linux动态替换内核函数,Linux内核中动态替换系统调用函数

有点意思.囤起来以后用得着的时候看看.

先通过getSyscallTable(void)获得内存中的系统调用表的地址&＃xff0c;然后就可以将自己的函数指针放在上面了。

Makefile&＃xff1a;

obj-m :&＃61; syscall.o

KERNELDIR :&＃61; /lib/modules/$(shell uname -r)/build

PWD :&＃61; $(shell pwd)

modules:

$(MAKE) -C $(KERNELDIR) M&＃61;$(PWD) modules

modules_install:

$(MAKE) -C $(KERNELDIR) M&＃61;$(PWD) modules_install

clean:

rm -rf *.o *~ core .depend .*.cmd *.ko *.mod.c .tmp_versions

Module.symvers

syscall.c:

#ifndef __KERNEL__

# define __KERNEL__

#endif

#ifndef MODULE

# define MODULE

#endif

#include

#include

#include

#include

#include

#include

#include

#ifdef CONFIG_SMP

#define __SMP__

#endif

#define __NR_testsyscall 39

unsigned long

**sys_call_table;

struct idt_tag

{

unsigned

short offset_low,segment_select;

unsigned

char reserved,flags;

unsigned

short offset_high;

};

unsigned long * savedcall;

static unsigned long

getSyscallTable(void)

{

unsigned

char idtr[6],*shell,*sort;

struct

idt_tag *idt;

unsigned

long system_call,sct;

unsigned

short offset_low,offset_high;

char

*p;

int i;

__asm__("sidt %0":"&＃61;m"(idtr));

idt &＃61;

(struct idt_tag*)((*(unsigned long*)&idtr[2]) &＃43; 8 *

0x80);

offset_low &＃61;

idt->offset_low;

offset_high

&＃61; idt->offset_high;

system_call

&＃61; (offset_high)<<16 |

offset_low; shell &＃61;

(char*)system_call;

sort &＃61;

"/xff/x14/x85";

for(i &＃61; 0;i <100-2;i&＃43;&＃43;)

if(shell [ i ] &＃61;&＃61; sort[0] && shell[i&＃43;1] &＃61;&＃61; sort[1]

&& shell[i&＃43;2] &＃61;&＃61; sort[2])

break;

p &＃61;

&shell [ i ] &＃43; 3;

sct &＃61;

*(unsigned long*)p;

return

sct; }

asmlinkage long testsyscall(char

*buf)

{

printk("hello world/n");

char* b&＃61;"hello world/n";

if(copy_to_user(buf,b,strlen(b))!&＃61;strlen(b))

{

printk("复制失败/n");

return -1;

}

printk("复制成功/n");

return 0;

}

int init_module(void)

{

sys_call_table &＃61; (unsigned

long**)getSyscallTable();

printk("***系统调用表的首地址为%p/n",sys_call_table);

savedcall&＃61;sys_call_table[__NR_testsyscall];//保存原来的调用

printk("原来的%d系统调用为&＃xff1a;

%p/n",__NR_testsyscall,savedcall);

printk("目的系统调用为%p/n",(unsigned

long*)testsyscall);

sys_call_table[__NR_testsyscall]&＃61;(unsigned

long*)testsyscall;

printk("更改后的%d系统调用为&＃xff1a;

%p/n",__NR_testsyscall,sys_call_table[__NR_testsyscall]);

printk("loaded success /n");

return 0;

}

void cleanup_module(void)

{

printk("恢复前的%d系统调用为&＃xff1a;

%p/n",__NR_testsyscall,sys_call_table[__NR_testsyscall]);

sys_call_table[__NR_testsyscall]&＃61;savedcall;

printk("恢复后的%d系统调用为&＃xff1a;

%p/n",__NR_testsyscall,sys_call_table[__NR_testsyscall]);

printk("unloaded success/n");

}

MODULE_LICENSE("GPL");

MODULE_AUTHOR("QCH");

测试程序&＃xff1a;

#include

#include

#include

#define __NR_testsyscall

39

int

testsyscall(char *buf){

return syscall(__NR_testsyscall,buf);

}

int main()

{

char buf[128];

int i;

for(i&＃61;0;i<128;i&＃43;&＃43;)

{

buf[i]&＃61;&＃39;/0&＃39;;

}

long r&＃61;-10;

r&＃61;testsyscall(buf);

printf("%s/n",buf);

return 0;

}