Hijacking system calling in Linux

Article Title: Implementing hijacking system calls in Linux. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.

I. Code and implementation

(1) hijack the code called by the open System

The kernel-mode hijacking system call code is as follows. For details, refer to link 1, which is the Code provided by albcamus. I have blocked some code here, only implementing hijacking of open system calls.

# Include

# Include

# Include

# Include

# Include

# Include

# Include

# Include

# Include

# Include

# Include

# Include

# Include

# Include

# Include

MODULE_DESCRIPTION ("Intercept the system call table in Linux ");

MODULE_AUTHOR ("alert7 ([email] alert7@xfocus.org [/email]) \ n \ t \ talbcamus <[email] albcamus@gmail.com [/email]> ");

MODULE_LICENSE ("GPL ");

/* Comment the following line to shut me up */

# Define INTERCEPT_DEBUG

# Ifdef INTERCEPT_DEBUG

# Define dbuplint (format, args ...)\

Printk ("intercept: function: % s-L % d:" format, _ FUNCTION __, _ LINE __,## args );

# Else

# Define dbuplint (format, args...) do {} while (0 );

# Endif

/**

* The system call table

*/

Void ** my_table;

Unsigned int orig_cr0;

/**

* The original syscall functions

*/

Asmlinkage long (* old_open) (char _ user * filename, int flags, int mode );

Asmlinkage int (* old_execve) (struct pt_regs regs );

/** Do_execve and do_fork */

Unsigned int can_exec_fork = 0;

Int (* new_do_execve) (char * filename,

Char _ user * argv,

Char _ user * envp,

Struct pt_regs * regs );

Struct idtr {

Unsigned short limit;

Unsigned int base;

} _ Attribute _ (packed ));

Struct idt {

Unsigned short off1;

Unsigned short sel;

Unsigned char none, flags;

Unsigned short off2;

} _ Attribute _ (packed ));

# If 0

/**

* Check if we can intercept fork/vfork/clone/execve or not

*

* Return: 0 for no, 1 for yes

*/

Struct kprobe kp_exec;

Unsigned int can_intercept_fork_exec (void)

{

Int ret = 0;

# Ifndef CONFIG_KPROBES

Return ret;

# Endif

Kp_exec.symbol_name = "do_execve ";

Ret = register_kprobe (& kp_exec );

If (ret! = 0 ){

Dbuplint ("cannot find do_execve by kprobe. \ n ");

Return 0;

}

New_do_execve = (int (*)

(Char *,

Char _ user *,

Char _ user *,

Struct pt_regs *

)

) Kp_exec.addr;

Dbuplint ("do_execve at % p \ n", (void *) kp_exec.addr );

Unregister_kprobe (& kp_exec );

Return 1;

}

# Endif

[1] [2] [3] [4] Next page