hook 卡死 获取系统表地址错误
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 | #include<linux/init.h> #include<linux/module.h> #include<linux/moduleparam.h> #include<linux/unistd.h> #include<linux/sched.h> #include<linux/syscalls.h> #include<linux/string.h> #include<linux/fs.h> #include<linux/fdtable.h> #include<linux/uaccess.h> #include <linux/kallsyms.h> #include<linux/rtc.h> #include<linux/vmalloc.h> #include <linux/slab.h> //module macros MODULE_LICENSE( "GPL" ); MODULE_DESCRIPTION( "hook sys_mkdir" ); //module constructor/destructor //typedef unsigned long (*sys_call_ptr_t)(void); sys_call_ptr_t *_sys_call_table = NULL; typedef asmlinkage long (*old_mkdir_t)( const char __user *pathname, umode_t mode); old_mkdir_t old_mkdir = NULL; // hooked mkdir function asmlinkage long hooked_mkdir( const char __user *pathname, umode_t mode) { printk( "hooked sys_mkdir(), mkdir name: " ); printk(pathname); old_mkdir(pathname, mode); } // memory protection shinanigans unsigned int level; pte_t *pte; //obtain sys_call_table static int get_sys_call_table( void ){ unsigned long tmp_sys_call_table = 0; int ans = 0; tmp_sys_call_table = kallsyms_lookup_name( "sys_call_table" ); if (tmp_sys_call_table != 0) { ans = 1; _sys_call_table = tmp_sys_call_table; printk( "[+] find sys_call_table: 0x%lx\n" , tmp_sys_call_table); } return ans; } // initialize the module static int hooked_init( void ) { printk( "+ Loading hook_mkdir module\n" ); if (!get_sys_call_table()){ return 0; } // now we can hook syscalls ...such as uname // first, save the old gate (fptr) old_mkdir = (old_mkdir_t) _sys_call_table[__NR_mkdir]; // unprotect sys_call_table memory page pte = lookup_address((unsigned long ) _sys_call_table, &level); // change PTE to allow writing set_pte_atomic(pte, pte_mkwrite(*pte)); printk( "+ unprotected kernel memory page containing sys_call_table\n" ); // now overwrite the __NR_uname entry with address to our uname _sys_call_table[__NR_mkdir] = (sys_call_ptr_t) hooked_mkdir; printk( "+ sys_mkdir hooked!\n" ); return 0; } static void hooked_exit( void ) { if (old_mkdir != NULL) { // restore sys_call_table to original state _sys_call_table[__NR_mkdir] = (sys_call_ptr_t) old_mkdir; // reprotect page set_pte_atomic(pte, pte_clear_flags(*pte, _PAGE_RW)); } printk( "+ Unloading hook_mkdir module\n" ); } /*entry/exit macros*/ module_init(hooked_init); module_exit(hooked_exit); |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 | CURRENT = $(shell uname -r ) KERNEL_TARGET=hello_Hkerner MODULE_NAME :=$(KERNEL_TARGET) MODULE_SUF=.ko PWD:=$(shell pwd ) OUTPUT=$(PWD)/ KDIR= /lib/modules/ $(CURRENT) /build INCLUDE=-I /usr/src/linux-headers-4 .9.0-3-common /include EXTRA_CFLAGS = -m64 -Wall -g $(INCLUDE) -lpthread #ccflags-y+=$(shell if [ $(call cc-version) -ge 0490 ] ; then echo "-Wno-error=date-time -Wno-date-time"; fi ;) obj-m:=$(MODULE_NAME).o $(MODULE_NAME)-objs:=TestKerner.o all: make -C $(KDIR) INCLUDE=$(INCLUDE) M=$(PWD) modules clean: make -C $(KDIR) M=$(PWD) clean .PHONY: modules clean |
【推荐】国内首个AI IDE,深度理解中文开发场景,立即下载体验Trae
【推荐】编程新体验,更懂你的AI,立即体验豆包MarsCode编程助手
【推荐】抖音旗下AI助手豆包,你的智能百科全书,全免费不限次数
【推荐】轻量又高性能的 SSH 工具 IShell:AI 加持,快人一步
· 记一次.NET内存居高不下排查解决与启示
· 探究高空视频全景AR技术的实现原理
· 理解Rust引用及其生命周期标识(上)
· 浏览器原生「磁吸」效果!Anchor Positioning 锚点定位神器解析
· 没有源码,如何修改代码逻辑?
· 全程不用写代码,我用AI程序员写了一个飞机大战
· DeepSeek 开源周回顾「GitHub 热点速览」
· MongoDB 8.0这个新功能碉堡了,比商业数据库还牛
· 记一次.NET内存居高不下排查解决与启示
· 白话解读 Dapr 1.15:你的「微服务管家」又秀新绝活了
2020-04-09 Linux获得mac地址
2020-04-09 校对:思路
2020-04-09 拒绝手机浏览器短视频
2020-04-09 问题:每秒的问题
2020-04-09 黑马校对软件
2018-04-09 oepnni安装