Entering the kernel without a driver and getting interrupt information from APIC
2012-07-08 22:45
232 查看
Introduction
Although making user-mode application enter the kernel is definitely an exciting exercise, it is far from being something unheard of. It has been first done by Matt Pietrek (he did it on Windows 95 many years ago). His technique was later adjusted to WindowsNT by Prasad Dabak, Sandeep Phadke and Milind Borate. In order to enter the kernel right from an application, one has to set up call gate descriptor in Global Descriptor Table (GDT), so that an application can enter the kernel via the call gate. However,
once user-mode code is not allowed to access GDT, above mentioned authors used a kernel-mode driver in order to set up call gate descriptor. Certainly, quite logical question arises - what is the point of entering the kernel without a driver if you still need
a driver in order to make it work??? After all, it just defeats the purpose, don't you think?
This article describes how user-mode application can access the kernel address space and set up call gate descriptor in GDT without using a driver. It explains how virtual-to-physical address translation works on 32-bit processors, and describes how the user-mode
application can find out which physical address some given virtual address represents. "Methodology" of solving this task is 100% of my own design - you will be unable to find anything similar anywhere. This article also thoroughly explains how protection
of kernel address space is implemented by Windows NT, how the transition from non-privileged to privileged mode can be made on x86-based system, and how applications can enter the kernel without a driver.
In addition to the above, this article introduces the reader to Advanced Programmable Interrupt Controller (APIC), and explains how interrupt information can be obtained from it. This topic seems to be barely known to the Windows community, although
APIC is briefly mentioned by Mark Russinovich and David Solomon in Windows Internals, fourth edition. However, this book does not explain how to actually program APIC. I never came across any explanation of APIC programming in any Windows-focused article either
- I had to figure out everything myself from Intel manuals. Therefore, I believe this information must be of great interest to Windows developers.
To summarize, if you want to learn more about the system internals, this article is right for you.
虽然使用户模式应用程序进入内核,绝对是一个令人兴奋的经历,这是闻所未闻的东西。它已首次完成由Matt Pietrek(他很多年前在windows95实现了该技术 )。他的技术,后来由Prasad Dabak, Sandeep Phadke 和 Milind Borate调整到Windows NT。为了从应用层进入内核,必须要在全局描述符表(GDT)设立调用门描述符,因此使应用程序可以通过调用门进入内核。然而,一旦用户模式代码是不允许访问GDT,上面提到的作者使用内核模式驱动程序才能去建立调用门描述符。当然,相当合乎逻辑的问题出现了
- 没有驱动程序进入内核,如果你还需要一个驱动程序,那么这个工作还有什么意义呢???毕竟,它只是失败的目的,你不觉得吗?
本文介绍了如何使 用户模式应用程序可以访问内核地址空间,并无需使用驱动程序在GDT设置调用门描述符。它解释了工作的32位处理器上虚拟到物理地址的转换,并介绍如何在用户模式应用程序可以找到一些给定虚拟地址代表的物理地址。解决这一任务的“Methodology”100%是我自己设计的, 在任何地方你将无法找到任何类似的信息。本文还详细地介绍了如何保护内核地址空间是在Windows NT中的实现,基于x86系统如何从非特权到特权模式的过渡,以及应用程序在没有驱动的情况下进入内核。
除了上述问题,本文向读者介绍了高级可编程中断控制器(APIC),并解释如何可以从中获得中断信息。在Windows交流社区这个话题似乎鲜为人知到,虽然APIC在 Windows Internals, fourth edition由Mark Russinovich和David Solomon简要提到了。然而,这本书没有解释如何实际APIC编程。在任何Windows的重点文章中我从来没有碰到任何解释APIC的编程的资料。 我必须自己从英特尔手册想出一切。因此,我相信这个信息必须是Windows开发人员的极大兴趣。
总结,如果你想了解更多有关系统内部,这篇文章是适合你的。
http://www.codeproject.com/Articles/11363/Entering-the-kernel-without-a-driver-and-getting-i
相关文章推荐
- Entering the kernel without a driver and getting interrupt information from APIC
- Databases and Information Systems IV: Selected Papers from the Seventh International Conference DB&I
- Understanding the linux kernel-ch4-Interrupt and exception
- Services.exe and the Windows CE 6.0 kernel (FROM FEEDSFARM)
- eclipse无法加载Layout(Eclipse is loading framework information and the layout library from the SDK fold)
- Loading drivers and Native applications from kernel mode, without touching registry
- Attempt to reset the display driver and recover from timeout failed
- The kernel thread khubd, from 《Essential Linux Device Driver》
- wxWidgets: How to initialize wxApp without using macros and without entering the main loop
- More 3D Graphics (rgl) for Classification with Local Logistic Regression and Kernel Density Estimates (from The Elements of Statistical Learning)(转)
- Loading drivers and Native applications from kernel mode, without touching registry
- 《Understanding the Linux kernel》学习笔记 Chapter 4: Interrupts and ExceptionsM
- Managing Virtual Teams: Getting the Most from Wikis, Blogs, and Other Collaborative Tools
- Reads information from the file and outputs it onto the screen
- exclude kernel or other packages from getting updated
- Eclipse:xxxx is required and cannot be removed from the server
- Skype to be integrated into the TVs from Panasonic and LG
- jdbc启动错误(The driver has not received any packets from the server)
- What is the difference between initWithCoder:, initWithNibName:, and awakeFromNib?
- ffmpeg 音频转换: use ffmpeg convert the audio from stereo to mono without changing the video part