Linux下实现劫持系统调用的总结

safeqq2

如果要劫持   netif_rx   和  dev_queue_xmit   函数呢     麻烦高手们给点建议

Godbach

基于什么需求要劫持这两个函数

tanyayun

怎么我运行会出现下面的错误呀？
[root@localhost xitongjiechi]# make -C /usr/src/linux M=`pwd` modules
make: Entering directory `/usr/src/linux-2.6.33.4'
  CC [M]  /usr/src/linux/xitongjiechi/hack_open.o
/usr/src/linux/xitongjiechi/hack_open.c:1: 错误：expected identifier or ‘(’ before numeric constant
/usr/src/linux/xitongjiechi/hack_open.c:1: 错误：程序中有游离的 ‘#’
/usr/src/linux/xitongjiechi/hack_open.c:2: 错误：程序中有游离的 ‘#’
/usr/src/linux/xitongjiechi/hack_open.c:3: 错误：程序中有游离的 ‘#’
/usr/src/linux/xitongjiechi/hack_open.c:4: 错误：程序中有游离的 ‘#’
/usr/src/linux/xitongjiechi/hack_open.c:5: 错误：程序中有游离的 ‘#’
/usr/src/linux/xitongjiechi/hack_open.c:6: 错误：程序中有游离的 ‘#’
/usr/src/linux/xitongjiechi/hack_open.c:7: 错误：程序中有游离的 ‘#’
/usr/src/linux/xitongjiechi/hack_open.c:8: 错误：程序中有游离的 ‘#’
/usr/src/linux/xitongjiechi/hack_open.c:9: 错误：程序中有游离的 ‘#’
/usr/src/linux/xitongjiechi/hack_open.c:10: 错误：程序中有游离的 ‘#’
/usr/src/linux/xitongjiechi/hack_open.c:11: 错误：程序中有游离的 ‘#’
/usr/src/linux/xitongjiechi/hack_open.c:12: 错误：程序中有游离的 ‘#’
/usr/src/linux/xitongjiechi/hack_open.c:13: 错误：程序中有游离的 ‘#’
/usr/src/linux/xitongjiechi/hack_open.c:14: 错误：程序中有游离的 ‘#’
/usr/src/linux/xitongjiechi/hack_open.c:15: 错误：程序中有游离的 ‘#’
/usr/src/linux/xitongjiechi/hack_open.c:19: 错误：expected identifier or ‘(’ before numeric constant
/usr/src/linux/xitongjiechi/hack_open.c:20: 错误：expected identifier or ‘(’ before numeric constant
/usr/src/linux/xitongjiechi/hack_open.c:21: 错误：expected identifier or ‘(’ before numeric constant
/usr/src/linux/xitongjiechi/hack_open.c:27: 错误：程序中有游离的 ‘#’
/usr/src/linux/xitongjiechi/hack_open.c:30: 错误：程序中有游离的 ‘#’
/usr/src/linux/xitongjiechi/hack_open.c:31: 错误：程序中有游离的 ‘#’
/usr/src/linux/xitongjiechi/hack_open.c:31: 错误：程序中有游离的 ‘##’
/usr/src/linux/xitongjiechi/hack_open.c:33: 错误：expected identifier or ‘(’ before numeric constant
/usr/src/linux/xitongjiechi/hack_open.c:33: 错误：程序中有游离的 ‘#’
/usr/src/linux/xitongjiechi/hack_open.c:34: 错误：程序中有游离的 ‘#’
/usr/src/linux/xitongjiechi/hack_open.c:34: 错误：expected identifier or ‘(’ before ‘while’
/usr/src/linux/xitongjiechi/hack_open.c:35: 错误：expected identifier or ‘(’ before numeric constant
/usr/src/linux/xitongjiechi/hack_open.c:35: 错误：程序中有游离的 ‘#’
/usr/src/linux/xitongjiechi/hack_open.c:45: 错误：expected identifier or ‘(’ before numeric constant
/usr/src/linux/xitongjiechi/hack_open.c:48: 错误：expected identifier or ‘(’ before numeric constant
/usr/src/linux/xitongjiechi/hack_open.c:54: 错误：expected identifier or ‘(’ before numeric constant
/usr/src/linux/xitongjiechi/hack_open.c:55: 错误：expected identifier or ‘(’ before numeric constant
/usr/src/linux/xitongjiechi/hack_open.c:66: 错误：expected identifier or ‘(’ before numeric constant
/usr/src/linux/xitongjiechi/hack_open.c:70: 错误：expected identifier or ‘(’ before numeric constant
/usr/src/linux/xitongjiechi/hack_open.c:78: 警告：空声明
/usr/src/linux/xitongjiechi/hack_open.c:79: 错误：expected identifier or ‘(’ before numeric constant
/usr/src/linux/xitongjiechi/hack_open.c:89: 警告：空声明
/usr/src/linux/xitongjiechi/hack_open.c:90: 错误：expected identifier or ‘(’ before numeric constant
/usr/src/linux/xitongjiechi/hack_open.c:95: 错误：程序中有游离的 ‘#’
/usr/src/linux/xitongjiechi/hack_open.c:102: 错误：expected identifier or ‘(’ before numeric constant
/usr/src/linux/xitongjiechi/hack_open.c:107: 错误：程序中有游离的 ‘#’
/usr/src/linux/xitongjiechi/hack_open.c:109: 错误：程序中有游离的 ‘#’
/usr/src/linux/xitongjiechi/hack_open.c:138: 错误：expected identifier or ‘(’ before numeric constant
/usr/src/linux/xitongjiechi/hack_open.c:140: 错误：程序中有游离的 ‘#’
/usr/src/linux/xitongjiechi/hack_open.c:168: 错误：expected identifier or ‘(’ before numeric constant
/usr/src/linux/xitongjiechi/hack_open.c:181: 错误：expected identifier or ‘(’ before numeric constant
/usr/src/linux/xitongjiechi/hack_open.c:220: 错误：expected identifier or ‘(’ before numeric constant
/usr/src/linux/xitongjiechi/hack_open.c:231: 错误：程序中有游离的 ‘#’
/usr/src/linux/xitongjiechi/hack_open.c:280: 错误：程序中有游离的 ‘#’
/usr/src/linux/xitongjiechi/hack_open.c:282: 错误：expected identifier or ‘(’ before numeric constant
/usr/src/linux/xitongjiechi/hack_open.c:300: 错误：expected identifier or ‘(’ before numeric constant
/usr/src/linux/xitongjiechi/hack_open.c:337: 错误：expected identifier or ‘(’ before numeric constant
/usr/src/linux/xitongjiechi/hack_open.c:349: 错误：程序中有游离的 ‘#’
/usr/src/linux/xitongjiechi/hack_open.c:349: 错误：程序中有游离的 ‘##’
/usr/src/linux/xitongjiechi/hack_open.c:349: 错误：程序中有游离的 ‘##’
/usr/src/linux/xitongjiechi/hack_open.c:349: 错误：程序中有游离的 ‘##’
/usr/src/linux/xitongjiechi/hack_open.c:349: 错误：程序中有游离的 ‘##’
/usr/src/linux/xitongjiechi/hack_open.c:355: 错误：程序中有游离的 ‘#’
/usr/src/linux/xitongjiechi/hack_open.c:359: 错误：程序中有游离的 ‘#’
/usr/src/linux/xitongjiechi/hack_open.c:362: 错误：程序中有游离的 ‘#’
/usr/src/linux/xitongjiechi/hack_open.c:365: 错误：expected identifier or ‘(’ before numeric constant
/usr/src/linux/xitongjiechi/hack_open.c:398: 错误：expected identifier or ‘(’ before numeric constant
/usr/src/linux/xitongjiechi/hack_open.c:405: 错误：程序中有游离的 ‘#’
/usr/src/linux/xitongjiechi/hack_open.c:405: 错误：程序中有游离的 ‘##’
/usr/src/linux/xitongjiechi/hack_open.c:405: 错误：程序中有游离的 ‘##’
/usr/src/linux/xitongjiechi/hack_open.c:410: 错误：程序中有游离的 ‘#’
/usr/src/linux/xitongjiechi/hack_open.c:413: 错误：程序中有游离的 ‘#’
/usr/src/linux/xitongjiechi/hack_open.c:417: 错误：程序中有游离的 ‘#’
/usr/src/linux/xitongjiechi/hack_open.c:419: 错误：expected identifier or ‘(’ before numeric constant
/usr/src/linux/xitongjiechi/hack_open.c:422: 错误：expected identifier or ‘(’ before numeric constant
make[1]: *** [/usr/src/linux/xitongjiechi/hack_open.o] 错误 1
make: *** [_module_/usr/src/linux/xitongjiechi] 错误 2
make: Leaving directory `/usr/src/linux-2.6.33.4'
[root@localhost xitongjiechi]#

tanyayun

明白了

Godbach

LS 明白神马了

tanyayun

出现了这个问题，怎么改呀？
[root@localhost xitongjiechi]# vim hack_open.c
[root@localhost xitongjiechi]# make -C /usr/src/linux M=`pwd` modules
make: Entering directory `/usr/src/linux-2.6.33.4'
  CC [M]  /usr/src/linux/xitongjiechi/hack_open.o
/usr/src/linux/xitongjiechi/hack_open.c: In function ‘new_execve’:
/usr/src/linux/xitongjiechi/hack_open.c:242: 错误：隐式声明函数 ‘getname’
/usr/src/linux/xitongjiechi/hack_open.c:242: 错误：‘struct pt_regs’ 没有名为 ‘ebx’ 的成员
/usr/src/linux/xitongjiechi/hack_open.c:242: 警告：赋值时将整数赋给指针，未作类型转换
/usr/src/linux/xitongjiechi/hack_open.c:248: 错误：‘struct pt_regs’ 没有名为 ‘ecx’ 的成员
/usr/src/linux/xitongjiechi/hack_open.c:249: 错误：‘struct pt_regs’ 没有名为 ‘edx’ 的成员
/usr/src/linux/xitongjiechi/hack_open.c:257: 错误：隐式声明函数 ‘putname’
make[1]: *** [/usr/src/linux/xitongjiechi/hack_open.o] 错误 1
make: *** [_module_/usr/src/linux/xitongjiechi] 错误 2
make: Leaving directory `/usr/src/linux-2.6.33.4'

Godbach

提示很明显啊，那个数据结构是内核的吗

tanyayun

回复 77# Godbach

是内核的吧
   61楼说， 自己写个struct加进去把原来的换调
可是，我不知道怎么写呀

Godbach

不同的内核版本，可能数据结构会发生变化，你要比较一下

tanyayun

回复 79# Godbach


    我怎么找pt_regs定义的位置呢？我在网上找的，说是在include/asm-i386/Ptrace.h 中.可是，我这没有asm-i386，只有asm-generic，有什么命令可以查找我电脑上pt_regs定义的位置吗？谢谢