Export the Linux call table (sys_call_table)

Export the Linux system call table (sys_call_table)-Linux general technology-Linux programming and kernel information. The following is a detailed description. Post:

Linux Kernel does not export the system call table (sys_call_table) Since 2.4.18. This is really not good news for our friends who want to do something about system calls. A lot of convenient conditions are missing. If we change the kernel source code and add EXPORT_SYMBOL (sys_call_table), we can still export it. However, we need to re-compile the kernel, the most annoying thing is restarting (sometimes we are most afraid of restarting. As for why, everyone understands, haha ). If we are lucky enough to find/boot/System. map, we can still get it through a simple grep sys_call_table/boot/System. map, but not all systems have this file. Fortunately, LKM provides us with the ability to access the kernel space, but how can we start with a large system?
Code related to the disassembly system call:
(Gdb) disas syscall_call
Dump of Cycler code for function syscall_call:
0xc0102e0a : Call * 0xc030948c (, % eax, 4)
0xc0102e11 : Mov % eax, 0x18 (% esp)
End of worker er dump.
(Gdb) x/8x 0xc0102e0a
0xc0102e0a : 0x8c8514ff 0x89c03094 0xfa182444 0x66084d8b
0xc0102e1a : 0xfeffc1f7 0x00cc850f 0x448b0000 0x648a3024

We can see that the blue part is the flag string to be found, and the high address next to it is the sys_call_table address we are looking. To narrow down the search scope, we only need to look down from the int $0x80 entry function, and its address can be directly obtained using the command sidt. The Code is as follows:
/*
* Copyright (c) 2006 xiaosuo
*
* Copyright (c) 2003 Dallachiesa Michelin
*
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or
* Modification are permitted.
*
* This software is provided by the author and contributors ''as is'' AND
* Any express or implied warranties, INCLUDING, but not limited to,
* Implied warranties of merchantability and fitness for a particle PURPOSE
* Are disclaimed. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
* For any direct, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, but not limited to, PROCUREMENT OF SUBSTITUTE GOODS
* Or services; loss of use, DATA, or profits; or business interruption)
* However caused and on any theory of liability, whether in contract, STRICT
* LIABILITY, or tort (including negligence or otherwise) ARISING IN ANY WAY
* Out of the use of this software, EVEN IF ADVISED OF THE POSSIBILITY
* Such damage.
*
*
* DESCRIPTION
*
* Redhat kernels don't export the sys_call_table symbol anymore .. this
* Is a workaround that let you use your old LKMs without fix them.
*
* In fact, the kernel (> = 2.4.18) don't export the sys_call_table symbol
* Anymore...
*
* USAGE
*
* Build this as a kernel module and loaded
*
* + Greetz: (# phrack. it | antifork.org) guys
* + Sys_call_table [] address lookup code from phrack 58 #0x07 by sd
*/
# Ifndef MODULE
# Define MODULE
# Endif
# Ifndef _ KERNEL __
# Define _ KERNEL __
# Endif
# Include
# Ifdef USE_SYMBOL_NAME
# Include
# Endif
# Include
# Define CALLOFF 100
Unsigned long sys_call_table = 0;
EXPORT_SYMBOL (sys_call_table );
Struct {
Unsigned short limit;
Unsigned int base;
} _ Attribute _ (packed) idtr;
Struct {
Unsigned short offset_low;
Unsigned short sel;
Unsigned char none, flags;
Unsigned short offset_high;
} _ Attribute _ (packed) * idt;
/*
* The/proc/kallsyms is not updated.
*/
Int set_symbol_value (unsigned long old_value, unsigned long value)
{
Struct kernel_symbol * ksyms;
Int I;
Ksyms = (struct kernel_symbol *) (THIS_MODULE-> syms );
For (I = 0; I <THIS_MODULE-> num_syms; I ++ ){
# Ifdef USE_SYMBOL_NAME
If (strcmp (ksyms . Name, "sys_call_table") = 0 ){
# Else
If (ksyms. Value = old_value ){
# Endif
Ksyms. Value = value;
Return 0;
}
}
Return-1;
}
Char * findoffset (char * start)
{
Char * p;
For (p = start; p <start + CALLOFF; p ++)
If (* (p + 0) = '\ xff' & * (p + 1) = '\ x14'
& * (P + 2) = '\ x85 ')
Return p;
Return NULL;
}
Int init_module (void)
{
Unsigned sys_call_off;
Char * p;
_ Asm _ ("sidt % 0": "= m" (idtr ));
Idt = (void *) (idtr. base + 8*0x80 );
Sys_call_off = (idt-> offset_high <16) | idt-> offset_low;
If (p = findoffset (char *) sys_call_off ))){
Return set_symbol_value (unsigned long) & sys_call_table,
* (Unsigned long *) (p + 3 )));
}
Return-1;
}
Void cleanup_module (void)
{
}

In addition, because the fact that sys_call_table is always between loops_per_jiffy and boot_cpu_data, you can use these two signed addresses as the boundary for query!
/* This method first be found in the dazuko 2.0.6
*/
Static void ** dazuko_get_sct (void)
{
Unsigned long ptr;
Extern int loops_per_jiffy;
Unsigned long * p;
For (ptr = (unsigned long) & loops_per_jiffy; ptr <(unsigned long) & boot_cpu_data;
Ptr + = sizeof (void *)){
P = (unsigned long *) ptr;
If (p [6] = (unsigned long) sys_close ){
Return (void **) p;
}
}
Return NULL;
}