在linux中所有的syscall都是调用int 0x80, int 0x80的中断服务程序为system_call(arch/x86/kernel/traps_32.c:set_system_gate(SYSCALL_VECTOR,&system_call). system_call (arch/x86/entry_32.S)最终call *sys_call_table(,%eax,4)来完成一个syscall调用.
即 int 0x80 -> system_call -> sys_call_table, 这样我们只要首先获取int 0x80的中断服务地址system_call地址, 然后在system_call代码中直接搜索call指令即可找到sys_call_table地址了!
另一种方法就是直接修改
通过cat /boot/System.map-`uname -r` |grep sys_call_table 查看当前sys_call_table地址,并与通过以上方法取得的地址做比较!
内核版本: ubuntu 2.6.24-19-server
/*
* Standard in kernel modules
*/
#include <linux/kernel.h> /* We're doing kernel work */
#include <linux/module.h> /* Specifically, a module, */
#include <linux/moduleparam.h> /* which will have params */
#include <linux/unistd.h> /* The list of system calls */
/*
* For the current (process) structure, we need
* this to know who the current user is.
*/
#include <linux/sched.h>
#include <asm/uaccess.h>
unsigned long *sys_call_table = 0;
//EXPORT_SYMBOL ( sys_call_table );
struct {
unsigned short limit;
unsigned int base;
} __attribute__ ( ( packed ) ) idtr;
struct {
unsigned short offset_low;
unsigned short segment_select;
unsigned char reserved, flags;
unsigned short offset_high;
} __attribute__ ( ( packed ) ) * idt;
unsigned long* find_sys_call_table(void)
{
unsigned long system_call = 0; // x80中断处理程序system_call 地址
char *call_hex = "\xff\x14\x85"; // call 指令
char *code_ptr = NULL;
