当前位置：首页 → 问答吧 → 请问改写系统调用函数的时候能否嵌套调用别的系统调用？

请问改写系统调用函数的时候能否嵌套调用别的系统调用？

时间：2010-07-30

来源：互联网

我按照论坛上的方法修改new_open函数的时候，想先在文件之中写点东西，就找到sys_call_table之中write和open函数的指针赋给old_write和old_open。
然后在new_open里面先调用old_open获得fd，然后调用old_write，但是创建文件的时候debug...old_write返回-14，打开文件的时候old_write返回-9。
查询错误列表一个是bad address，一个是Bad file number。
请问各位大大，这代表什么意思？fd是打开文件返回的，参数貌似应该没错啊。

作者: cdwzt 发布时间: 2010-07-30

贴一下你的代码

作者: 0vk0 发布时间: 2010-07-31

本帖最后由 cdwzt 于 2010-07-31 09:57 编辑

回复 0vk0

哦！好的！我是在Godbach 大大发的帖子的基础上改的。主要是open调用里面添加了点内容，但是查看系统日志发现在open里面调用old_write没有写成功，实际上文件也还是原来的大小。
但是lseek返回了正确的值（定义的宏#define PAGE_RESERVED 1000）

#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/module.h>
#include <linux/kprobes.h>
#include <linux/kallsyms.h>
#include <linux/sched.h>
#include <linux/ptrace.h>
#include <linux/mm.h>
#include <linux/smp.h>
#include <linux/user.h>
#include <linux/errno.h>
#include <linux/cpu.h>
#include <linux/syscalls.h>
#include <linux/fs.h> /*struct file*/
#include <linux/file.h> /*fget() fput()*/
#include <linux/fdtable.h> /*NR_OPEN_DEFAULT*/
#include <linux/dcache.h> /*d_path()*/
#include <linux/random.h>
#include <linux/syscalls.h>
#include <asm/uaccess.h>
#include <asm/fcntl.h>
#include <asm/unistd.h>
#define PAGE_RESERVED (4*1024)
MODULE_DESCRIPTION("Intercept the system call table in Linux");
MODULE_AUTHOR("alert7 ([email][email protected][/email]) \n\t\talbcamus <[email][email protected][/email]>");
MODULE_LICENSE("GPL");
/* comment the following line to shut me up */
#define INTERCEPT_DEBUG
#ifdef INTERCEPT_DEBUG
#define dbgprint(format,args...) \
printk("intercept: function:%s-L%d: "format, __FUNCTION__, __LINE__, ##args);
#else
#define dbgprint(format,args...) do {} while(0);
#endif
/**
* the system call table
*/
void **my_table;
unsigned int orig_cr0;
/**
* the original syscall functions
*/
asmlinkage long (*old_open) (char __user *filename, int flags, int mode);
asmlinkage int (*old_read) (unsigned int fd, char __user *buf, size_t count);
asmlinkage int (*old_write) (unsigned int fd, char __user *buf, size_t count);
asmlinkage long (*old_lseek) (unsigned int fd, off_t offset, unsigned int origin);
struct idtr {
unsigned short limit;
unsigned int base;
} __attribute__ ((packed));
struct idt {
unsigned short off1;
unsigned short sel;
unsigned char none, flags;
unsigned short off2;
} __attribute__ ((packed));
/**
* clear WP bit of CR0, and return the original value
*/
unsigned int clear_and_return_cr0(void)
{
unsigned int cr0 = 0;
unsigned int ret;
asm volatile ("movl %%cr0, %%eax"
: "=a"(cr0)
);
ret = cr0;
/* clear the 16 bit of CR0, a.k.a WP bit */
cr0 &= 0xfffeffff;
asm volatile ("movl %%eax, %%cr0"
:
: "a"(cr0)
);
return ret;
}
/** set CR0 with new value
*
* @val : new value to set in cr0
*/
void setback_cr0(unsigned int val)
{
asm volatile ("movl %%eax, %%cr0"
:
: "a"(val)
);
}
/**
* Return the first appearence of NEEDLE in HAYSTACK.
* */
static void *memmem(const void *haystack, size_t haystack_len,
const void *needle, size_t needle_len)
{/*{{{*/
const char *begin;
const char *const last_possible
= (const char *) haystack + haystack_len - needle_len;
if (needle_len == 0)
/* The first occurrence of the empty string is deemed to occur at
the beginning of the string. */
return (void *) haystack;
/* Sanity check, otherwise the loop might search through the whole
memory. */
if (__builtin_expect(haystack_len < needle_len, 0))
return NULL;
for (begin = (const char *) haystack; begin <= last_possible;
++begin)
if (begin[0] == ((const char *) needle)[0]
&& !memcmp((const void *) &begin[1],
(const void *) ((const char *) needle + 1),
needle_len - 1))
return (void *) begin;
return NULL;
}/*}}}*/
/**
* Find the location of sys_call_table
*/
static unsigned long get_sys_call_table(void)
{/*{{{*/
/* we'll read first 100 bytes of int $0x80 */
#define OFFSET_SYSCALL 100
struct idtr idtr;
struct idt idt;
unsigned sys_call_off;
unsigned retval;
char sc_asm[OFFSET_SYSCALL], *p;
/* well, let's read IDTR */
asm("sidt %0":"=m"(idtr)
:
:"memory" );
dbgprint("idtr base at 0x%X, limit at 0x%X\n", (unsigned int)idtr.base,(unsigned short)idtr.limit);
/* Read in IDT for vector 0x80 (syscall) */
memcpy(&idt, (char *) idtr.base + 8 * 0x80, sizeof(idt));
sys_call_off = (idt.off2 << 16) | idt.off1;
dbgprint("idt80: flags=%X sel=%X off=%X\n",
(unsigned) idt.flags, (unsigned) idt.sel, sys_call_off);
/* we have syscall routine address now, look for syscall table
dispatch (indirect call) */
memcpy(sc_asm, (void *)sys_call_off, OFFSET_SYSCALL);
/**
* Search opcode of `call sys_call_table(,eax,4)'
*/
p = (char *) memmem(sc_asm, OFFSET_SYSCALL, "\xff\x14\x85", 3);
if (p == NULL)
return 0;
retval = *(unsigned *) (p + 3);
if (p) {
dbgprint("sys_call_table at 0x%x, call dispatch at 0x%x\n",
retval, (unsigned int) p);
}
return retval;
#undef OFFSET_SYSCALL
}/*}}}*/
/**
* new_open - replace the original sys_open when initilazing,
* as well as be got rid of when removed
*/
asmlinkage long new_open(char *filename, int flags, int mode)
{
int i, write_return;
long fd;
unsigned char Flag, CNT[8];
char __user * CNT_user[8];
fd = old_open (filename, flags, mode);
//printk("open ...fd=%08X\n", fd);
i = 0;
while(((char*)(filename))[i++]!='\0');
if(i<=5)
{
goto ret;
}
i -= 5;
if(0 == (strcmp(&(((char*)(filename))[i]),".txt")))
{
printk("Cteate(open) txt files...fd=%08X\n", fd);
//get_random_bytes(CNT, 8);
memset(CNT, 0xAA, 8);
Flag = 1;
printk("next write flags and counter...");
old_write(fd, &Flag, 1);
//copy_to_user(CNT_user, CNT, 8);
write_return = old_write(fd, CNT, 8);
printk("write return:%d\n", write_return);
//i = old_lseek(fd, PAGE_RESERVED, SEEK_SET);
//printk("lseek return:%x\n", i);
}
ret:
return fd;
}
asmlinkage int new_read(unsigned int fd, char *buf, size_t count)
{
return old_read(fd, buf, count);
}
asmlinkage int new_write(unsigned int fd, char *buf, size_t count)
{
return old_write(fd, buf, count);
}
asmlinkage long new_lseek(unsigned int fd, off_t offset, unsigned int origin)
{
return old_lseek(fd, offset, origin);
}
static int intercept_init(void)
{
my_table = (void **)get_sys_call_table();
if (my_table == NULL)
return -1;
dbgprint("sys call table address %p\n", (void *) my_table);
#define REPLACE(x) old_##x = my_table[__NR_##x];\
my_table[__NR_##x] = new_##x
REPLACE(open);
REPLACE(read);
REPLACE(write);
REPLACE(lseek);
#if 0
can_exec_fork = can_intercept_fork_exec();
if(can_exec_fork == 1)
REPLACE(execve);
#endif
#undef REPLACE
return 0;
}
static int __init this_init(void)
{
int ret;
printk("syscall intercept: Hi, poor linux!\n");
orig_cr0 = clear_and_return_cr0();
ret = intercept_init();
setback_cr0(orig_cr0);
return ret;
}
static void __exit this_fini(void)
{
printk("syscall intercept: bye, poor linux!\n");
#define RESTORE(x) my_table[__NR_##x] = old_##x
orig_cr0 = clear_and_return_cr0();
RESTORE(open);
RESTORE(read);
RESTORE(write);
RESTORE(lseek);
#if 0
if(can_exec_fork == 1)
RESTORE(execve);
#endif
setback_cr0(orig_cr0);
#undef RESTORE
}
module_init(this_init);
module_exit(this_fini);

复制代码

作者: cdwzt 发布时间: 2010-07-31

请问改写系统调用函数的时候能否嵌套调用别的系统调用？

热门阅读

热门下载