linux内核勾点,Linux内核：系统调用钩子示例

我终于找到了答案自己。

内核在某个点被改变，使得系统调用表是只读的。

密码：

Even if it is late but the Solution

may interest others too: In the

entry.S file you will find: Code:

06000

sys_call_table -> ReadOnly You have to

compile the Kernel new if you want to

“hack” around with sys_call_table…

链接还有一个将内存更改为可写的示例。

nasekomoe：

Hi everybody. Thanks for replies. I

solved the problem long ago by

modifying access to memory pages. I

have implemented two functions that do

it for my upper level code:

06001

这是一个适用于我的原始代码的修改版本。

#include

#include

#include

#include

#include

#include

void **sys_call_table;

asmlinkage int (*original_call) (const char*, int, int);

asmlinkage int our_sys_open(const char* file, int flags, int mode)

{

printk("A file was opened\n");

return original_call(file, flags, mode);

}

int set_page_rw(long unsigned int _addr)

{

struct page *pg;

pgprot_t prot;

pg = virt_to_page(_addr);

prot.pgprot = VM_READ | VM_WRITE;

return change_page_attr(pg, 1, prot);

}

int init_module()

{

// sys_call_table address in System.map

sys_call_table = (void*)0xc061e4e0;

original_call = sys_call_table[__NR_open];

set_page_rw(sys_call_table);

sys_call_table[__NR_open] = our_sys_open;

}

void cleanup_module()

{

// Restore the original call

sys_call_table[__NR_open] = original_call;

}