Linux Kernel: System call hooking example

I finally found the answer myself.

http://www.linuxforums.org/forum/linux-kernel/133982-cannot-modify-sys_call_table.html

The kernel was changed at some point so that the system call table is read only.

cypherpunk:

Even if it is late but the Solution may interest others too: In the entry.S file you will find: Code:

.section .rodata,"a"#include "syscall_table_32.S"

sys_call_table -> ReadOnly You have to compile the Kernel new if you want to "hack" around with sys_call_table...

The link also has an example of changing the memory to be writable.

nasekomoe:

Hi everybody. Thanks for replies. I solved the problem long ago by modifying access to memory pages. I have implemented two functions that do it for my upper level code:

#include <asm/cacheflush.h>#ifdef KERN_2_6_24#include <asm/semaphore.h>int set_page_rw(long unsigned int _addr){    struct page *pg;    pgprot_t prot;    pg = virt_to_page(_addr);    prot.pgprot = VM_READ | VM_WRITE;    return change_page_attr(pg, 1, prot);}int set_page_ro(long unsigned int _addr){    struct page *pg;    pgprot_t prot;    pg = virt_to_page(_addr);    prot.pgprot = VM_READ;    return change_page_attr(pg, 1, prot);}#else#include <linux/semaphore.h>int set_page_rw(long unsigned int _addr){    return set_memory_rw(_addr, 1);}int set_page_ro(long unsigned int _addr){    return set_memory_ro(_addr, 1);}#endif // KERN_2_6_24

Here's a modified version of the original code that works for me.

#include <linux/kernel.h>#include <linux/module.h>#include <linux/moduleparam.h>#include <linux/unistd.h>#include <asm/semaphore.h>#include <asm/cacheflush.h>void **sys_call_table;asmlinkage int (*original_call) (const char*, int, int);asmlinkage int our_sys_open(const char* file, int flags, int mode){   printk("A file was opened\n");   return original_call(file, flags, mode);}int set_page_rw(long unsigned int _addr){   struct page *pg;   pgprot_t prot;   pg = virt_to_page(_addr);   prot.pgprot = VM_READ | VM_WRITE;   return change_page_attr(pg, 1, prot);}int init_module(){    // sys_call_table address in System.map    sys_call_table = (void*)0xc061e4e0;    original_call = sys_call_table[__NR_open];    set_page_rw(sys_call_table);    sys_call_table[__NR_open] = our_sys_open;}void cleanup_module(){   // Restore the original call   sys_call_table[__NR_open] = original_call;}

Thanks Stephen, your research here was helpful to me. I had a few problems, though, as I was trying this on a 2.6.32 kernel, and getting WARNING: at arch/x86/mm/pageattr.c:877 change_page_attr_set_clr+0x343/0x530() (Not tainted) followed by a kernel OOPS about not being able to write to the memory address.

The comment above the mentioned line states:

// People should not be passing in unaligned addresses

The following modified code works:

int set_page_rw(long unsigned int _addr){    return set_memory_rw(PAGE_ALIGN(_addr) - PAGE_SIZE, 1);}int set_page_ro(long unsigned int _addr){    return set_memory_ro(PAGE_ALIGN(_addr) - PAGE_SIZE, 1);}

Note that this still doesn't actually set the page as read/write in some situations. The static_protections() function, which is called inside of set_memory_rw(), removes the _PAGE_RW flag if:

• It's in the BIOS area
• The address is inside .rodata
• CONFIG_DEBUG_RODATA is set and the kernel is set to read-only

I found this out after debugging why I still got "unable to handle kernel paging request" when trying to modify the address of kernel functions. I was eventually able to solve that problem by finding the page table entry for the address myself and manually setting it to writable. Thankfully, the lookup_address() function is exported in version 2.6.26+. Here is the code I wrote to do that:

void set_addr_rw(unsigned long addr) {    unsigned int level;    pte_t *pte = lookup_address(addr, &level);    if (pte->pte &~ _PAGE_RW) pte->pte |= _PAGE_RW;}void set_addr_ro(unsigned long addr) {    unsigned int level;    pte_t *pte = lookup_address(addr, &level);    pte->pte = pte->pte &~_PAGE_RW;}

Finally, while Mark's answer is technically correct, it'll case problem when ran inside Xen. If you want to disable write-protect, use the read/write cr0 functions. I macro them like this:

#define GPF_DISABLE write_cr0(read_cr0() & (~ 0x10000))#define GPF_ENABLE write_cr0(read_cr0() | 0x10000)

Hope this helps anyone else who stumbles upon this question.

Note that the following will also work instead of using change_page_attr and cannot be depreciated:

static void disable_page_protection(void) {    unsigned long value;    asm volatile("mov %%cr0,%0" : "=r" (value));    if (value & 0x00010000) {            value &= ~0x00010000;            asm volatile("mov %0,%%cr0": : "r" (value));    }}static void enable_page_protection(void) {    unsigned long value;    asm volatile("mov %%cr0,%0" : "=r" (value));    if (!(value & 0x00010000)) {            value |= 0x00010000;            asm volatile("mov %0,%%cr0": : "r" (value));    }}