打印本文 打印本文 关闭窗口 关闭窗口
Linux2.4.18内核下基于LKM的系统调用劫持
作者:武汉SEO闵涛  文章来源:敏韬网  点击数2367  更新时间:2009/4/22 20:45:50  文章录入:mintao  责任编辑:mintao
...)来做到。但要小心,访问完系统调用的参数后,一定要恢复FS。下面是一段例子:

filename内核空间;比如说我们刚创建了一个字串

unsigned long old_fs_value=get_fs();

set_fs(get_ds);               /*完成之后就可以存取用户空间了*/

open(filename, O_CREAT|O_RDWR|O_EXCL, 0640);

set_fs(old_fs_value);         /*恢复 fs ...*/

三.在module里实现sys_call_table地址查找的代码实现

主要代码如下:

/*实现系统调用*/

unsigned long errno;

#define __syscall_return(type, res) \

do { \

      if ((unsigned long)(res) >= (unsigned long)(-125)) { \

           errno = -(res); \

           res = -1; \

      } \

      return (type) (res); \

} while (0)

#define _syscall1(type,name,type1,arg1) \

type name(type1 arg1) \

{ \

long __res; \

__asm__ volatile ("int $0x80" \

      : "=a" (__res) \

      : "0" (__NR_##name),"b" ((long)(arg1))); \

__syscall_return(type,__res); \

}

#define _syscall3(type,name,type1,arg1,type2,arg2,type3,arg3) \

type name(type1 arg1,type2 arg2,type3 arg3) \

{ \

long __res; \

__asm__ volatile ("int $0x80" \

      : "=a" (__res) \

      : "0" (__NR_##name),"b" ((long)(arg1)),"c" ((long)(arg2)), \

             "d" ((long)(arg3))); \

__syscall_return(type,__res); \

}

static inline _syscall3(int,write,int,fd,const char *,buf,off_t,count)

static inline _syscall3(int,read,int,fd,char *,buf,off_t,count)

static inline _syscall3(off_t,lseek,int,fd,off_t,offset,int,count)

static inline _syscall3(int,open,const char *,file,int,flag,int,mode)

static inline _syscall1(int,close,int,fd)

/*从这里以后就可以使用这几个系统调用了*/

 

struct {

        unsigned short limit;

        unsigned int base;

} __attribute__ ((packed)) idtr;

struct {

        unsigned short off1;

        unsigned short sel;

        unsigned char none,flags;

        unsigned short off2;

} __attribute__ ((packed)) idt;

int kmem;

void readkmem (void *m,unsigned off,int sz)

{

      mm_segment_t old_fs_value=get_fs();

        set_fs(get_ds());    

        if (lseek(kmem,off,0)!=off) {

                printk("kmem lseek error in read\n"); return;

        }

        if (read(kmem,m,sz)!=sz) {

                printk("kmem read error!\n"); return;

        }

      set_fs(old_fs_value);

}

#define CALLOFF 100 /* 我们将读出int $0x80的头100个字节 */

/*得到sys_call_table的地址*/

unsigned getscTable()

{

        unsigned sct;

        unsigned sys_call_off;

        char sc_asm[CALLOFF],*p;

/* 获得IDTR寄存器的值 */

        asm ("sidt %0" : "=m" (idtr));

         mm_segment_t old_fs_value=get_fs();

          const char *filename="/dev/kmem";

上一页  [1] [2] [3]  下一页

打印本文 打印本文 关闭窗口 关闭窗口