学步园

#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/module.h>
#include <asm/unistd.h>
MODULE_DESCRIPTION("My kernel module");
MODULE_AUTHOR("root (root@10h212.xjtu.edu.cn)");
MODULE_LICENSE("$LICENSE$");

struct idt
{
unsigned short limit;
unsigned int base;
}__attribute__((packed));

struct idt_gate
{
unsigned short off1;
unsigned short sel;
unsigned char nome,flags;
unsigned short off2;
}__attribute__((packed));

unsigned int get_idt_base()
{
 unsigned int base;
struct idt idt_table;
__asm__ __volatile__("sidt %0":"=m"(idt_table));
base=idt_table.base;
return base;
}

unsigned int get_sys_call_entry(unsigned int idt_base)
{
struct idt_gate sys_call;
memcpy(&sys_call,idt_base+8*0x80,sizeof(struct idt_gate));
unsigned int sys_call_entry=(sys_call.off2 << 16) | sys_call.off1;
return sys_call_entry;
}

unsigned int get_sys_call_table_entry(unsigned int sys_call_entry,char * exp,char exp_len,unsigned int cope)
{
char * begin=sys_call_entry;
char * end=sys_call_entry+cope;
for(;begin<end;begin++)
{
 if(begin[0]==exp[0]&&begin[1]==exp[1]&&begin[2]==exp[2])
   return *((unsigned int *)(begin+3));
}
return 0;
}

void setback_cr0(unsigned int val)
 {
     asm volatile ("movl %%eax, %%cr0"
               :
               : "a"(val)
               );
 }
unsigned int clear_cr0_save()
{
   unsigned int cr0 = 0;
   unsigned int ret;
   __asm__ __volatile__ ("movl %%cr0, %%eax":"=a"(cr0));
   ret = cr0;

  cr0 &= 0xfffeffff;
  asm volatile ("movl %%eax, %%cr0":: "a"(cr0));
  return ret;
}

// new mkdir
asmlinkage long my_mkdir(const char *name,int mod)
{
printk(KERN_ALERT"mkdir call is intercepted\n");
}
asmlinkage long my_open(const char *name,int mod)
{
printk(KERN_ALERT"open call is intercepted\n");
}
static int syscall_info_init_module(void)
{
        unsigned int idt_base=get_idt_base();
        printk( KERN_ALERT"the idt base address is %x\n",idt_base );
    unsigned int sys_call_entry=get_sys_call_entry(idt_base);
    printk( KERN_ALERT"the sys call entry is %x\n",sys_call_entry );
        unsigned int sys_table=get_sys_call_table_entry(sys_call_entry,"\xff\x14\x85",3,100);
    void ** table=(void **)sys_table;
   
    //wp clear
      unsigned int cr0=clear_cr0_save();
    // intercept mkdir call
    table[__NR_mkdir]=my_mkdir;
      //   table[__NR_open]=my_mkoep;
    //set wp bit
    setback_cr0(cr0);
    printk( KERN_ALERT"the sys table  is %x\n",sys_table );
    return 0;
}
static void syscall_info_exit_module(void)
{
    printk( KERN_DEBUG "Module syscall_info exit\n" );
}

module_init(syscall_info_init_module);
module_exit(syscall_info_exit_module);

实现原理：

在linux中使用0x80 异常实现系统调用，因此，主要的实现路径：获得中断向量表->获得系统调用中断处理函数地址->获得系统调用符号表->修改对应变量的偏移值指向新的系统调用程序(后门程序)。

一，中断像量表的获取。

在x86中，idtr寄存器使得中断向量表可以存放在内存的任何位置，idtr寄存器有一个基地址和一个段限组成，高四字节为基地址，低两字节为段限。可以通过sidt指令获得idtr的内容。

struct idt
{
unsigned short limit;
unsigned int base;
}__attribute__((packed));