linux动态替换内核函数,Linux内核中动态替换系统调用函数-CSDN博客

有点意思.囤起来以后用得着的时候看看.

先通过getSyscallTable(void)获得内存中的系统调用表的地址，然后就可以将自己的函数指针放在上面了。

Makefile：

obj-m := syscall.o

KERNELDIR := /lib/modules/$(shell uname -r)/build

PWD := $(shell pwd)

modules:

$(MAKE) -C $(KERNELDIR) M=$(PWD) modules

modules_install:

$(MAKE) -C $(KERNELDIR) M=$(PWD) modules_install

clean:

rm -rf *.o *~ core .depend .*.cmd *.ko *.mod.c .tmp_versions

Module.symvers

syscall.c:

#ifndef __KERNEL__

# define __KERNEL__

#endif

#ifndef MODULE

# define MODULE

#endif

#include

#ifdef CONFIG_SMP

#define __SMP__

#endif

#define __NR_testsyscall 39

unsigned long

**sys_call_table;

struct idt_tag

{

unsigned

short offset_low,segment_select;

unsigned

char reserved,flags;

unsigned

short offset_high;

};

unsigned long * savedcall;

static unsigned long

getSyscallTable(void)

{

unsigned

char idtr[6],*shell,*sort;

struct

idt_tag *idt;

unsigned

long system_call,sct;

unsigned

short offset_low,offset_high;

char

*p;

int i;

__asm__("sidt %0":"=m"(idtr));

idt =

(struct idt_tag*)((*(unsigned long*)&idtr[2]) + 8 *

0x80);

offset_low =

idt->offset_low;

offset_high

= idt->offset_high;

system_call

= (offset_high)<<16 |

offset_low; shell =

(char*)system_call;

sort =

"/xff/x14/x85";

for(i = 0;i < 100-2;i++)

if(shell [ i ] == sort[0] && shell[i+1] == sort[1]

&& shell[i+2] == sort[2])

break;

p =

&shell [ i ] + 3;

sct =

*(unsigned long*)p;

return

sct; }

asmlinkage long testsyscall(char

*buf)

{

printk("hello world/n");

char* b="hello world/n";

if(copy_to_user(buf,b,strlen(b))!=strlen(b))

{

printk("复制失败/n");

return -1;

}

printk("复制成功/n");

return 0;

}

int init_module(void)

{

sys_call_table = (unsigned

long**)getSyscallTable();

printk("***系统调用表的首地址为%p/n",sys_call_table);

savedcall=sys_call_table[__NR_testsyscall];//保存原来的调用

printk("原来的%d系统调用为：

%p/n",__NR_testsyscall,savedcall);

printk("目的系统调用为%p/n",(unsigned

long*)testsyscall);

sys_call_table[__NR_testsyscall]=(unsigned

long*)testsyscall;

printk("更改后的%d系统调用为：

%p/n",__NR_testsyscall,sys_call_table[__NR_testsyscall]);

printk("loaded success /n");

return 0;

}

void cleanup_module(void)

{

printk("恢复前的%d系统调用为：

%p/n",__NR_testsyscall,sys_call_table[__NR_testsyscall]);

sys_call_table[__NR_testsyscall]=savedcall;

printk("恢复后的%d系统调用为：

%p/n",__NR_testsyscall,sys_call_table[__NR_testsyscall]);

printk("unloaded success/n");

}

MODULE_LICENSE("GPL");

MODULE_AUTHOR("QCH");

测试程序：

#include

#define __NR_testsyscall

int

testsyscall(char *buf){

return syscall(__NR_testsyscall,buf);

}

int main()

{

char buf[128];

int i;

for(i=0;i<128;i++)

{

buf[i]='/0';

}

long r=-10;

r=testsyscall(buf);

printf("%s/n",buf);

return 0;

}