Linux下实现劫持系统调用的总结

冷秋风扫落叶

谢谢Godbach兄

孤行者_cuit

赞，赞

iyunny

您好,我想获得系统运行时所有进程的所有系统调用,怎么实现？麻烦您给相关提示，或者相关资料，我在entry.S中找到系统调用那块，能劫持到系统调用号，但是不知道如何用汇编代码将内核中的信息打印到文件,希望您能给些帮助，不生感激~
回复 1# Godbach


   

mousexqshe

                楼主你好，学习完后，我自己实践了一下，想劫持read操作，但是出现了死循环，请问如何解决啊？修改后的代码如下
#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/module.h>
#include <linux/kprobes.h>
#include <linux/kallsyms.h>
#include <linux/sched.h>
#include <linux/ptrace.h>
#include <linux/mm.h>
#include <linux/smp.h>
#include <linux/user.h>
#include <linux/errno.h>
#include <linux/cpu.h>
#include <asm/uaccess.h>
#include <asm/fcntl.h>
#include <asm/unistd.h>

MODULE_DESCRIPTION("Intercept the system call table in Linux");
MODULE_AUTHOR("alert7 (alert7@xfocus.org) \n\t\talbcamus <albcamus@gmail.com>");
MODULE_LICENSE("GPL");


/* comment the following line to shut me up */
#define INTERCEPT_DEBUG

#ifdef INTERCEPT_DEBUG
    #define dbgprint(format,args...) \
        printk("intercept: function:%s-L%d: "format, __FUNCTION__, __LINE__, ##args);
#else
    #define dbgprint(format,args...)  do {} while(0);
#endif


/**
* the system call table
*/
void **my_table;

unsigned int orig_cr0;

/**
* the original syscall functions
*/
asmlinkage long (*old_open) (char __user *filename, int flags, int mode);
asmlinkage long (*old_write) (unsigned int fd, const char __user * buf, size_t count);
asmlinkage long (*old_read) (unsigned int fd, const char __user * buf, size_t count);
asmlinkage int  (*old_execve) (struct pt_regs regs);



/** do_execve and do_fork */
unsigned int can_exec_fork = 0;
int    (*new_do_execve) (char * filename,
            char __user *__user *argv,
            char __user *__user *envp,
            struct pt_regs * regs);


struct idtr {
    unsigned short limit;
    unsigned int base;
} __attribute__ ((packed));


struct idt {
    unsigned short off1;
    unsigned short sel;
    unsigned char none, flags;
    unsigned short off2;
} __attribute__ ((packed));


#if 0
/**
*  check if we can intercept fork/vfork/clone/execve or not
*
*  return : 0 for no, 1 for yes
*/
struct kprobe kp_exec;
unsigned int can_intercept_fork_exec(void)
{
    int ret = 0;

#ifndef CONFIG_KPROBES
    return ret;
#endif

    kp_exec.symbol_name = "do_execve";

    ret = register_kprobe(&kp_exec);
    if (ret != 0 ) {
        dbgprint("cannot find do_execve by kprobe.\n");
        return 0;
    }
    new_do_execve = ( int (*)
             (char *,
              char __user * __user *,
              char __user * __user *,
              struct pt_regs *
             )
            ) kp_exec.addr;

    dbgprint("do_execve at %p\n", (void *)kp_exec.addr);
    unregister_kprobe(&kp_exec);


    return 1;
}

#endif

/**
* clear WP bit of CR0, and return the original value
*/
unsigned int clear_and_return_cr0(void)
{
    unsigned int cr0 = 0;
    unsigned int ret;

    asm volatile ("movl %%cr0, %%eax"
              : "=a"(cr0)
              );
    ret = cr0;

    /* clear the 16 bit of CR0, a.k.a WP bit */
    cr0 &= 0xfffeffff;

    asm volatile ("movl %%eax, %%cr0"
              :
              : "a"(cr0)
              );
    return ret;
}

/** set CR0 with new value
*
* @val : new value to set in cr0
*/
void setback_cr0(unsigned int val)
{
    asm volatile ("movl %%eax, %%cr0"
              :
              : "a"(val)
              );
}


/**
* Return the first appearence of NEEDLE in HAYSTACK.  
* */
static void *memmem(const void *haystack, size_t haystack_len,
            const void *needle, size_t needle_len)
{/*{{{*/
    const char *begin;
    const char *const last_possible
        = (const char *) haystack + haystack_len - needle_len;

    if (needle_len == 0)
        /* The first occurrence of the empty string is deemed to occur at
           the beginning of the string.  */
        return (void *) haystack;

    /* Sanity check, otherwise the loop might search through the whole
       memory.  */
    if (__builtin_expect(haystack_len < needle_len, 0))
        return NULL;

    for (begin = (const char *) haystack; begin <= last_possible;
         ++begin)
        if (begin[0] == ((const char *) needle)[0]
            && !memcmp((const void *) &begin[1],
                   (const void *) ((const char *) needle + 1),
                   needle_len - 1))
            return (void *) begin;

    return NULL;
}/*}}}*/


/**
* Find the location of sys_call_table
*/
static unsigned long get_sys_call_table(void)
{/*{{{*/
/* we'll read first 100 bytes of int $0x80 */
#define OFFSET_SYSCALL 100        

    struct idtr idtr;
    struct idt idt;
    unsigned sys_call_off;
    unsigned retval;
    char sc_asm[OFFSET_SYSCALL], *p;

    /* well, let's read IDTR */
    asm("sidt %0":"=m"(idtr)
             :
             :"memory" );

    dbgprint("idtr base at 0x%X, limit at 0x%X\n", (unsigned int)idtr.base,(unsigned short)idtr.limit);

    /* Read in IDT for vector 0x80 (syscall) */
    memcpy(&idt, (char *) idtr.base + 8 * 0x80, sizeof(idt));

    sys_call_off = (idt.off2 << 16) | idt.off1;

    dbgprint("idt80: flags=%X sel=%X off=%X\n",
                 (unsigned) idt.flags, (unsigned) idt.sel, sys_call_off);

    /* we have syscall routine address now, look for syscall table
       dispatch (indirect call) */
    memcpy(sc_asm, (void *)sys_call_off, OFFSET_SYSCALL);

    /**
     * Search opcode of `call sys_call_table(,eax,4)'
     */
    p = (char *) memmem(sc_asm, OFFSET_SYSCALL, "\xff\x14\x85", 3);
    if (p == NULL)
        return 0;

    retval = *(unsigned *) (p + 3);
    if (p) {
        dbgprint("sys_call_table at 0x%x, call dispatch at 0x%x\n",
             retval, (unsigned int) p);
    }
    return retval;
#undef OFFSET_SYSCALL
}/*}}}*/



/**
* new_open - replace the original sys_open when initilazing,
*           as well as be got rid of when removed
*/
asmlinkage long new_open(char *filename, int flags, int mode)
{
    dbgprint("call open()\n");
    return old_open (filename, flags, mode);
}

asmlinkage long new_write(unsigned int fd, const char __user * buf, size_t count)
{
    dbgprint("call write()\n");
    return old_write (fd, buf, count);;
}

asmlinkage long new_read(unsigned int fd, const char __user * buf, size_t count)
{
    dbgprint("call read()\n");
    return old_read (fd, buf, count);;
}

/**
* new_execve - you should change this function whenever the kernel's sys_execve()
* changes
*/
asmlinkage int new_execve(struct pt_regs regs)
{
    int error;
    char *filename;

    dbgprint("Hello\n");

    filename = getname( (char __user *) regs.ebx );
    error = PTR_ERR(filename);
    if ( IS_ERR(filename) )
        goto out;
    dbgprint("file to execve: %s\n", filename);
    error = new_do_execve(filename,
                  (char __user * __user *) regs.ecx,
                  (char __user * __user *) regs.edx,
                  &regs);
    if (error == 0) {
        task_lock(current);
        current->ptrace &= ~PT_DTRACE;
        task_unlock(current);
        set_thread_flag(TIF_IRET);
    }
    putname (filename);
out:
    return error;
}

static int intercept_init(void)
{
    my_table = (void **)get_sys_call_table();
    if (my_table == NULL)
        return -1;

    dbgprint("sys call table address %p\n", (void *) my_table);

#define REPLACE(x) old_##x = my_table[__NR_##x];\
    my_table[__NR_##x] = new_##x

   
//    REPLACE(open);
                        REPLACE(read);
#if 0
    can_exec_fork = can_intercept_fork_exec();
    if(can_exec_fork == 1)
        REPLACE(execve);
#endif

#undef REPLACE
    return 0;
}

static int __init this_init(void)
{
    int ret;
    printk("syscall intercept: Hi, poor linux!\n");

    orig_cr0 = clear_and_return_cr0();   
    ret = intercept_init();
    setback_cr0(orig_cr0);

    return ret;
}

static void __exit this_fini(void)
{
    printk("syscall intercept: bye, poor linux!\n");

#define RESTORE(x) my_table[__NR_##x] = old_##x

    orig_cr0 = clear_and_return_cr0();   
    RESTORE(open);
#if 0
    if(can_exec_fork == 1)
        RESTORE(execve);
#endif
    setback_cr0(orig_cr0);

#undef RESTORE
}

module_init(this_init);
module_exit(this_fini);


错误截图：

wugj03

我是在kernel 2.6.32上跑的，劫持了read系统调用出现了panic，其他系统调用都没有问题，求大神指点

1.bug重现：
#insmod prov.ko (涉及的模块)
...read some files...
#rmmod prov
#insmod prov.ko
切换到另一个tty终端上，系统就崩溃了。
PS：a.在第一次insmod时，点击另外一个tty终端，是不会出错的。
b. 去掉if(ret ==0){...}， 也是不会出现panic的
c. 不是每次都会出现，但基本都出现，否则就要多一次rmmod,insmod，才出现panic

附全部代码：

1. #include <linux/kernel.h>
   
2. #include <linux/init.h>
   
3. #include <linux/module.h>
   
4. #include <linux/kprobes.h>
   
5. #include <linux/kallsyms.h>
   
6. #include <linux/sched.h>
   
7. #include <linux/ptrace.h>
   
8. #include <linux/mm.h>
   
9. #include <linux/fs.h>
   
10. #include <linux/file.h>
    
11. #include <linux/smp.h>
    
12. #include <linux/user.h>
    
13. #include <linux/errno.h>
    
14. #include <linux/cpu.h>
    
15. #include <asm/uaccess.h>
    
16. #include <asm/fcntl.h>
    
17. #include <asm/unistd.h>
    
18. 
    
19. MODULE_DESCRIPTION("Intercept the system call table in Linux");
    
20. MODULE_LICENSE("GPL");
    
21. 
    
22. 
    
23. /* comment the following line to shut me up */
    
24. #define INTERCEPT_DEBUG
    
25. 
    
26. #ifdef INTERCEPT_DEBUG
    
27.     #define dbgprint(format,args...) \
    
28.         printk("intercept: function:%s-L%d: "format, __FUNCTION__, __LINE__, ##args);
    
29. #else
    
30.     #define dbgprint(format,args...)  do {} while(0);
    
31. #endif
    
32. 
    
33. 
    
34. /**
    
35. * * the system call table
    
36. * */
    
37. void **my_table;
    
38. 
    
39. unsigned int orig_cr0;
    
40. 
    
41. /**
    
42. * * the original syscall functions
    
43. * */
    
44. asmlinkage long (*old_read) (unsigned int fd, char __user *buf, size_t count);
    
45. 
    
46. 
    
47. struct idtr {
    
48.     unsigned short limit;
    
49.     unsigned int base;
    
50. } __attribute__ ((packed));
    
51. 
    
52. 
    
53. struct idt {
    
54.     unsigned short off1;
    
55.     unsigned short sel;
    
56.     unsigned char none, flags;
    
57.     unsigned short off2;
    
58. } __attribute__ ((packed));
    
59. 
    
60. 
    
61. 
    
62. /**
    
63. * * clear WP bit of CR0, and return the original value
    
64. * */
    
65. unsigned int clear_and_return_cr0(void)
    
66. {
    
67.     unsigned int cr0 = 0;
    
68.     unsigned int ret;
    
69. 
    
70.     asm volatile ("movl %%cr0, %%eax"
    
71.               : "=a"(cr0)
    
72.               );
    
73.     ret = cr0;
    
74. 
    
75.     /* clear the 20 bit of CR0, a.k.a WP bit */
    
76.     cr0 &= 0xfffeffff;
    
77. 
    
78.     asm volatile ("movl %%eax, %%cr0"
    
79.               :
    
80.               : "a"(cr0)
    
81.               );
    
82.     return ret;
    
83. }
    
84. 
    
85. /** set CR0 with new value
    
86. * *
    
87. * * @val : new value to set in cr0
    
88. * */
    
89. void setback_cr0(unsigned int val)
    
90. {
    
91.     asm volatile ("movl %%eax, %%cr0"
    
92.               :
    
93.               : "a"(val)
    
94.               );
    
95. }
    
96. 
    
97. 
    
98. /**
    
99. * * Return the first appearence of NEEDLE in HAYSTACK.  
    
100. * * */
     
101. static void *memmem(const void *haystack, size_t haystack_len,
     
102.             const void *needle, size_t needle_len)
     
103. {/*{{{*/
     
104.     const char *begin;
     
105.     const char *const last_possible
     
106.         = (const char *) haystack + haystack_len - needle_len;
     
107. 
     
108.     if (needle_len == 0)
     
109.         /* The first occurrence of the empty string is deemed to occur at
     
110. *            the beginning of the string.  */
     
111.         return (void *) haystack;
     
112. 
     
113.     /* Sanity check, otherwise the loop might search through the whole
     
114. *        memory.  */
     
115.     if (__builtin_expect(haystack_len < needle_len, 0))
     
116.         return NULL;
     
117. 
     
118.     for (begin = (const char *) haystack; begin <= last_possible;
     
119.          ++begin)
     
120.         if (begin[0] == ((const char *) needle)[0]
     
121.             && !memcmp((const void *) &begin[1],
     
122.                    (const void *) ((const char *) needle + 1),
     
123.                    needle_len - 1))
     
124.             return (void *) begin;
     
125. 
     
126.     return NULL;
     
127. }/*}}}*/
     
128. 
     
129. 
     
130. /**
     
131. * * Find the location of sys_call_table
     
132. * */
     
133. static unsigned long get_sys_call_table(void)
     
134. {/*{{{*/
     
135. /* we'll read first 100 bytes of int $0x80 */
     
136. #define OFFSET_SYSCALL 100        
     
137. 
     
138.     struct idtr idtr;
     
139.     struct idt idt;
     
140.     unsigned sys_call_off;
     
141.     unsigned retval;
     
142.     char sc_asm[OFFSET_SYSCALL], *p;
     
143. 
     
144.     /* well, let's read IDTR */
     
145.     asm("sidt %0":"=m"(idtr)
     
146.              :
     
147.              :"memory" );
     
148. 
     
149.     dbgprint("idtr base at 0x%X\n", (unsigned int)idtr.base);
     
150. 
     
151.     /* Read in IDT for vector 0x80 (syscall) */
     
152.     memcpy(&idt, (char *) idtr.base + 8 * 0x80, sizeof(idt));
     
153. 
     
154.     sys_call_off = (idt.off2 << 16) | idt.off1;
     
155. 
     
156.     dbgprint("idt80: flags=%X sel=%X off=%X\n",
     
157.                  (unsigned) idt.flags, (unsigned) idt.sel, sys_call_off);
     
158. 
     
159.     /* we have syscall routine address now, look for syscall table
     
160. *        dispatch (indirect call) */
     
161.     memcpy(sc_asm, (void *)sys_call_off, OFFSET_SYSCALL);
     
162. 
     
163.     /**
     
164. *      * Search opcode of `call sys_call_table(,eax,4)'
     
165. *           */
     
166.     p = (char *) memmem(sc_asm, OFFSET_SYSCALL, "\xff\x14\x85", 3);
     
167.     if (p == NULL)
     
168.         return 0;
     
169. 
     
170.     retval = *(unsigned *) (p + 3);
     
171.     if (p) {
     
172.         dbgprint("sys_call_table at 0x%x, call dispatch at 0x%x\n",
     
173.              retval, (unsigned int) p);
     
174.     }
     
175.     return retval;
     
176. #undef OFFSET_SYSCALL
     
177. }/*}}}*/
     
178. 
     
179. asmlinkage long new_read(unsigned int fd, char __user *buf, size_t count)
     
180. {
     
181.         long ret;
     
182.         struct file *file;
     
183.         ret = old_read(fd, buf, count);
     
184.         /*0 represent EOF
     
185.         * We just collect a 'read' when finished
     
186.         */
     
187.         if(ret == 0){
     
188.                 file = fget(fd);
     
189.                 if(file){
     
190.                         fput(file);
     
191.                 }
     
192.         }
     
193.         return ret;
     
194. }
     
195. 
     
196. static int intercept_init(void)
     
197. {
     
198.     my_table = (void **)get_sys_call_table();
     
199.     if (my_table == NULL)
     
200.         return -1;
     
201. 
     
202.     dbgprint("sys call table address %p\n", (void *) my_table);
     
203. 
     
204. #define REPLACE(x) old_##x = my_table[__NR_##x];\
     
205.     my_table[__NR_##x] = new_##x
     
206. 
     
207.    
     
208.         REPLACE(read);
     
209. 
     
210. #undef REPLACE
     
211.     return 0;
     
212. }
     
213. 
     
214. 
     
215. static int __init this_init(void)
     
216. {
     
217.     int ret;
     
218.     printk("syscall intercept: Hi, poor linux!\n");
     
219. 
     
220.     orig_cr0 = clear_and_return_cr0();   
     
221.     ret = intercept_init();
     
222.     setback_cr0(orig_cr0);
     
223. 
     
224.     return ret;
     
225. }
     
226. 
     
227. static void __exit this_fini(void)
     
228. {
     
229.     printk("syscall intercept: bye, poor linux!\n");
     
230. 
     
231. #define RESTORE(x) my_table[__NR_##x] = old_##x
     
232. 
     
233.     orig_cr0 = clear_and_return_cr0();   
     
234.         RESTORE(read);
     
235.     setback_cr0(orig_cr0);
     
236. 
     
237. #undef RESTORE
     
238. }
     
239. 
     
240. module_init(this_init);
     
241. module_exit(this_fini);
     

复制代码

Godbach

回复 95# wugj03

你是要把所有系统调用统统尝试一遍么

   

wugj03

回复 96# Godbach

倒没有==、，其他几个系统调用就write，open, close，就是想观察这些系统调用，收集一些信息，就在read上卡住了

发了帖子，沉了    http://bbs.chinaunix.net/thread-4166052-1-1.html

有空帮我看看


   

Godbach

回复 97# wugj03

因为 read 无处不在，调用的最为频繁，所以坑也比较多。


   

wugj03

回复 98# Godbach


    是呀，anyway, thanks

yzh07137

我在ubuntu12.04.5(内核是3.13.0.20-32-generic)上试验了，结果编译报错了，那个Makefile不能成功执行，提示下面这个错误：
error:'struct pt_regs' has no member named 'ebx';
error:'struct pt_regs' has no member named 'ecx';
error:'struct pt_regs' has no member named 'edx';
error:'TIF_IRET' undeclared(first used in this function);
这是error，还有一些警告，请问是什么原因啊，是因为内核版本的问题吗？