hook 卡死 获取系统表地址错误

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
#include<linux/init.h>
#include<linux/module.h>
#include<linux/moduleparam.h>
#include<linux/unistd.h>
#include<linux/sched.h>
#include<linux/syscalls.h>
#include<linux/string.h>
#include<linux/fs.h>
#include<linux/fdtable.h>
#include<linux/uaccess.h>
#include <linux/kallsyms.h>
#include<linux/rtc.h>
#include<linux/vmalloc.h>
#include <linux/slab.h>
//module macros
MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("hook sys_mkdir");
//module constructor/destructor
//typedef unsigned long (*sys_call_ptr_t)(void);
sys_call_ptr_t *_sys_call_table = NULL;
typedef asmlinkage long (*old_mkdir_t)(const char __user *pathname, umode_t mode);
old_mkdir_t old_mkdir = NULL;
// hooked mkdir function
asmlinkage long hooked_mkdir(const char __user *pathname, umode_t mode) {
printk("hooked sys_mkdir(), mkdir name: ");
printk(pathname);
old_mkdir(pathname, mode);
}
// memory protection shinanigans
unsigned int level;
pte_t *pte;
//obtain sys_call_table
static int get_sys_call_table(void){
unsigned long tmp_sys_call_table = 0;
int ans = 0;
tmp_sys_call_table = kallsyms_lookup_name("sys_call_table");
if(tmp_sys_call_table != 0)
{
ans = 1;
_sys_call_table = tmp_sys_call_table;
printk("[+] find sys_call_table: 0x%lx\n", tmp_sys_call_table);
}
return ans;
}
// initialize the module
static int hooked_init(void) {
printk("+ Loading hook_mkdir module\n");
if(!get_sys_call_table()){
return 0;
}
// now we can hook syscalls ...such as uname
// first, save the old gate (fptr)
old_mkdir = (old_mkdir_t) _sys_call_table[__NR_mkdir];
// unprotect sys_call_table memory page
pte = lookup_address((unsigned long) _sys_call_table, &level);
// change PTE to allow writing
set_pte_atomic(pte, pte_mkwrite(*pte));
printk("+ unprotected kernel memory page containing sys_call_table\n");
// now overwrite the __NR_uname entry with address to our uname
_sys_call_table[__NR_mkdir] = (sys_call_ptr_t) hooked_mkdir;
printk("+ sys_mkdir hooked!\n");
return 0;
}
static void hooked_exit(void) {
if(old_mkdir != NULL) {
// restore sys_call_table to original state
_sys_call_table[__NR_mkdir] = (sys_call_ptr_t) old_mkdir;
// reprotect page
set_pte_atomic(pte, pte_clear_flags(*pte, _PAGE_RW));
}
printk("+ Unloading hook_mkdir module\n");
}
/*entry/exit macros*/
module_init(hooked_init);
module_exit(hooked_exit);

 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
CURRENT = $(shell uname -r )
KERNEL_TARGET=hello_Hkerner
MODULE_NAME :=$(KERNEL_TARGET)
MODULE_SUF=.ko
PWD:=$(shell pwd)
OUTPUT=$(PWD)/
KDIR=/lib/modules/$(CURRENT)/build
 
INCLUDE=-I/usr/src/linux-headers-4.9.0-3-common/include
EXTRA_CFLAGS = -m64  -Wall -g $(INCLUDE) -lpthread
#ccflags-y+=$(shell if [ $(call cc-version) -ge 0490 ] ; then echo "-Wno-error=date-time -Wno-date-time"; fi ;)
 
obj-m:=$(MODULE_NAME).o
$(MODULE_NAME)-objs:=TestKerner.o 
all:
    make -C  $(KDIR) INCLUDE=$(INCLUDE) M=$(PWD) modules
clean:
    make -C $(KDIR) M=$(PWD) clean
.PHONY: modules clean

 

posted on   lydstory  阅读(74)  评论(0编辑  收藏  举报

编辑推荐:
· 记一次.NET内存居高不下排查解决与启示
· 探究高空视频全景AR技术的实现原理
· 理解Rust引用及其生命周期标识(上)
· 浏览器原生「磁吸」效果!Anchor Positioning 锚点定位神器解析
· 没有源码,如何修改代码逻辑?
阅读排行:
· 全程不用写代码,我用AI程序员写了一个飞机大战
· DeepSeek 开源周回顾「GitHub 热点速览」
· MongoDB 8.0这个新功能碉堡了,比商业数据库还牛
· 记一次.NET内存居高不下排查解决与启示
· 白话解读 Dapr 1.15:你的「微服务管家」又秀新绝活了
历史上的今天:
2020-04-09 Linux获得mac地址
2020-04-09 校对:思路
2020-04-09 拒绝手机浏览器短视频
2020-04-09 问题:每秒的问题
2020-04-09 黑马校对软件
2018-04-09 oepnni安装

导航

< 2025年3月 >
23 24 25 26 27 28 1
2 3 4 5 6 7 8
9 10 11 12 13 14 15
16 17 18 19 20 21 22
23 24 25 26 27 28 29
30 31 1 2 3 4 5

统计

点击右上角即可分享
微信分享提示