linux 鐃塾ワ申鐃緒申鐃銃ムコ鐃緒申鐃緒申鐃春ッワ申鐃緒申鐃緒申
鐃叔近、鐃夙わ申鐃暑ク鐃緒申鐃緒申鐃緒申鐃宿ワ申鐃緒申鐃緒申鐃淑デバワ申鐃緒申鐃緒申鐃緒申鐃縦￥申鐃緒申竜鐃銃逸申鐃緒申鐃緒申砲覆蝓�鐃緒申鐃緒申動鐃緒申砲弔鐃緒申堂鐃緒申呂鐃緒申討澆襪鰹申箸砲鐃緒申泙鐃緒申鐃緒申鐃�
鐃竣ワ申鐃緒申鐃緒申鐃緒申妊丱奪鐃緒申鐃緒申鐃緒申鐃緒申鐃熟わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃宿わ申淵鐃緒申鐃緒申謄爛鰹申鐃緒申襪�鐃銃ばれ、鐃宿のよう鐃淑逸申鐃緒申鐃緒申鐃熟わ申鐃緒申討鐃緒申襪�鐃緒申調鐃駿るこ鐃夙わ申鐃叔わ申鐃緒申 strace 鐃緒申鐃緒申鐃緒申有鐃術でわ申鐃緒申
鐃緒申鐃緒申鐃緒申鐃緒申strace 鐃叔わ申 ioctl 鐃緒申鐃熟わ申鐃緒申鐃淑ｏ申鐃緒申淵如鐃緒申鐃緒申鐃渋わ申鐃宿緒申鐃緒申鐃緒申襪鰹申箸呂任鐃緒申覆鐃緒申鐃緒申瓠�鐃緒申鐃緒申鐃銃ムコ鐃緒申鐃緒申鐃春ッワ申鐃緒申鐃銃逸申鐃緒申鐃緒申表鐃緒申鐃緒申鐃緒申箸鐃緒申鐃緒申鐃緒申覆鐃緒申襪鰹申箸砲鐃緒申泙鐃緒申鐃緒申鐃�
鐃緒申鐃緒申鐃緒申鐃緒申鐃� linux 鐃叔ワ申鐃緒申鐃銃ムコ鐃緒申鐃緒申鐃春ッワ申鐃緒申鐃緒申鐃緒申法鐃祝つわ申鐃緒申調鐃駿て醐申鐃緒申鐃夙わ申鐃緒申鐃緒申鐃春鰹申鐃夙わ申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申法鐃緒申有鐃暑こ鐃夙わ申鐃塾わ申泙鐃緒申鐃緒申里如鐃緒申遒件申討澆鐃緒申鐃祝￥申鐃緒申鐃縦わ申鐃述介しわ申鐃緒申鐃夙思わ申鐃殉わ申鐃緒申
鐃緒申)鐃緒申鐃緒申亮存鐃緒申忙鐃緒申僂鐃緒申鐃� linux kernel 鐃塾バ￥申鐃緒申鐃緒申鐃緒申 2.6.25.11 鐃叔わ申鐃緒申鐃循なわ申弌鐃緒申鐃緒申鐃緒申任呂鐃緒申亮存鐃緒申未鐃祝はなわ申覆鐃緒申鐃順が鐃緒申鐃緒申泙鐃緒申鐃�
LD_PRELOAD 鐃緒申箸辰謄侫奪鐃緒申鐃緒申鐃�
鐃殉わ申鐃緒申鐃瞬種申端鐃緒申鐃潤そ鐃緒申鐃淑のわ申 LD_PRELOAD 鐃緒申鐃緒申僂鐃緒申鐃� hook 鐃緒申鐃緒申鐃緒申法鐃叔わ申鐃緒申
鐃緒申鐃緒申: 鐃緒申鐃塾ワ申鐃緒申鐃� Unoh Labs: LD_PRELOAD鐃緒申箸辰鐃叔わ申佞隆愎鐃緒申討喀个鐃緒申縫侫奪鐃緒申鐃緒申討澆鐃�
鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申笋�鐃緒申鐃熟わ申鐃緒申鐃緒申鐃竣ワ申鐃緒申鐃緒申鐃緒申 libc 鐃薯スワ申鐃銃ワ申鐃獣ワ申鐃緒申鵐�わ申鐃緒申鐃緒申鐃� strip 鐃緒申鐃銃わ申鐃緒申箸鐃緒申鐃緒申丱鐃緒申淵鐃叔わ申鐃緒申鐃塾で￥申鐃緒申念鐃淑わ申鐃初こ鐃緒申鐃緒申法鐃叔わ申 hook 鐃緒申鐃暑こ鐃夙わ申鐃緒申鐃緒申泙鐃緒申鐃叔わ申鐃緒申鐃緒申
kernel module 鐃叔フッワ申鐃緒申鐃緒申
鐃緒申鐃祝￥申kernel module 鐃緒申鐃緒申僂鐃緒申鐃緒申侫奪鐃緒申鐃縦�鐃緒し鐃銃みまわ申鐃緒申鐃緒申
鐃緒申鐃緒申: Linux Kernel Hacking
鐃緒申鐃緒申鐃緒申鮖温佑砲鐃緒申動焚鐃緒申里茲�鐃緒申 open 鐃緒申侫奪鐃緒申鐃緒申鐃� kernel 鐃盾ジ鐃遵ー鐃緒申 鐃緒申颪い討澆鐃緒申里任鐃緒申鐃緒申鐃緒申鐃緒申泙鐃緒申鐃緒申鐃術ワ申鐃緒申任鐃緒申泙鐃緒申鐃�
#include <linux/init.h>
#include <linux/module.h>
#include <linux/syscalls.h>
#include <linux/utsname.h>
MODULE_LICENSE("GPL");
asmlinkage int (*orig_open)(const char *pathname, int flags);
asmlinkage static int hook_open(const char *pathname, int flags)
{
printk(KERN_INFO "hook_open(\"%s\", %d)\n", pathname, flags);
return orig_open(pathname, flags);
}
static int hook_init(void){
printk(KERN_INFO "hook_init\n");
orig_open = sys_call_table[__NR_open];
sys_call_table[__NR_open] = hook_open;
return 0;
}
static void hook_exit(void){
printk(KERN_INFO "hook_exit\n");
sys_call_table[__NR_open] = orig_open;
}
module_init(hook_init);
module_exit(hook_exit);
鐃宿わ申鐃緒申鐃遵記鐃緒申鐃緒申法鐃緒申 hook 鐃出わ申鐃緒申里鐃� kernel 2.4 鐃塾削申鐃殉でで￥申 2.6 鐃緒申鐃緒申魯鐃緒申鐃緒申鐃緒申謄鐃緒申鐃緒申鐃緒申由鐃緒申鐃緒申 sys_call_table 鐃緒申鐃緒申椒襪� export 鐃緒申鐃緒申覆鐃緒申覆辰鐃緒申茲�鐃叔わ申鐃緒申
kernel 鐃術刻申鐃緒申鐃銃のフッワ申
鐃宿わ申鐃祝わ申 2.6.x 鐃叔わ申 hook 鐃緒申鐃緒申鐃緒申法鐃緒申無鐃緒申鐃塾わ申鐃淑￥申鐃緒申調鐃駿てみわ申醗焚鐃緒申鐃緒申鐃祝￥申鮓�つわ申鐃殉わ申鐃緒申鐃緒申
Re: using sys_mknod in init_module鐃潤ー鐃緒申鐃緒申鐃緒申討伴禊鰹申曚覆鐃殉わ申鐃緒申鐃緒申x86 32bit 鐃緒申鐃緒申鐃緒申鐃銃ワ申鐃緒申鐃緒申両鐃緒申 arch/x86/kernel/i386_ksyms_32.c 鐃舜以駕申鐃緒申2鐃峻わ申鐃宿居申鐃緒申鐃緒申
extern void* sys_call_table[]; EXPORT_SYMBOL(sys_call_table);
kernel module 鐃祝以駕申鐃緒申鐃緒申鐃緒申鐃緒申謬鐃緒申鐃緒申襪鰹申箸鐃縮居申鐃緒申咼鐃宿わ申鐃緒申 insmod 鐃緒申鐃緒申鐃処う鐃祝なわ申泙鐃緒申鐃緒申鐃�
extern void *sys_call_table[];
鐃緒申速 insmod 鐃緒申鐃緒申
# dmesg -c
# cat /etc/passwd > /dev/null
# dmesg
hook_open("/dev/null", 33345)
hook_open("/etc/ld.so.cache", 0)
hook_open("/lib/libc.so.6", 0)
hook_open("/etc/passwd", 32768)
hook_open("/etc/ld.so.cache", 0)
hook_open("/lib/libc.so.6", 0)
鐃出っわ申鐃緒申 hook 鐃緒申鐃暑こ鐃夙わ申鐃緒申鐃緒申泙鐃緒申鐃緒申鐃�
kernel 鐃緒申鐃術刻申鐃緒申鐃淑わ申鐃叔フッワ申鐃緒申鐃緒申
rootkit 鐃塾器申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申鐃緒申里任鐃緒申鐃� kernel 鐃緒申鐃術刻申鐃緒申鐃淑わ申鐃緒申鐃� hook 鐃緒申鐃緒申覆鐃緒申箸鐃緒申鐃緒申里鐃緒申鐃緒申僂覆里如鐃�kernel 鐃緒申鐃術刻申鐃緒申辰鐃緒申鐃緒申鐃�kernel module 鐃塾みわ申 hook 鐃出わ申鐃暑か鐃宿わ申鐃緒申調鐃駿てみまわ申鐃緒申鐃緒申
- sys_call_table 鐃緒申蓮鐃緒申疋鐃緒申鐃緒申妊鐃緒申鵐阿鐃緒申鐃�
- sys_call_table 鐃緒申探鐃緒申鐃緒申鐃緒申
sys_call_table 鐃緒申 export 鐃緒申鐃緒申覆鐃緒申箸皀�鐃宿レス鐃緒申予鐃緒申調鐃駿てわ申鐃緒申鐃銃ハ￥申鐃宿ワ申鐃緒申鐃宿わ申鐃銃わ申鐃出よさ鐃緒申鐃緒申鐃叔わ申鐃緒申未鐃緒申鐃縮わ申 vmlinux 鐃緒申鐃縦ってわ申鐃緒申鐃� sys_call_table 鐃塾ワ申鐃宿レス鐃緒申鐃獣縁申鐃縦器申戮襪鰹申箸鐃緒申鐃緒申鐃殉わ申鐃緒申(/proc/kallsyms 鐃叔わ申調鐃駿わ申鐃緒申茲�鐃叔わ申)
nm vmlinux|grep sys_call_table c02bc838 R sys_call_table
鐃緒申鐃緒申鐃緒申呂鐃緒申鐃緒申咾任呂鐃緒申鐃緒申鐃祝￥申能鐃淑�鐃緒申鐃盾し鐃緒申泙鐃緒申鐃粛￥申
鐃熟￥申鐃宿ワ申鐃緒申鐃宿わ申鐃緒申里呂鐃緒申鐃獣となわ申鐃夙わ申鐃緒申鐃緒申鐃緒申 module 鐃緒申 init 鐃緒申鐃緒申 sys_call_table 鐃緒申探鐃緒申鐃緒申鐃緒申箸鐃緒申鐃緒申蠅�鐃緒申鐃緒申鐃粛でわ申鐃緒申
Finding the Linux System Call table in 2.6 series kernels | Subversity
鐃緒申鐃緒申鐃緒申鐃� sys_call_table 鐃緒申探鐃緒申鐃緒申鐃暑コ鐃緒申鐃宿わ申鐃述介さわ申討鐃緒申鐃塾でわ申鐃緒申鐃緒申unlock_kernel 鐃緒申鐃緒申椒襪�鐃緒申鐃緒申鐃緒申鐃緒申覆鐃緒申鐃緒申鐃俊ワ申匹任鐃緒申泙鐃緒申鐃叔わ申鐃緒申鐃緒申
unlock_kernel 鐃緒申鐃緒申鐃緒申法鐃緒申鐃緒申茲� sys_call_table 鐃緒申鐃緒申鐃緒申鐃祝わ申鐃暑シ鐃緒申椒鐃緒申眺鐃緒申討鐃緒申鐃緒申箸鐃緒申鐃� strstr 鐃夙わ申鐃緒申鐃緒申鐃緒申椒襪�鐃緒申鐃順う鐃緒申鐃宿わ申鐃緒申鐃緒申鐃淑ので￥申鐃緒申鐃緒申鐃緒申鐃術わ申鐃緒申 sys_call_table 鐃緒申探鐃緒申鐃緒申鐃緒申鐃宿わ申匆陲靴泙鐃緒申鐃�
unsigned long **find_sys_call_table(void)
{
unsigned long **sctable;
unsigned long ptr;
sctable = NULL;
for (ptr = (unsigned long)&strstr;
ptr < (unsigned long)&boot_cpu_data;
ptr += sizeof(void *))
{
unsigned long *p;
p = (unsigned long *)ptr;
if (p[__NR_close] == (unsigned long) sys_close)
{
sctable = (unsigned long **)p;
return &sctable[0];
}
}
return NULL;
}
鐃殉とわ申
鐃緒申鐃緒申蓮鐃緒申鐃緒申鐃緒申鐃熟のわ申鐃緒申砲箸砲鐃緒申鐃緒申侫奪鐃緒申鐃緒申鐃緒申鐃緒申辰鐃緒申里任鐃巡強鐃緒申鐃緒申鐃緒申法鐃祝なってわ申鐃殉わ申鐃殉わ申鐃緒申鐃緒申鐃緒申鐃緒申辰反鐃緒申鐃緒申鐃緒申鐃緒申鐃祝￥申妊鐃緒申鐃緒申謄爛鰹申鐃緒申鐃緒申侫奪鐃緒申鐃緒申鐃緒申鐃祝￥申鐃緒申鐃緒申蠅緒申鐃緒申任鐃緒申鐃�
鐃殉わ申鐃緒申鐃緒申鐃藷いわ申鐃緒申鐃緒申鐃緒申鐃緒申法鐃緒申調鐃駿てみてワ申鐃緒申鐃銃ムコ鐃緒申鐃緒申離侫奪鐃緒申剖鐃縮ｏ申鐃緒申个討鐃緒申鐃緒申里如鐃緒申泙鐃緒申未鐃緒申鐃祝￥申鐃緒申里辰鐃緒申鐃緒申砲肋匆陲靴討澆鐃緒申鐃緒申隼廚鐃緒申泙鐃緒申鐃�
--hamano
鐃夙ワ申奪鐃緒申丱奪鐃�URL
鐃緒申鐃塾居申鐃緒申鐃舜のワ申鐃緒申鐃緒申
鐃緒申鐃塾ペ￥申鐃緒申鐃薯参考にわ申鐃銃￥申鐃緒申分鐃緒申Linux鐃叔のワ申鐃緒申鐃銃ムコ鐃緒申鐃緒申侫奪鐃緒申鐃庶し鐃銃みまわ申鐃緒申鐃緒申
鐃庶し鐃緒申鐃緒申念鐃緒申屬里鐃緒申鐃緒申鐃緒申鐃緒申鐃熟￥申ptrace鐃叔わ申鐃緒申
鐃緒申鐃緒申鐃粛ワ申皀醐申紂種申鐃緒申箸鐃緒申鐃祝￥申發わ申鐃緒申里任鐃緒申鐃緒申鐃�2.6.25鐃淑降では￥申sys_call_table鐃緒申
鐃所ー鐃宿ワ申鐃緒申蝓種申砲覆辰討鐃緒申蝓�鐃春ッワ申鐃緒申鐃暑た鐃緒申砲魯鐃緒申鐃緒申優鐃塾再刻申鐃循わ申必鐃竣となわ申泙鐃緒申鐃�
鐃粛わ申鐃庶し鐃緒申鐃緒申法鐃熟￥申鐃春ッワ申鐃緒申鐃緒申鐃緒申鐃竣ワ申鐃緒申鐃緒申鐃緒申謄廛鐃緒申鐃緒申鐃緒申箸鐃緒申撞鐃銃逸申鐃緒申鐃竣ワ申鐃緒申鐃緒申鐃緒申
鐃書きまわ申鐃緒申鐃緒申鐃緒申鐃緒申如鐃�PTRACE_SYSCALL鐃緒申箸辰謄鐃緒申鐃緒申謄爛鰹申鐃緒申鐃緒申鐃緒申鐃緒申直鐃緒申鐃緒申
鐃述プワ申鐃緒申鐃緒申鐃薯ストップわ申鐃殉わ申鐃緒申
鐃述プワ申鐃緒申鐃緒申鐃緒申鐃緒申鐃術レジ鐃緒申鐃緒申鐃祝ワ申鐃緒申鐃銃ムコ鐃緒申鐃緒申両鐃緒申鐃�(鐃緒申鐃緒申鐃夙わ申鐃緒申鐃緒申鐃銃ムコ鐃緒申鐃緒申鐃縮常申鐃�)
鐃緒申鐃緒申納鐃緒申鐃緒申討鐃緒申鐃塾で￥申鐃緒申鐃緒申鐃緒申PTRACE_POKEDATA鐃緒申箸辰峠颪�器申鐃緒申鐃銃わ申鐃緒申
鐃緒申鐃緒申鐃銃ムコ鐃緒申鐃緒申鮃イ鐃緒申覆茲�鐃祝書き器申鐃緒申鐃緒申泙鐃緒申鐃�
鐃緒申鐃緒申鐃緒申法鐃緒申鐃夙￥申鐃緒申鐃緒申鐃粛ワ申虜胴鐃緒申曚鐃�sys_call_table鐃塾ワ申鐃宿レス鐃緒申鐃緒か鐃緒申覆鐃緒申討鐃�
鐃春ッワ申鐃緒申鐃暑こ鐃夙わ申鐃叔わ申鐃緒申里如鐃緒申鐃緒申鐃緒申鐃叔わ申鐃緒申
