135 char ch;
+136
+137 if (__kuid_val(current_uid()) != uid)
+138 goto orig_call;
+139
+140 /* Report the file, if relevant */
+141 pr_info("Opened file by %d: ", uid);
+142 do {
+143#ifdef CONFIG_ARCH_HAS_SYSCALL_WRAPPER
+144 get_user(ch, (char __user *)regs->si + i);
+145#else
+146 get_user(ch, (char __user *)filename + i);
+147#endif
+148 i++;
+149 pr_info("%c", ch);
+150 } while (ch != 0);
+151 pr_info("\n");
+152
+153orig_call:
+154 /* Call the original sys_openat - otherwise, we lose the ability to
+155 * open files.
+156 */
+157#ifdef CONFIG_ARCH_HAS_SYSCALL_WRAPPER
+158 return original_call(regs);
+159#else
+160 return original_call(dfd, filename, flags, mode);
+161#endif
+162}
+163
+164static unsigned long **acquire_sys_call_table(void)
+165{
+166#ifdef HAVE_KSYS_CLOSE
+167 unsigned long int offset = PAGE_OFFSET;
+168 unsigned long **sct;
+169
+170 while (offset < ULLONG_MAX) {
+171 sct = (unsigned long **)offset;
+172
+173 if (sct[__NR_close] == (unsigned long *)ksys_close)
+174 return sct;
+175
+176 offset += sizeof(void *);
+177 }
+178
+179 return NULL;
+180#endif
+181
+182#ifdef HAVE_PARAM
+183 const char sct_name[15] = "sys_call_table";
+184 char symbol[40] = { 0 };
+185
+186 if (sym == 0) {
+187 pr_alert("For Linux v5.7+, Kprobes is the preferable way to get "
+188 "symbol.\n");
+189 pr_info("If Kprobes is absent, you have to specify the address of "
+190 "sys_call_table symbol\n");
+191 pr_info("by /boot/System.map or /proc/kallsyms, which contains all the "
+192 "symbol addresses, into sym parameter.\n");
+193 return NULL;
+194 }
+195 sprint_symbol(symbol, sym);
+196 if (!strncmp(sct_name, symbol, sizeof(sct_name) - 1))
+197 return (unsigned long **)sym;
+198
+199 return NULL;
+200#endif
+201
+202#ifdef HAVE_KPROBES
+203 unsigned long (*kallsyms_lookup_name)(const char *name);
+204 struct kprobe kp = {
+205 .symbol_name = "kallsyms_lookup_name",
+206 };
+207
+208 if (register_kprobe(&kp) < 0)
+209 return NULL;
+210 kallsyms_lookup_name = (unsigned long (*)(const char *name))kp.addr;
+211 unregister_kprobe(&kp);
+212#endif
+213
+214 return (unsigned long **)kallsyms_lookup_name("sys_call_table");
+215}
+216
+217#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 3, 0)
+218static inline void __write_cr0(unsigned long cr0)
+219{
+220 asm volatile("mov %0,%%cr0" : "+r"(cr0) : : "memory");
+221}
+222#else
+223#define __write_cr0 write_cr0
+224#endif
+225
+226static void enable_write_protection(void)
+227{
+228 unsigned long cr0 = read_cr0();
+229 set_bit(16, &cr0);
+230 __write_cr0(cr0);
+231}
+232
+233static void disable_write_protection(void)
+234{
+235 unsigned long cr0 = read_cr0();
+236 clear_bit(16, &cr0);
+237 __write_cr0(cr0);
+238}
+239#endif
+240
+241static int __init syscall_steal_start(void)
+242{
+243#if USE_KPROBES_PRE_HANDLER_BEFORE_SYSCALL
244 int err;
245 /* use symbol name from the module parameter */
246 syscall_kprobe.symbol_name = syscall_sym;
@@ -3773,55 +3773,53 @@ dry run of this example, you will have to patch your current kernel in order to
250 pr_err("Please check the symbol name from 'syscall_sym' parameter.\n");
251 return err;
252 }
-253
-254#else
-255 if (!(sys_call_table_stolen = acquire_sys_call_table()))
-256 return -1;
-257
-258 disable_write_protection();
-259
-260 /* keep track of the original open function */
-261 original_call = (void *)sys_call_table_stolen[__NR_openat];
-262
-263 /* use our openat function instead */
-264 sys_call_table_stolen[__NR_openat] = (unsigned long *)our_sys_openat;
-265
-266 enable_write_protection();
+253#else
+254 if (!(sys_call_table_stolen = acquire_sys_call_table()))
+255 return -1;
+256
+257 disable_write_protection();
+258
+259 /* keep track of the original open function */
+260 original_call = (void *)sys_call_table_stolen[__NR_openat];
+261
+262 /* use our openat function instead */
+263 sys_call_table_stolen[__NR_openat] = (unsigned long *)our_sys_openat;
+264
+265 enable_write_protection();
+266#endif
267
-268#endif
-269
-270 pr_info("Spying on UID:%d\n", uid);
-271 return 0;
-272}
-273
-274static void __exit syscall_steal_end(void)
-275{
-276#if USE_KPROBES_PRE_HANDLER_BEFORE_SYSCALL
-277 unregister_kprobe(&syscall_kprobe);
-278#else
-279 if (!sys_call_table_stolen)
-280 return;
-281
-282 /* Return the system call back to normal */
-283 if (sys_call_table_stolen[__NR_openat] != (unsigned long *)our_sys_openat) {
-284 pr_alert("Somebody else also played with the ");
-285 pr_alert("open system call\n");
-286 pr_alert("The system may be left in ");
-287 pr_alert("an unstable state.\n");
-288 }
-289
-290 disable_write_protection();
-291 sys_call_table_stolen[__NR_openat] = (unsigned long *)original_call;
-292 enable_write_protection();
-293#endif
-294
-295 msleep(2000);
-296}
-297
-298module_init(syscall_steal_start);
-299module_exit(syscall_steal_end);
-300
-301MODULE_LICENSE("GPL");
+268 pr_info("Spying on UID:%d\n", uid);
+269 return 0;
+270}
+271
+272static void __exit syscall_steal_end(void)
+273{
+274#if USE_KPROBES_PRE_HANDLER_BEFORE_SYSCALL
+275 unregister_kprobe(&syscall_kprobe);
+276#else
+277 if (!sys_call_table_stolen)
+278 return;
+279
+280 /* Return the system call back to normal */
+281 if (sys_call_table_stolen[__NR_openat] != (unsigned long *)our_sys_openat) {
+282 pr_alert("Somebody else also played with the ");
+283 pr_alert("open system call\n");
+284 pr_alert("The system may be left in ");
+285 pr_alert("an unstable state.\n");
+286 }
+287
+288 disable_write_protection();
+289 sys_call_table_stolen[__NR_openat] = (unsigned long *)original_call;
+290 enable_write_protection();
+291#endif
+292
+293 msleep(2000);
+294}
+295
+296module_init(syscall_steal_start);
+297module_exit(syscall_steal_end);
+298
+299MODULE_LICENSE("GPL");
11 Blocking Processes and threads