这是在 20CN网络安全小组第一代论坛 的论坛 编程破解 中的主题 codelmk(转自大鹰主页)


要查看这个主题,请使用这个 URL:
http://www.20cn.net/cgi-bin/ubb/ultimatebb.cgi?ubb=get_topic;f=5;t=000241

ucr (编号: 2804) 发表于 :
 
这个就是可以不用修改sys_call_table表挂接系统调用方法的实例

#define __KERNEL__
#define MODULE
#define MODVERSIONS

#define S_KERNEL_VERSION(a,b,c) (((a) << 16) + ((b) << 8) + (c))

#include <linux/modversions.h>
#include <linux/config.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/version.h>
#include <linux/utsname.h>
#include <linux/string.h>
#include <asm/string.h>
#include <asm/unistd.h>

#define SYSCALL_NR __NR_uname

static char syscall_code[7];
static char new_syscall_code[7] =
"\xbd\x00\x00\x00\x00" /* movl $0,%ebp */
"\xff\xe5" /* jmp *%ebp */
;

extern void *sys_call_table[];

void *_memcpy(void *dest, const void *src, int size)
{
const char *p = src;
char *q = dest;
int i;

for (i = 0; i < size; i++) *q++ = *p++;

return dest;
}

/*
uname
*/

int new_syscall(struct new_utsname *buf)
{
printk("UNAME - Here!I am e4gle!\n");
_memcpy(
sys_call_table[SYSCALL_NR], syscall_code,
sizeof(syscall_code)
);
((int (*)(struct new_utsname *))sys_call_table[SYSCALL_NR])(buf);
_memcpy(
sys_call_table[SYSCALL_NR], new_syscall_code,
sizeof(syscall_code)
);
}

int init_module(void)
{
*(long *)&new_syscall_code[1] = (long)new_syscall;
_memcpy(
syscall_code, sys_call_table[SYSCALL_NR],
sizeof(syscall_code)
);
_memcpy(
sys_call_table[SYSCALL_NR], new_syscall_code,
sizeof(syscall_code)
);
return 0;
}

void cleanup_module(void)
{
_memcpy(
sys_call_table[SYSCALL_NR], syscall_code,
sizeof(syscall_code)
);
}
 






Powered by Infopop Corporation
UBB.classic™ 6.5.0
NetDemon修改版 1.5.0, 20CN网络安全小组 版权所有。