get system call table in x86-64 Linux
  1. http://bbs.chinaunix.net/thread-2143235-1-1.html

  2. Linux System Call Table

    http://bluemaster.iu.hio.no/edu/dark/lin-asm/syscalls.html
  3. #include <linux/kernel.h>
  4. #include <linux/init.h>
  5. #include <linux/module.h>
  6. #include <asm/uaccess.h>
  7. #include <asm/fcntl.h>
  8. #include <asm/unistd.h>
  9. #include <asm/ia32_unistd.h>
  10. #include <asm/msr.h>



  14. #define THIS_DESCRIPTION "Dynamically get sys_call_table/ia32_sys_call_table in kernel module.\n\t\tI don't think there would be anyone who won't enable CONFIG_IA32_EMULATION these days.\n\t\tso you can add the unessary check if you really want to."
  15. MODULE_DESCRIPTION( THIS_DESCRIPTION );
  16. MODULE_AUTHOR("albcamus <albcamus@gmail.com>");
  17. MODULE_LICENSE("GPL");


  20. /**
  21. * TODO: if you want shut this up, comment the following line.
  22. */
  23. #define BY_IDT_DEBUG

  25. #ifdef BY_IDT_DEBUG
  26. #define dbgprint(format,args...) \
  27.                  printk("get_syscall: function:%s-L%d: "format, __FUNCTION__, __LINE__, ## args);
  28. #else
  29. #define dbgprint(format,args...)  do {} while(0);
  30. #endif


  33. /**
  34. * sys call table
  35. */
  36. void ** my_ia32_syscall_table;
  37. void ** my_syscall_table;



  41. /**
  42. * 10 bytes  -- please refer to AMD64 Architecture Programmer's 
  43. *         Manuals for more information.
  44. */
  45. struct idtr {
  46.     unsigned short limit;
  47.     unsigned long base; //in 64bit mode, base address is 8 bytes
  48. } __attribute__ ((packed));


  51. /**
  52. * in long mode -- 64bit mode and compatity mode, 
  53. * every IDT entry has a 16-byte size
  54. */
  55. struct idt {
  56.     u16 offset_low;
  57.     u16 segment;
  58.     unsigned ist : 3, zero0 : 5, type : 5, dpl :2, p : 1;
  59.     u16 offset_middle;
  60.     u32 offset_high;
  61.     u32 zero1;
  62. } __attribute__ ((packed));




  67. /**
  68. * Return the first appearence of NEEDLE in HAYSTACK.  -- copied from PHRACK
  69. * */
  70. static void *memmem(const void *haystack, size_t haystack_len,
  71.             const void *needle, size_t needle_len)
  72. {/*{{{*/
  73.     const char *begin;
  74.     const char *const last_possible
  75.         = (const char *) haystack + haystack_len - needle_len;

  77.     if (needle_len == 0)
  78.         /* The first occurrence of the empty string is deemed to occur at
  79.            the beginning of the string.  */
  80.         return (void *) haystack;

  82.     /* Sanity check, otherwise the loop might search through the whole
  83.        memory.  */
  84.     if (__builtin_expect(haystack_len < needle_len, 0))
  85.         return NULL;

  87.     for (begin = (const char *) haystack; begin <= last_possible;
  88.          ++begin)
  89.         if (begin[0] == ((const char *) needle)[0]
  90.             && !memcmp((const void *) &begin[1],
  91.                    (const void *) ((const char *) needle + 1),
  92.                    needle_len - 1))
  93.             return (void *) begin;

  95.     return NULL;
  96. }/*}}}*/


  99. /**
  100. * Find the location of ia32_sys_call_table
  101. */
  102. static unsigned long get_syscall_table_ia32(void)
  103. {/*{{{*/
  104. #define OFFSET_SYSCALL 100    /* from system_call/ia32_syscall, we'll read first 150 bytes */

  106.     struct idtr idtr;
  107.     struct idt idt;

  109.     unsigned long sys_call_off;
  110.     unsigned long retval;

  112.     char sc_asm[OFFSET_SYSCALL], *p;




  117.     /* well, let's read IDTR */
  118.     asm("sidt %0"
  119.         :"=m"(idtr)
  120.         : );

  122.     dbgprint("idtr base at %p\n", (void *)idtr.base);

  124.     /**
  125.      * Read in IDT for vector 0x80 (syscall) 
  126.      */
  127.     memcpy(&idt, (char *) idtr.base + 16 * 0x80, sizeof(idt)); 
  128.     sys_call_off =  ( ( (unsigned long)idt.offset_high ) << 32 ) | 
  129.         ( ((idt.offset_middle << 16 ) | idt.offset_low) & 0x00000000ffffffff ); 
  130.     dbgprint("sys_call_off at %p\n", (void *)sys_call_off);

  132.     /* we have syscall routine address now, look for syscall table
  133.        dispatch (indirect call) */
  134.     memcpy(sc_asm, (void *)sys_call_off, OFFSET_SYSCALL);
  135.     /**
  136.      * ia32_call > ia32_tracesys > ia32_do_syscall > 'call *ia32_sys_call_table(,%rax,8)'
  137.      * Find callq *ia32_sys_call_table(,%rax,8)
  138.      *
  139.      * (gdb) disassemble ia32_syscall
  140.      * Dump of assembler code for function ia32_syscall:
  141.      * 0xffffffff81066b98 <ia32_syscall+0>:    swapgs
  142.      * 0xffffffff81066b9b <ia32_syscall+3>:    sti
  143.      * 0xffffffff81066b9c <ia32_syscall+4>:    mov    %eax,%eax
  144.      * 0xffffffff81066b9e <ia32_syscall+6>:    push   %rax
  145.      * 0xffffffff81066b9f <ia32_syscall+7>:    cld
  146.      * 0xffffffff81066ba0 <ia32_syscall+8>:    sub    $0x48,%rsp
  147.      * 0xffffffff81066ba4 <ia32_syscall+12>:   mov    %rdi,0x40(%rsp)
  148.      * 0xffffffff81066ba9 <ia32_syscall+17>:   mov    %rsi,0x38(%rsp)
  149.      * 0xffffffff81066bae <ia32_syscall+22>:   mov    %rdx,0x30(%rsp)
  150.      * 0xffffffff81066bb3 <ia32_syscall+27>:   mov    %rcx,0x28(%rsp)
  151.      * 0xffffffff81066bb8 <ia32_syscall+32>:   mov    %rax,0x20(%rsp)
  152.      * 0xffffffff81066bbd <ia32_syscall+37>:   mov    %gs:0x10,%r10
  153.      * 0xffffffff81066bc6 <ia32_syscall+46>:   sub    $0x1fd8,%r10
  154.      * 0xffffffff81066bcd <ia32_syscall+53>:   orl    $0x2,0x14(%r10)
  155.      * 0xffffffff81066bd2 <ia32_syscall+58>:   testl  $0x181,0x10(%r10)
  156.      * 0xffffffff81066bda <ia32_syscall+66>:   jne    0xffffffff81066c04 <ia32_tracesys>
  157.      * End of assembler dump.
  158.      * (gdb) disassemble ia32_tracesys
  159.      * Dump of assembler code for function ia32_tracesys:
  160.      * 0xffffffff81066c04 <ia32_tracesys+0>:   sub    $0x30,%rsp
  161.      * 0xffffffff81066c08 <ia32_tracesys+4>:   mov    %rbx,0x28(%rsp)
  162.      * 0xffffffff81066c0d <ia32_tracesys+9>:   mov    %rbp,0x20(%rsp)
  163.      * 0xffffffff81066c12 <ia32_tracesys+14>:  mov    %r12,0x18(%rsp)
  164.      * 0xffffffff81066c17 <ia32_tracesys+19>:  mov    %r13,0x10(%rsp)
  165.      * 0xffffffff81066c1c <ia32_tracesys+24>:  mov    %r14,0x8(%rsp)
  166.      * 0xffffffff81066c21 <ia32_tracesys+29>:  mov    %r15,(%rsp)
  167.      * 0xffffffff81066c25 <ia32_tracesys+33>:  movq   $0xffffffffffffffda,0x50(%rsp)
  168.      * 0xffffffff81066c2e <ia32_tracesys+42>:  mov    %rsp,%rdi
  169.      * 0xffffffff81066c31 <ia32_tracesys+45>:  callq  0xffffffff81073a02 <syscall_trace_enter>
  170.      * 0xffffffff81066c36 <ia32_tracesys+50>:  mov    0x30(%rsp),%r11
  171.      * 0xffffffff81066c3b <ia32_tracesys+55>:  mov    0x38(%rsp),%r10
  172.      * 0xffffffff81066c40 <ia32_tracesys+60>:  mov    0x40(%rsp),%r9
  173.      * 0xffffffff81066c45 <ia32_tracesys+65>:  mov    0x48(%rsp),%r8
  174.      * 0xffffffff81066c4a <ia32_tracesys+70>:  mov    0x58(%rsp),%rcx
  175.      * 0xffffffff81066c4f <ia32_tracesys+75>:  mov    0x60(%rsp),%rdx
  176.      * 0xffffffff81066c54 <ia32_tracesys+80>:  mov    0x68(%rsp),%rsi
  177.      * 0xffffffff81066c59 <ia32_tracesys+85>:  mov    0x70(%rsp),%rdi
  178.      * 0xffffffff81066c5e <ia32_tracesys+90>:  mov    0x78(%rsp),%rax
  179.      * 0xffffffff81066c63 <ia32_tracesys+95>:  mov    (%rsp),%r15
  180.      * 0xffffffff81066c67 <ia32_tracesys+99>:  mov    0x8(%rsp),%r14
  181.      * 0xffffffff81066c6c <ia32_tracesys+104>: mov    0x10(%rsp),%r13
  182.      * 0xffffffff81066c71 <ia32_tracesys+109>: mov    0x18(%rsp),%r12
  183.      * 0xffffffff81066c76 <ia32_tracesys+114>: mov    0x20(%rsp),%rbp
  184.      * 0xffffffff81066c7b <ia32_tracesys+119>: mov    0x28(%rsp),%rbx
  185.      * 0xffffffff81066c80 <ia32_tracesys+124>: add    $0x30,%rsp
  186.      * 0xffffffff81066c84 <ia32_tracesys+128>: jmpq   0xffffffff81066bdc <ia32_do_syscall>
  187.      * End of assembler dump.
  188.      * (gdb) disassemble ia32_do_syscall
  189.      * Dump of assembler code for function ia32_do_syscall:
  190.      * 0xffffffff81066bdc <ia32_do_syscall+0>: cmp    $0x13d,%eax
  191.      * 0xffffffff81066be1 <ia32_do_syscall+5>: ja     0xffffffff81066c89 <ia32_badsys>
  192.      * 0xffffffff81066be7 <ia32_do_syscall+11>:        mov    %edi,%r8d
  193.      * 0xffffffff81066bea <ia32_do_syscall+14>:        mov    %ebp,%r9d
  194.      * 0xffffffff81066bed <ia32_do_syscall+17>:        xchg   %ecx,%esi
  195.      * 0xffffffff81066bef <ia32_do_syscall+19>:        mov    %ebx,%edi
  196.      * 0xffffffff81066bf1 <ia32_do_syscall+21>:        mov    %edx,%edx
  197.      * 0xffffffff81066bf3 <ia32_do_syscall+23>:        callq  *0xffffffff812e7c70(,%rax,8)
  198.      * End of assembler dump.
  199.      * (gdb) x/xw ia32_do_syscall+23
  200.      * 0xffffffff81066bf3 <ia32_do_syscall+23>:        0x70c514ff
  201.      * (gdb)
  202.      *
  203.      */
  204.     p = (char *) memmem(sc_asm, OFFSET_SYSCALL, "\xff\x14\xc5", 3);
  205.     if (p == NULL) {
  206.         printk("opcode not found, meats that we cannot find sys_call_table.\n");
  207.         return 0;
  208.     }

  210.     retval = *(unsigned long *) (p + 3);
  211.     return retval;
  212. #undef OFFSET_SYSCALL
  213. }/*}}}*/


  216. /**
  217. * Find the location of long-mode sys_call_table
  218. */
  219. static unsigned long get_syscall_table_long(void)
  220. {/*{{{*/
  221. #define OFFSET_SYSCALL 150
  222.     unsigned long syscall_long, retval;
  223.     char sc_asm[OFFSET_SYSCALL];

  225.     rdmsrl(MSR_LSTAR, syscall_long);
  226.     dbgprint("long mode: system_call is at %p\n", (void *)syscall_long);

  228.     memcpy(sc_asm, (char *)syscall_long, OFFSET_SYSCALL);


  231.     /**
  232.      * Find callq *sys_call_table(,%rax,8) 
  233.      * -------------------------------------
  234.      * (gdb) disassemble system_call
  235.      * Dump of assembler code for function system_call:
  236.      * 0xffffffff81063750 <system_call+0>:     swapgs
  237.      * 0xffffffff81063753 <system_call+3>:     mov    %rsp,%gs:0x18
  238.      * 0xffffffff8106375c <system_call+12>:    mov    %gs:0x10,%rsp
  239.      * 0xffffffff81063765 <system_call+21>:    sti
  240.      * 0xffffffff81063766 <system_call+22>:    sub    $0x50,%rsp
  241.      * 0xffffffff8106376a <system_call+26>:    mov    %rdi,0x40(%rsp)
  242.      * 0xffffffff8106376f <system_call+31>:    mov    %rsi,0x38(%rsp)
  243.      * 0xffffffff81063774 <system_call+36>:    mov    %rdx,0x30(%rsp)
  244.      * 0xffffffff81063779 <system_call+41>:    mov    %rax,0x20(%rsp)
  245.      * 0xffffffff8106377e <system_call+46>:    mov    %r8,0x18(%rsp)
  246.      * 0xffffffff81063783 <system_call+51>:    mov    %r9,0x10(%rsp)
  247.      * 0xffffffff81063788 <system_call+56>:    mov    %r10,0x8(%rsp)
  248.      * 0xffffffff8106378d <system_call+61>:    mov    %r11,(%rsp)
  249.      * 0xffffffff81063791 <system_call+65>:    mov    %rax,0x48(%rsp)
  250.      * 0xffffffff81063796 <system_call+70>:    mov    %rcx,0x50(%rsp)
  251.      * 0xffffffff8106379b <system_call+75>:    mov    %gs:0x10,%rcx
  252.      * 0xffffffff810637a4 <system_call+84>:    sub    $0x1fd8,%rcx
  253.      * 0xffffffff810637ab <system_call+91>:    testl  $0x181,0x10(%rcx)
  254.      * 0xffffffff810637b2 <system_call+98>:    jne    0xffffffff81063889 <tracesys>
  255.      * 0xffffffff810637b8 <system_call+104>:   cmp    $0x117,%rax
  256.      * 0xffffffff810637be <system_call+110>:   ja     0xffffffff8106387b <badsys>
  257.      * 0xffffffff810637c4 <system_call+116>:   mov    %r10,%rcx
  258.      * 0xffffffff810637c7 <system_call+119>:   callq  *0xffffffff812e6d60(,%rax,8)
  259.      * 0xffffffff810637ce <system_call+126>:   mov    %rax,0x20(%rsp)
  260.      * End of assembler dump.
  261.      * (gdb) x/xw system_call+119
  262.      * 0xffffffff810637c7 <system_call+119>:   0x60c514ff
  263.      * (gdb)
  264.      */
  265.     retval = (unsigned long) memmem(sc_asm, OFFSET_SYSCALL, "\xff\x14\xc5", 3);
  266.     if ( retval != 0 ) {
  267.         dbgprint("long mode : sys_call_table is at %p\n", 
  268.                 (void *) (* (unsigned long *)(retval+3)) ) ;
  269.         retval = (unsigned long) ( * (unsigned long *)(retval+3) );
  270.     } else {
  271.         printk("long mode : memmem found nothing, returning NULL:( \n");
  272.         retval = 0;
  273.     } 

  275. #undef OFFSET_SYSCALL
  276.     return retval;
  277. }/*}}}*/




  282. static int get_syscall_init_module(void)
  283. {/*{{{*/
  284.     printk(KERN_DEBUG "get_syscall: Hi, you fucking linux!\n");

  286.     my_ia32_syscall_table = (void **) get_syscall_table_ia32();
  287.     if (my_ia32_syscall_table == 0)
  288.         return -1;

  290.     my_syscall_table = (void **) get_syscall_table_long();
  291.     if (my_syscall_table == 0)
  292.         return -1;

  294.     dbgprint("ia32_sys_call_table address : %p\n", (void *) my_ia32_syscall_table);
  295.     dbgprint("long mode : sys_call_table address : %p\n", (void *) my_syscall_table);

  297. #define REPLACE_IA32(x) o_sys_##x = my_ia32_syscall_table[__NR_ia32_##x];\
  298.     my_ia32_syscall_table[__NR_ia32_##x] = my_sys_##x

  300. #define GET_OLD_IA32_SYSCALL_ADDR(x) my_ia32_syscall_table[__NR_ia32_##x]
  301. //    dbgprint("sys_read at %p, my_read at %p\n", (void *)GET_OLD_IA32_SYSCALL_ADDR(read), (void *)my_sys_read);

  303. //    REPLACE_IA32(read);
  304. #undef REPLACE_IA32


  307.     return 0;
  308. }/*}}}*/


  311. static void get_syscall_exit_module(void)
  312. {/*{{{*/
  313.     printk(KERN_DEBUG "get_syscall: bye, you fucking linux!\n");

  315. #define RESTORE_IA32(x) my_ia32_syscall_table[__NR_ia32_##x] = o_sys_##x

  317. //    RESTORE_IA32(read);

  319. #undef RESTORE_IA32
  320. }/*}}}*/

  322. module_init(get_syscall_init_module);
  323. module_exit(get_syscall_exit_module);
复制代码




Reference :
http://phrack.org/archives/58/p58-0x07
 posted on 2011-08-26 16:56  chingliuyu  阅读(890)  评论(0)  编辑  收藏  举报