another way to get sys_call_table for kernel 2.6

mingyanguo

sys_call_table in Linux kernel 2.6 is not exported. here is a way to find it out.

#include linux/kernel.h>
#include linux/module.h>
#include linux/init.h>
#include linux/config.h>
#include linux/thread_info.h>
#include linux/ptrace.h>
MODULE_LICENSE("Dual BSD/GPL");
struct    dummyidt {
    unsigned short    idtdata[4];
};
static    void *arch_get_syscall_entry(void)
{
    struct dummyidt *idt;
    char    idtrbuf[8];
    void    *addr;
    __asm__ volatile ("sidt %0;"
            :"=m"(idtrbuf[0]));
    idt = (void*)(*(unsigned long*)(idtrbuf + 2));
    printk("idt@:%p\n", idt);
    addr = (void*)(((unsigned int )idt[0x80].idtdata[0]) |
        (((unsigned int)idt[0x80].idtdata[3])  16));
    printk("syscall entry@: %p\n", addr);
    return    addr;
}
static    int addr_seems_ok(void *addr)
{
    static    void    *addrbegin = NULL;
    if (addrbegin == NULL){
        addrbegin = arch_get_syscall_entry();
    }
    if ((addr > addrbegin) && (addr  addrbegin + 2000))
        return    1;
    return    0;
}
static    void* get_tbl_addr(unsigned long stacksz)
{
    char    callinstr[] = {0xff, 0x14, 0x85, 0};
    void    *stacktop;
    void    *syscalltable = NULL;
    char    *mem;
    stacktop = (void*)current_thread_info() + stacksz;
    stacktop -= sizeof(struct pt_regs) + sizeof(void*);
    mem = *(char**)stacktop;
    if (!addr_seems_ok(mem))
        return    syscalltable;
    mem -= 7;
    /*
     * @mem points to the address of
     * `call sys_call_table(, %eax, 4)`, now.
     */
    if (strcmp(mem, callinstr) == 0){
        mem += 3;
        syscalltable = (void*)*(unsigned long *)mem;
    }
    return    syscalltable;
}
static    int getsyscall_init(void)
{
    void *tbl;
    unsigned long stacksz;
    for (stacksz = 1  PAGE_SHIFT; stacksz  (1  14); stacksz = 1){
        tbl = get_tbl_addr(stacksz);
        if (tbl != NULL){
            goto    findtbl;
        }
    }
    printk("syscall table not found\n");
    return    0;
findtbl:
    printk("syscall table @ %p, stacksize=%lu\n",
            tbl, stacksz);
    return    0;
}
static    void getsyscall_exit(void)
{
}
module_init(getsyscall_init);
module_exit(getsyscall_exit);

I was laughing at the Windows Vxers' brute force search for PE header, when I was a college student, and what I am searching for now is even not a string...


本文来自ChinaUnix博客，如果查看原文请点：http://blog.chinaunix.net/u/10543/showart_247586.html