Linux使用者空間擷取系統調用表地址(1)

一、代碼及實現

一）使用者空間原始碼

#include

#include

#include

#include

#include

#include

#include

#include

#include

#define CALLOFF 100 //讀取100位元組

struct {

unsigned short limit;

unsigned int base;

} __attribute__ ((packed)) idtr;  //這個結構表示IDTR寄存器，這個寄存器中儲存中斷描述符表 的地址

struct {

unsigned short off1;

unsigned short sel;

unsigned char none,flags;

unsigned short off2;

} __attribute__ ((packed)) idt;  //中斷描述符表中的內容：中斷門描述符

unsigned int old_readkmem (int fd, void * buf,size_t off,unsigned int size) //用read方式讀取kmem中一定長度內容

{

if (lseek64(fd, (unsigned long long)off,SEEK_SET)!=off)

{

perror("fd lseek error");

return 0;

}

if (read(fd, buf,size)!=size)

{

perror("fd read error");

return 0;

}

}

unsigned long readkmem (int fd, void * buf, size_t off, unsigned int size)//用mmap方式從kmem中讀取一定長度內容

{

size_t  moff, roff;

size_t   sz = getpagesize();

char * kmap;

unsigned long ret_old = old_readkmem(fd, buf, off, size); //先用老方法讀取,不行再用mmap