系统调用 table 黑客玩具示例在 64 位上不起作用
Syscall table hacking toy-example does not work on 64 bit
这是我正在开发的一个非常简单的模块。它只是用我的新系统调用 log_message 替换了 sys_ni_syscall。这里是源文件template_syscall_hacking.c:
#include <linux/init.h>
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/errno.h>
#include <linux/types.h>
#include <linux/unistd.h>
#include <asm/cacheflush.h>
#include <asm/page.h>
#include <asm/current.h>
#include <linux/sched.h>
#include <linux/kallsyms.h>
#define MODNAME "SYSCALL HACKING TEMPLATE"
MODULE_LICENSE("GPL");
MODULE_AUTHOR("Marco");
// 32-bit machine addresses
unsigned long sys_call_table = 0xc1672140;
unsigned long sys_ni_syscall = 0xc10778b0;
// 64-bit machine addresses
//unsigned long sys_call_table = 0xffffffff81a00240;
//unsigned long sys_ni_syscall = 0xffffffff810aa2b0;
asmlinkage int log_message(int x) {
printk("%s: log_message called\n", MODNAME);
}
int restore;
int init_module(void) {
unsigned long * p = (unsigned long *) sys_call_table;
int i;
unsigned long cr0;
printk("%s: init_module\n", MODNAME);
cr0 = read_cr0();
write_cr0(cr0 & ~X86_CR0_WP);
for (i=0; i<256; i++){
if (p[i] == sys_ni_syscall){
printk("%s: table entry %d keeps address %p\n",MODNAME,i,(void*)p[i]);
restore = i;
break;
}
}
p[restore] = (unsigned long)log_message;
write_cr0 (cr0);
return 0;
}
void cleanup_module(void) {
unsigned long * p = (unsigned long *) sys_call_table;
unsigned long cr0;
cr0 = read_cr0();
write_cr0(cr0 & ~X86_CR0_WP);
p[restore] = sys_ni_syscall;
write_cr0 (cr0);
printk("%s: cleanup_module\n", MODNAME);
return;
}
我尝试在两个 linux 发行版上安装模块，32 位（来宾 OS）和 64 位（主机 OS）。遵循 uname -ri 的输出：
3.13.0-128-generic i686
4.10.0-32-generic x86_64
客人OS是Ubuntu14.04，而主人OS是Ubuntu16.04.
我将变量 sys_call_table 和 sys_ni_syscall 设置为使用以下命令获得的值（在两台机器上）：
sudo cat /boot/System.map-$(uname -r) | grep sys_call_table
sudo cat /boot/System.map-$(uname -r) | grep sys_ni_syscall
对于编译，我使用 "standard" Makefile 用于 linux 内核模块：
obj-m += template_syscall_hacking.o
all:
make -C /lib/modules/$(shell uname -r)/build M=$(PWD) modules
clean:
make -C /lib/modules/$(shell uname -r)/build M=$(PWD) clean
最后，我用下面的程序测试了新的系统调用user.c:
#include <stdlib.h>
#include <stdio.h>
int main(int argc, char** argv){
int sys_call_num, arg;
if(argc < 2){
printf("usage: prog syscall-num\n");
return;
}
sys_call_num = strtol(argv[1],NULL,10);
syscall(sys_call_num);
return 0;
}
32 位测试
我在32位机器上测试模块时一切正常
首先，在编译模块之前，我们需要更改目标机器的地址：
// 32-bit machine addresses
//uncomment these lines
unsigned long sys_call_table = 0xc1672140;
unsigned long sys_ni_syscall = 0xc10778b0;
// 64-bit machine addresses
//comment these ones
//unsigned long sys_call_table = 0xffffffff81a00240;
//unsigned long sys_ni_syscall = 0xffffffff810aa2b0;
I 运行 make，生成 template_syscall_hacking.ko
我用 sudo insmod template_syscall_hacking.ko 安装了模块。它生成以下消息（dmesg | tail 的输出）：
[14177.841355] SYSCALL HACKING TEMPLATE: init_module
[14177.841358] SYSCALL HACKING TEMPLATE: table entry 17 keeps address c10778b0
然后，我用 gcc user.c 和 ./a.out 17 测试了新系统调用（17 是新系统调用的 id），它给出了输出:
[14181.207843] SYSCALL HACKING TEMPLATE: log_message called
使用 sudo rmmod template_syscall_hacking 删除模块得到：
[14183.901823] SYSCALL HACKING TEMPLATE: cleanup_module
一切正常，如我所料，仅此而已。
64 位测试
和以前一样，我需要更改从 System.map 文件中获取的新机器的地址。
它编译正确，但是当我尝试安装模块时它失败并显示这些消息（来自 dmesg）：
[47672.950671] SYSCALL HACKING TEMPLATE: init_module
[47672.950699] BUG: unable to handle kernel paging request at ffffffff81a00240
[47672.950715] IP: init_module+0x46/0xd0 [template_syscall_hacking]
[47672.950719] PGD 16720c067
[47672.950722] PUD 16720d063
[47672.950726] PMD 0
[47672.950737] Oops: 0000 [#4] SMP
[47672.950741] Modules linked in: template_syscall_hacking(OE+) template_sys_call_table_hacker(OE+) virtual_to_physical_memory_mapper(OE+) sys_call_table_hacker(OE+) ccm vboxdrv(OE) uas usb_storage rfcomm bnep binfmt_misc nls_iso8859_1 hid_multitouch intel_rapl i2c_designware_platform i2c_designware_core asus_nb_wmi asus_wmi sparse_keymap mxm_wmi arc4 x86_pkg_temp_thermal intel_powerclamp kvm_intel iwlmvm mac80211 kvm irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc aesni_intel aes_x86_64 crypto_simd glue_helper btusb btrtl uvcvideo videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_core videodev joydev media snd_hda_codec_realtek snd_hda_codec_generic idma64 intel_lpss_acpi virt_dma cryptd input_leds serio_raw iwlwifi cfg80211 processor_thermal_device int3403_thermal snd_hda_intel
[47672.950819] int340x_thermal_zone snd_hda_codec snd_hda_core snd_hwdep intel_lpss_pci intel_soc_dts_iosf snd_pcm intel_lpss int3400_thermal intel_pch_thermal tpm_crb acpi_thermal_rel asus_wireless snd_seq_midi snd_seq_midi_event snd_rawmidi nvidia_uvm(POE) snd_seq snd_seq_device snd_timer snd hci_uart btbcm btqca btintel mac_hid bluetooth soundcore shpchp mei_me mei wmi acpi_als kfifo_buf industrialio acpi_pad coretemp parport_pc ppdev lp parport autofs4 hid_generic usbhid nvidia_drm(POE) nvidia_modeset(POE) nvidia(POE) drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops r8169 ahci drm mii libahci i2c_hid hid video pinctrl_sunrisepoint pinctrl_intel fjes
[47672.950900] CPU: 5 PID: 29722 Comm: insmod Tainted: P D OE 4.10.0-32-generic #36~16.04.1-Ubuntu
[47672.950904] Hardware name: ASUSTeK COMPUTER INC. GL502VMK/GL502VMK, BIOS GL502VMK.300 12/27/2016
[47672.950910] task: ffff9e6922c74500 task.stack: ffffb42e93cdc000
[47672.950919] RIP: 0010:init_module+0x46/0xd0 [template_syscall_hacking]
[47672.950923] RSP: 0018:ffffb42e93cdfc88 EFLAGS: 00010246
[47672.950929] RAX: 0000000080040033 RBX: 0000000000000000 RCX: ffffffff810aa2b0
[47672.950934] RDX: 0000000000000000 RSI: ffff9e693ed4dc88 RDI: 0000000080040033
[47672.950939] RBP: ffffb42e93cdfc98 R08: 00000000000e818f R09: 00000000000011a3
[47672.950943] R10: ffff9e6795f39d20 R11: ffffffffa9c487ed R12: ffffffff81a00240
[47672.950948] R13: 0000000000000000 R14: ffff9e672e6bf900 R15: 0000000000000001
[47672.950953] FS: 00007fc22bbce700(0000) GS:ffff9e693ed40000(0000) knlGS:0000000000000000
[47672.950958] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080040033
[47672.950962] CR2: ffffffff81a00240 CR3: 0000000393e2a000 CR4: 00000000003426e0
[47672.950967] Call Trace:
[47672.950977] ? log_message+0x20/0x20 [template_syscall_hacking]
[47672.950986] do_one_initcall+0x53/0x1c0
[47672.950996] ? kmem_cache_alloc_trace+0x152/0x1c0
[47672.951005] do_init_module+0x5f/0x1ff
[47672.951014] load_module+0x1825/0x1bf0
[47672.951022] ? __symbol_put+0x60/0x60
[47672.951030] ? ima_post_read_file+0x7d/0xa0
[47672.951038] ? security_kernel_post_read_file+0x6b/0x80
[47672.951047] SYSC_finit_module+0xdf/0x110
[47672.951055] SyS_finit_module+0xe/0x10
[47672.951077] entry_SYSCALL_64_fastpath+0x1e/0xad
[47672.951078] RIP: 0033:0x7fc22b702499
[47672.951079] RSP: 002b:00007ffc41fe31f8 EFLAGS: 00000202 ORIG_RAX: 0000000000000139
[47672.951081] RAX: ffffffffffffffda RBX: 00007fc22b9c5b20 RCX: 00007fc22b702499
[47672.951082] RDX: 0000000000000000 RSI: 0000564b4889826b RDI: 0000000000000003
[47672.951083] RBP: 0000000000001011 R08: 0000000000000000 R09: 00007fc22b9c7ea0
[47672.951084] R10: 0000000000000003 R11: 0000000000000202 R12: 00007fc22b9c5b78
[47672.951085] R13: 00007fc22b9c5b78 R14: 000000000000270f R15: 00007fc22b9c61a8
[47672.951086] Code: 8b 25 c7 1f 00 00 e8 ad e8 4a e7 e8 15 86 36 e7 66 90 48 25 ff ff fe ff 48 89 c7 e8 15 86 36 e7 66 90 48 8b 0d 9c 1f 00 00 31 db <49> 39 0c dc 74 5f 48 83 c3 01 48 81 fb 00 01 00 00 75 ed e8 e2
[47672.951110] RIP: init_module+0x46/0xd0 [template_syscall_hacking] RSP: ffffb42e93cdfc88
[47672.951111] CR2: ffffffff81a00240
[47672.951112] ---[ end trace 538c9fde5e05cd81 ]---
谁能告诉我哪里出了问题？我认为相同的代码应该也适用于 64 位的情况。我错过了什么？
首先，这是在内核中做任何事情的糟糕方式，像那样搞乱 cr0。
但是，内核恐慌消息说明了真正发生的事情：
PGD 16720c067
PUD 16720d063
PMD 0
Page middle directory entry 为 0，因此您的地址 ffffffff81a00240 无效。
还是没有直接解决问题；但是使用 OpenSUSE（64 位）它可以工作。
uname -a 输出为：
Linux linux-6783.suse 4.4.79-19-default #1 SMP Thu Aug 10 20:28:47 UTC 2017 (2dd03e8) x86_64 x86_64 x86_64 GNU/Linux
编辑：
已解决：问题是 实际 地址在 /proc/kallsyms 中。
因此，您应该按以下方式 grep /proc/kallsyms 而不是 grep System.Map 文件：
sudo cat /proc/kallsyms | grep sys_call_table
sudo cat /proc/kallsyms | grep sys_ni_syscall
并在上面的代码中使用这些地址。
这是我正在开发的一个非常简单的模块。它只是用我的新系统调用 log_message 替换了 sys_ni_syscall。这里是源文件template_syscall_hacking.c:
#include <linux/init.h>
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/errno.h>
#include <linux/types.h>
#include <linux/unistd.h>
#include <asm/cacheflush.h>
#include <asm/page.h>
#include <asm/current.h>
#include <linux/sched.h>
#include <linux/kallsyms.h>
#define MODNAME "SYSCALL HACKING TEMPLATE"
MODULE_LICENSE("GPL");
MODULE_AUTHOR("Marco");
// 32-bit machine addresses
unsigned long sys_call_table = 0xc1672140;
unsigned long sys_ni_syscall = 0xc10778b0;
// 64-bit machine addresses
//unsigned long sys_call_table = 0xffffffff81a00240;
//unsigned long sys_ni_syscall = 0xffffffff810aa2b0;
asmlinkage int log_message(int x) {
printk("%s: log_message called\n", MODNAME);
}
int restore;
int init_module(void) {
unsigned long * p = (unsigned long *) sys_call_table;
int i;
unsigned long cr0;
printk("%s: init_module\n", MODNAME);
cr0 = read_cr0();
write_cr0(cr0 & ~X86_CR0_WP);
for (i=0; i<256; i++){
if (p[i] == sys_ni_syscall){
printk("%s: table entry %d keeps address %p\n",MODNAME,i,(void*)p[i]);
restore = i;
break;
}
}
p[restore] = (unsigned long)log_message;
write_cr0 (cr0);
return 0;
}
void cleanup_module(void) {
unsigned long * p = (unsigned long *) sys_call_table;
unsigned long cr0;
cr0 = read_cr0();
write_cr0(cr0 & ~X86_CR0_WP);
p[restore] = sys_ni_syscall;
write_cr0 (cr0);
printk("%s: cleanup_module\n", MODNAME);
return;
}
我尝试在两个 linux 发行版上安装模块，32 位（来宾 OS）和 64 位（主机 OS）。遵循 uname -ri 的输出：
3.13.0-128-generic i686
4.10.0-32-generic x86_64
客人OS是Ubuntu14.04，而主人OS是Ubuntu16.04.
我将变量 sys_call_table 和 sys_ni_syscall 设置为使用以下命令获得的值（在两台机器上）：
sudo cat /boot/System.map-$(uname -r) | grep sys_call_table
sudo cat /boot/System.map-$(uname -r) | grep sys_ni_syscall
对于编译，我使用 "standard" Makefile 用于 linux 内核模块：
obj-m += template_syscall_hacking.o
all:
make -C /lib/modules/$(shell uname -r)/build M=$(PWD) modules
clean:
make -C /lib/modules/$(shell uname -r)/build M=$(PWD) clean
最后，我用下面的程序测试了新的系统调用user.c:
#include <stdlib.h>
#include <stdio.h>
int main(int argc, char** argv){
int sys_call_num, arg;
if(argc < 2){
printf("usage: prog syscall-num\n");
return;
}
sys_call_num = strtol(argv[1],NULL,10);
syscall(sys_call_num);
return 0;
}
32 位测试
我在32位机器上测试模块时一切正常
首先，在编译模块之前，我们需要更改目标机器的地址：
// 32-bit machine addresses //uncomment these lines unsigned long sys_call_table = 0xc1672140; unsigned long sys_ni_syscall = 0xc10778b0; // 64-bit machine addresses //comment these ones //unsigned long sys_call_table = 0xffffffff81a00240; //unsigned long sys_ni_syscall = 0xffffffff810aa2b0;I 运行
make，生成template_syscall_hacking.ko我用
sudo insmod template_syscall_hacking.ko安装了模块。它生成以下消息（dmesg | tail的输出）：[14177.841355] SYSCALL HACKING TEMPLATE: init_module [14177.841358] SYSCALL HACKING TEMPLATE: table entry 17 keeps address c10778b0然后，我用
gcc user.c和./a.out 17测试了新系统调用（17是新系统调用的 id），它给出了输出:[14181.207843] SYSCALL HACKING TEMPLATE: log_message called使用
sudo rmmod template_syscall_hacking删除模块得到：[14183.901823] SYSCALL HACKING TEMPLATE: cleanup_module
一切正常，如我所料，仅此而已。
64 位测试
和以前一样，我需要更改从 System.map 文件中获取的新机器的地址。
它编译正确，但是当我尝试安装模块时它失败并显示这些消息（来自 dmesg）：
[47672.950671] SYSCALL HACKING TEMPLATE: init_module
[47672.950699] BUG: unable to handle kernel paging request at ffffffff81a00240
[47672.950715] IP: init_module+0x46/0xd0 [template_syscall_hacking]
[47672.950719] PGD 16720c067
[47672.950722] PUD 16720d063
[47672.950726] PMD 0
[47672.950737] Oops: 0000 [#4] SMP
[47672.950741] Modules linked in: template_syscall_hacking(OE+) template_sys_call_table_hacker(OE+) virtual_to_physical_memory_mapper(OE+) sys_call_table_hacker(OE+) ccm vboxdrv(OE) uas usb_storage rfcomm bnep binfmt_misc nls_iso8859_1 hid_multitouch intel_rapl i2c_designware_platform i2c_designware_core asus_nb_wmi asus_wmi sparse_keymap mxm_wmi arc4 x86_pkg_temp_thermal intel_powerclamp kvm_intel iwlmvm mac80211 kvm irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc aesni_intel aes_x86_64 crypto_simd glue_helper btusb btrtl uvcvideo videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_core videodev joydev media snd_hda_codec_realtek snd_hda_codec_generic idma64 intel_lpss_acpi virt_dma cryptd input_leds serio_raw iwlwifi cfg80211 processor_thermal_device int3403_thermal snd_hda_intel
[47672.950819] int340x_thermal_zone snd_hda_codec snd_hda_core snd_hwdep intel_lpss_pci intel_soc_dts_iosf snd_pcm intel_lpss int3400_thermal intel_pch_thermal tpm_crb acpi_thermal_rel asus_wireless snd_seq_midi snd_seq_midi_event snd_rawmidi nvidia_uvm(POE) snd_seq snd_seq_device snd_timer snd hci_uart btbcm btqca btintel mac_hid bluetooth soundcore shpchp mei_me mei wmi acpi_als kfifo_buf industrialio acpi_pad coretemp parport_pc ppdev lp parport autofs4 hid_generic usbhid nvidia_drm(POE) nvidia_modeset(POE) nvidia(POE) drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops r8169 ahci drm mii libahci i2c_hid hid video pinctrl_sunrisepoint pinctrl_intel fjes
[47672.950900] CPU: 5 PID: 29722 Comm: insmod Tainted: P D OE 4.10.0-32-generic #36~16.04.1-Ubuntu
[47672.950904] Hardware name: ASUSTeK COMPUTER INC. GL502VMK/GL502VMK, BIOS GL502VMK.300 12/27/2016
[47672.950910] task: ffff9e6922c74500 task.stack: ffffb42e93cdc000
[47672.950919] RIP: 0010:init_module+0x46/0xd0 [template_syscall_hacking]
[47672.950923] RSP: 0018:ffffb42e93cdfc88 EFLAGS: 00010246
[47672.950929] RAX: 0000000080040033 RBX: 0000000000000000 RCX: ffffffff810aa2b0
[47672.950934] RDX: 0000000000000000 RSI: ffff9e693ed4dc88 RDI: 0000000080040033
[47672.950939] RBP: ffffb42e93cdfc98 R08: 00000000000e818f R09: 00000000000011a3
[47672.950943] R10: ffff9e6795f39d20 R11: ffffffffa9c487ed R12: ffffffff81a00240
[47672.950948] R13: 0000000000000000 R14: ffff9e672e6bf900 R15: 0000000000000001
[47672.950953] FS: 00007fc22bbce700(0000) GS:ffff9e693ed40000(0000) knlGS:0000000000000000
[47672.950958] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080040033
[47672.950962] CR2: ffffffff81a00240 CR3: 0000000393e2a000 CR4: 00000000003426e0
[47672.950967] Call Trace:
[47672.950977] ? log_message+0x20/0x20 [template_syscall_hacking]
[47672.950986] do_one_initcall+0x53/0x1c0
[47672.950996] ? kmem_cache_alloc_trace+0x152/0x1c0
[47672.951005] do_init_module+0x5f/0x1ff
[47672.951014] load_module+0x1825/0x1bf0
[47672.951022] ? __symbol_put+0x60/0x60
[47672.951030] ? ima_post_read_file+0x7d/0xa0
[47672.951038] ? security_kernel_post_read_file+0x6b/0x80
[47672.951047] SYSC_finit_module+0xdf/0x110
[47672.951055] SyS_finit_module+0xe/0x10
[47672.951077] entry_SYSCALL_64_fastpath+0x1e/0xad
[47672.951078] RIP: 0033:0x7fc22b702499
[47672.951079] RSP: 002b:00007ffc41fe31f8 EFLAGS: 00000202 ORIG_RAX: 0000000000000139
[47672.951081] RAX: ffffffffffffffda RBX: 00007fc22b9c5b20 RCX: 00007fc22b702499
[47672.951082] RDX: 0000000000000000 RSI: 0000564b4889826b RDI: 0000000000000003
[47672.951083] RBP: 0000000000001011 R08: 0000000000000000 R09: 00007fc22b9c7ea0
[47672.951084] R10: 0000000000000003 R11: 0000000000000202 R12: 00007fc22b9c5b78
[47672.951085] R13: 00007fc22b9c5b78 R14: 000000000000270f R15: 00007fc22b9c61a8
[47672.951086] Code: 8b 25 c7 1f 00 00 e8 ad e8 4a e7 e8 15 86 36 e7 66 90 48 25 ff ff fe ff 48 89 c7 e8 15 86 36 e7 66 90 48 8b 0d 9c 1f 00 00 31 db <49> 39 0c dc 74 5f 48 83 c3 01 48 81 fb 00 01 00 00 75 ed e8 e2
[47672.951110] RIP: init_module+0x46/0xd0 [template_syscall_hacking] RSP: ffffb42e93cdfc88
[47672.951111] CR2: ffffffff81a00240
[47672.951112] ---[ end trace 538c9fde5e05cd81 ]---
谁能告诉我哪里出了问题？我认为相同的代码应该也适用于 64 位的情况。我错过了什么？
首先，这是在内核中做任何事情的糟糕方式，像那样搞乱 cr0。
但是，内核恐慌消息说明了真正发生的事情：
PGD 16720c067
PUD 16720d063
PMD 0
Page middle directory entry 为 0，因此您的地址 ffffffff81a00240 无效。
还是没有直接解决问题；但是使用 OpenSUSE（64 位）它可以工作。
uname -a 输出为：
Linux linux-6783.suse 4.4.79-19-default #1 SMP Thu Aug 10 20:28:47 UTC 2017 (2dd03e8) x86_64 x86_64 x86_64 GNU/Linux
编辑：
已解决：问题是 实际 地址在 /proc/kallsyms 中。
因此，您应该按以下方式 grep /proc/kallsyms 而不是 grep System.Map 文件：
sudo cat /proc/kallsyms | grep sys_call_table
sudo cat /proc/kallsyms | grep sys_ni_syscall
并在上面的代码中使用这些地址。