Linux 内核:系统调用挂钩示例 [英] Linux Kernel: System call hooking example
问题描述
我正在尝试编写一些简单的测试代码作为挂钩系统调用表的演示.
I'm trying to write some simple test code as a demonstration of hooking the system call table.
"sys_call_table" 在 2.6 中不再导出,所以我只是从 System.map 文件中抓取地址,我可以看到它是正确的(在我找到的地址处查看内存,我可以看到指向系统调用的指针).
"sys_call_table" is no longer exported in 2.6, so I'm just grabbing the address from the System.map file, and I can see it is correct (Looking through the memory at the address I found, I can see the pointers to the system calls).
然而,当我尝试修改这个表时,内核给出了一个糟糕"和无法在虚拟地址 c061e4f4 处理内核分页请求"并且机器重新启动.
However, when I try to modify this table, the kernel gives an "Oops" with "unable to handle kernel paging request at virtual address c061e4f4" and the machine reboots.
这是运行 2.6.18-164.10.1.el5 的 CentOS 5.4.是否有某种保护或我只是有一个错误?我知道它与 SELinux 一起提供,并且我尝试将其置于许可模式,但没有任何区别
This is CentOS 5.4 running 2.6.18-164.10.1.el5. Is there some sort of protection or do I just have a bug? I know it comes with SELinux, and I've tried putting it in to permissive mode, but it doesn't make a difference
这是我的代码:
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/moduleparam.h>
#include <linux/unistd.h>
void **sys_call_table;
asmlinkage int (*original_call) (const char*, int, int);
asmlinkage int our_sys_open(const char* file, int flags, int mode)
{
printk("A file was opened
");
return original_call(file, flags, mode);
}
int init_module()
{
// sys_call_table address in System.map
sys_call_table = (void*)0xc061e4e0;
original_call = sys_call_table[__NR_open];
// Hook: Crashes here
sys_call_table[__NR_open] = our_sys_open;
}
void cleanup_module()
{
// Restore the original call
sys_call_table[__NR_open] = original_call;
}
推荐答案
我终于自己找到了答案.
I finally found the answer myself.
http://www.linuxforums.org/论坛/linux-kernel/133982-cannot-modify-sys_call_table.html
内核在某个时候发生了变化,因此系统调用表是只读的.
The kernel was changed at some point so that the system call table is read only.
密码朋克:
即使迟到了,但解决方案其他人也可能感兴趣:在您将找到 entry.S 文件:代码:
Even if it is late but the Solution may interest others too: In the entry.S file you will find: Code:
.section .rodata,"a"
#include "syscall_table_32.S"
sys_call_table -> ReadOnly 你必须如果你想编译内核新使用 sys_call_table 来破解"...
sys_call_table -> ReadOnly You have to compile the Kernel new if you want to "hack" around with sys_call_table...
该链接还有一个将内存更改为可写的示例.
The link also has an example of changing the memory to be writable.
nasekomoe:
大家好.感谢您的回复.一世很久以前解决了这个问题修改对内存页的访问.一世已经实现了两个功能它用于我的上层代码:
Hi everybody. Thanks for replies. I solved the problem long ago by modifying access to memory pages. I have implemented two functions that do it for my upper level code:
#include <asm/cacheflush.h>
#ifdef KERN_2_6_24
#include <asm/semaphore.h>
int set_page_rw(long unsigned int _addr)
{
struct page *pg;
pgprot_t prot;
pg = virt_to_page(_addr);
prot.pgprot = VM_READ | VM_WRITE;
return change_page_attr(pg, 1, prot);
}
int set_page_ro(long unsigned int _addr)
{
struct page *pg;
pgprot_t prot;
pg = virt_to_page(_addr);
prot.pgprot = VM_READ;
return change_page_attr(pg, 1, prot);
}
#else
#include <linux/semaphore.h>
int set_page_rw(long unsigned int _addr)
{
return set_memory_rw(_addr, 1);
}
int set_page_ro(long unsigned int _addr)
{
return set_memory_ro(_addr, 1);
}
#endif // KERN_2_6_24
这是对我有用的原始代码的修改版本.
Here's a modified version of the original code that works for me.
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/moduleparam.h>
#include <linux/unistd.h>
#include <asm/semaphore.h>
#include <asm/cacheflush.h>
void **sys_call_table;
asmlinkage int (*original_call) (const char*, int, int);
asmlinkage int our_sys_open(const char* file, int flags, int mode)
{
printk("A file was opened
");
return original_call(file, flags, mode);
}
int set_page_rw(long unsigned int _addr)
{
struct page *pg;
pgprot_t prot;
pg = virt_to_page(_addr);
prot.pgprot = VM_READ | VM_WRITE;
return change_page_attr(pg, 1, prot);
}
int init_module()
{
// sys_call_table address in System.map
sys_call_table = (void*)0xc061e4e0;
original_call = sys_call_table[__NR_open];
set_page_rw(sys_call_table);
sys_call_table[__NR_open] = our_sys_open;
}
void cleanup_module()
{
// Restore the original call
sys_call_table[__NR_open] = original_call;
}
这篇关于Linux 内核:系统调用挂钩示例的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!