linux下系统调用劫持ioctl

实验环境：linux 2.6.32   64位系统

采用lkm（动态加载内核模块）方式劫持ioctl系统调用，系统调用过程如图所示（以open为例子）

实验代码:(头文件有不需要的，但是懒得改了，在系统开发时依赖 kernel-devel开发工具)

#include <linux/module.h>

#include <linux/kernel.h>

#include <linux/init.h>

#include <linux/sched.h>

#include <linux/fs.h>

#include <linux/file.h>

#include <linux/fs_struct.h>

#include <linux/fdtable.h>

#include <linux/string.h>

#include <linux/mm.h>

#include <linux/syscalls.h>

#include <linux/list.h>

#include <linux/jiffies.h>

#include <linux/cdev.h>

#include <linux/path.h>

#include <linux/time.h>

#include <linux/stat.h>

#include <net/sock.h>

#include <net/inet_sock.h>

#include <linux/cdrom.h>

#include <linux/types.h>

#include <linux/security.h>

#include <linux/export.h>

#include <linux/uaccess.h>

#include <linux/writeback.h>

#include <linux/buffer_head.h>

#include <linux/falloc.h>

#include <asm/cpufeature.h>

#include <asm/unistd.h>

#include <asm/uaccess.h>

#include <asm/ioctls.h>

#include <linux/compiler.h>

#include <linux/posix_types.h>

#include <linux/syscalls.h>

#include <linux/export.h>

#include <linux/fs.h>

#include <linux/mm.h>

#include <linux/mmzone.h>

#include <linux/time.h>

#include <linux/sched.h>

#include <linux/slab.h>

#include <linux/vmalloc.h>

#include <linux/file.h>

#include <linux/fdtable.h>

#include <linux/bitops.h>

#include <linux/interrupt.h>

#include <linux/spinlock.h>

#include <linux/rcupdate.h>

#inclu
bc50
de <linux/workqueue.h>

#include <linux/syscalls.h>

#include <linux/mm.h>

#include <linux/smp_lock.h>

#include <linux/capability.h>

#include <linux/file.h>

#include <linux/fs.h>

#include <linux/security.h>

#include <linux/module.h>

#include <linux/uaccess.h>

#include <linux/writeback.h>

#include <linux/buffer_head.h>

#include <linux/falloc.h>

#include <linux/ioctl.h>

#include <asm/ioctls.h>

//通过内核符号表查找到的sys_call_table的地址

//  grep sys_call_table /boot/System.map-`uname -r` 

unsigned long **sys_call_table = (unsigned long **)0xffffffff81600520;

//unsigned long *orig_mkdir = NULL;  

//unsigned long *orig_ioctl = NULL;

asmlinkage long (*orig_ioctl)(unsigned int fd, unsigned int cmd,
unsigned long arg);

//为了可以对sys_call_table所在内存页，进行读写，需要重新设置页的属性。

/* make the page writable */

int make_rw(unsigned long address)

{

        unsigned int level;

        pte_t *pte = lookup_address(address, &level);//查找地址所在的内存页面

        if (pte->pte & ~_PAGE_RW) //设置读写属性

                pte->pte |=  _PAGE_RW;

        return 0;

}

/* make the page write protected */

int make_ro(unsigned long address)

{

        unsigned int level;

        pte_t *pte = lookup_address(address, &level);

        pte->pte &= ~_PAGE_RW; //设置只读属性

        return 0;

}

//mkdir的函数原型,这个函数的原型要和系统的一致

/*asmlinkage long hacked_mkdir(const char __user *pathname, int mode)

{

        printk("mkdir pathname: %s\n", pathname);

        printk(KERN_ALERT "mkdir do nothing!\n");

        return 0; //everything is ok, but he new systemcall does nothing*/

//}

// you should change inside code according your kernel version

asmlinkage long hacked_ioctl(unsigned int fd, unsigned int cmd,
unsigned long arg){
printk("hacking\n");
if(cmd == CDROMEJECT){
printk("HiveMe Hack!\n");
return 0;
}

return orig_ioctl(fd,cmd,arg);

}

//也是内核初始化函数

static int syscall_init_module(void)

{

        printk(KERN_ALERT "sys_call_table: 0x%p\n", sys_call_table);

      //  orig_mkdir = (unsigned long *)(sys_call_table[__NR_mkdir]); //获取原来的系统调用地址

        orig_ioctl = (unsigned long *)(sys_call_table[__NR_ioctl]);

     //   printk(KERN_ALERT "orig_mkdir: 0x%p\n", orig_mkdir);
printk(KERN_ALERT "orig_ioctl: 0x%p\n", orig_ioctl);

        make_rw((unsigned long)sys_call_table); //修改页属性

    //    sys_call_table[__NR_mkdir] = (unsigned long *)hacked_mkdir; //设置新的系统调用地址

    //    printk("mkdir\n");

      sys_call_table[__NR_ioctl] = (unsigned long *)hacked_ioctl;
printk("ioctl\n");

       // make_ro((unsigned long)sys_call_table);

        return 0;

}

//内核注销函数

static void syscall_cleanup_module(void)

{

        printk(KERN_ALERT "Module syscall unloaded.\n");

        make_rw((unsigned long)sys_call_table);

      //  sys_call_table[__NR_mkdir] = (unsigned long *)orig_mkdir;
sys_call_table[__NR_ioctl] = (unsigned long *)orig_ioctl;

        /*set mkdir syscall to the origal one*/

        make_ro((unsigned long)sys_call_table);

}

module_init(syscall_init_module);

module_exit(syscall_cleanup_module);

MODULE_LICENSE("GPL");

MODULE_DESCRIPTION("hack syscall");

代码源自其他网友，进行了部分修改，如原作者需要特殊标注请与我联系