- 论坛徽章:
- 0
|
void set_idt_handler (void *system_call)
{
unsigned char *p;
unsigned long *p2;
p = ( unsigned char *) system_call;
while (!( (*p == 0x0f) && (*(p+1) == 0x83) ))
p++;
p -= 5;
*p++ = 0x68;
p2 = (unsigned long *) p;
*p2++ = (unsigned long) ( (void *) new_idt);
p = (unsigned char *) p2;
*p = 0xc3;
while (!( (*p == 0x0f) && (*(p+1) == 0x82)))
p++;
p -= 5;
*p++ = 0x68;
p2 = (unsigned long *) p;
*p2++ = (unsigned long) ((void *) new_idt);
p = (unsigned char *) p2;
*p = 0xc3;
}
这样system_call的就被修改成了
ENTRY(system_call)
pushl %eax # save orig_eax
SAVE_ALL
GET_THREAD_INFO(%ebp)
testw $(_TIF_SYSCALL_EMU | _TIF_SYSCALL_TRACE | _TIF_SECCOMP | _TIF_SYSCALL_AUDIT), TI_flags (%ebp)
jnz syscall_trace_entry
push new_idt
ret
syscall_call:
call *sys_call_table(, %eax, 4)
movl %eax, PT_EAX (%esp) # store the return value
syscall_exit:
...
下面是new_idt函数内容:
void new_idt(void)
{
ASMIDType
(
"cmp %0, %%eax \n"
"jae syscallmala \n"
"jmp hook \n"
"syscallmala: \n"
"jmp dire_exit \n"
: : "i" (NR_syscalls)
);
}
有上述代码的内核模块,在2.6.25下一加载就oops,但在之前的版本都没问题,是2.6.25做了什么修改或者限制吗?一直找不到原因。
郁闷撒 |
|