Results 1 to 1 of 1
Am having issues modifying the syscall table in kernel 2.6.30.
Am doing the following (relevant pieces of code):
Code:
unsigned long **find_sys_call_table(void)
{
unsigned long **sctable;
unsigned long ptr;
sctable ...
Enjoy an ad free experience by logging in. Not a member yet? Register.
- 09-01-2009 #1Just Joined!
- Join Date
- Sep 2009
- Posts
- 1
Modifying syscall table in newer kernels
Am having issues modifying the syscall table in kernel 2.6.30.
Am doing the following (relevant pieces of code):
But I get the following:Code:unsigned long **find_sys_call_table(void) { unsigned long **sctable; unsigned long ptr; sctable = NULL; for (ptr = (unsigned long)&unlock_kernel; ptr < (unsigned long)&loops_per_jiffy; ptr += sizeof(void *)) { unsigned long *p; p = (unsigned long *)ptr; if (p[__NR_close] == (unsigned long) sys_close) { sctable = (unsigned long **)p; return &sctable[0]; } } return NULL; } static int __init scsisniff_init_module(void) { if ( (sys_call_table = find_sys_call_table()) ) { real_ioctl = (int(*)(unsigned int fd, unsigned int cmd, unsigned long arg))sys_call_table[__NR_ioctl]; if ( set_memory_rw( (unsigned long)sys_call_table[__NR_ioctl], 1 ) ) printk( "set_memory_rw: succeeded\n" ); else { printk( "set_memory_rw: failed!\n" ); return -1; } sys_call_table[__NR_ioctl] = (unsigned long)my_ioctl; } else { return -1; } return 0; }
The second oops is obviously as a result of the mem being RO.Code:[ 71.143742] WARNING: at arch/x86/mm/pageattr.c:833 change_page_attr_set_clr+0x1a0/0x400() [ 71.143745] Modules linked in: scsi_sniff(+) i915 binfmt_misc drm i2c_algo_bit bridge stp bnep lp snd_hda_codec_analog snd_hda_intel snd_hda_codec snd_hwdep snd_pcm_oss snd_mixer_oss snd_pcm snd_seq_dummy snd_seq_oss snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq snd_timer snd_seq_device video snd psmouse tpm_infineon tpm ppdev soundcore serio_raw pcspkr intel_agp tpm_bios output heci(C) iTCO_wdt iTCO_vendor_support parport_pc parport snd_page_alloc floppy usbhid usb_storage e1000e [ 71.143768] Pid: 3378, comm: insmod Tainted: G C 2.6.30.4custom-1.0 #6 [ 71.143769] Call Trace: [ 71.143773] [<ffffffff802da6d5>] ? __vunmap+0xc5/0x110 [ 71.143775] [<ffffffff80235200>] ? change_page_attr_set_clr+0x1a0/0x400 [ 71.143778] [<ffffffff8024edf8>] warn_slowpath_common+0x78/0xd0 [ 71.143780] [<ffffffff8024ee5f>] warn_slowpath_null+0xf/0x20 [ 71.143783] [<ffffffff80235200>] change_page_attr_set_clr+0x1a0/0x400 [ 71.143785] [<ffffffffa0274050>] ? my_ioctl+0x0/0x120 [scsi_sniff] [ 71.143789] [<ffffffff802a6dcd>] ? marker_update_probe_range+0x1dd/0x2d0 [ 71.143791] [<ffffffffa0277000>] ? scsisniff_init_module+0x0/0xf4 [scsi_sniff] [ 71.143793] [<ffffffff80235b9a>] set_memory_rw+0x2a/0x30 [ 71.143796] [<ffffffff802ff000>] ? sys_fcntl+0x180/0x420 [ 71.143798] [<ffffffffa02770bb>] scsisniff_init_module+0xbb/0xf4 [scsi_sniff] [ 71.143801] [<ffffffff8020a04c>] do_one_initcall+0x3c/0x180 [ 71.143804] [<ffffffff8026b7f3>] ? __blocking_notifier_call_chain+0x63/0x80 [ 71.143807] [<ffffffff8027dc0d>] sys_init_module+0xad/0x200 [ 71.143810] [<ffffffff80210fc2>] system_call_fastpath+0x16/0x1b [ 71.143812] ---[ end trace 5b3efe312296b587 ]--- [ 71.143958] set_memory_rw: failed! [ 71.143963] BUG: unable to handle kernel paging request at ffffffff806c63e0 [ 71.143966] IP: [<ffffffffa02770d4>] scsisniff_init_module+0xd4/0xf4 [scsi_sniff] [ 71.143969] PGD 203067 PUD 207063 PMD 20cc99063 PTE 80000000006c6161 [ 71.143972] Oops: 0003 [#1] SMP [ 71.143974] last sysfs file: /sys/devices/pci0000:00/0000:00:02.0/drm/card0/dev [ 71.143976] CPU 0 [ 71.143977] Modules linked in: scsi_sniff(+) i915 binfmt_misc drm i2c_algo_bit bridge stp bnep lp snd_hda_codec_analog snd_hda_intel snd_hda_codec snd_hwdep snd_pcm_oss snd_mixer_oss snd_pcm snd_seq_dummy snd_seq_oss snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq snd_timer snd_seq_device video snd psmouse tpm_infineon tpm ppdev soundcore serio_raw pcspkr intel_agp tpm_bios output heci(C) iTCO_wdt iTCO_vendor_support parport_pc parport snd_page_alloc floppy usbhid usb_storage e1000e [ 71.143997] Pid: 3378, comm: insmod Tainted: G WC 2.6.30.4custom-1.0 [ 71.143999] RIP: 0010:[<ffffffffa02770d4>] [<ffffffffa02770d4>] scsisniff_init_module+0xd4/0xf4 [scsi_sniff] [ 71.144002] RSP: 0018:ffff88020d435ed8 EFLAGS: 00010296 [ 71.144004] RAX: ffffffff806c6360 RBX: ffffffffa02747c0 RCX: 000000000001ffff [ 71.144005] RDX: ffff880028034000 RSI: 0000000000000046 RDI: 0000000000000296 [ 71.144007] RBP: ffff88020d435ed8 R08: 0000000000000000 R09: 0000000000000001 [ 71.144008] R10: 000000000000000a R11: 0000000000000000 R12: ffffffffa0277000 [ 71.144010] R13: 0000000000000000 R14: 0000000000040000 R15: 0000000001989010 [ 71.144012] FS: 00007f1cea6426f0(0000) GS:ffff880028034000(0000) knlGS:0000000000000000 [ 71.144013] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b [ 71.144015] CR2: ffffffff806c63e0 CR3: 00000002164ea000 CR4: 00000000000406a0 [ 71.144016] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 71.144018] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 71.144020] Process insmod (pid: 3378, threadinfo ffff88020d434000, task ffff8802164c2cc0) [ 71.144021] Stack: [ 71.144022] ffff88020d435f48 ffffffff8020a04c ffff88020d435f38 ffffffff8026b7f3 [ 71.144025] 0000000000040000 ffffffffa02747c0 0000000000000001 ffffffffa02747c0 [ 71.144027] 000000000002164c 00007f1cea601010 ffffffffa02747c0 000000000002164c [ 71.144030] Call Trace: [ 71.144031] [<ffffffff8020a04c>] do_one_initcall+0x3c/0x180 [ 71.144034] [<ffffffff8026b7f3>] ? __blocking_notifier_call_chain+0x63/0x80 [ 71.144037] [<ffffffff8027dc0d>] sys_init_module+0xad/0x200 [ 71.144039] [<ffffffff80210fc2>] system_call_fastpath+0x16/0x1b [ 71.144042] Code: ff be 01 00 00 00 48 8b b8 80 00 00 00 e8 b5 ea fb df 85 c0 74 25 48 c7 c7 42 42 27 a0 31 c0 e8 6f 02 44 e0 48 8b 05 14 d9 ff ff <48> c7 80 80 00 00 00 50 40 27 a0 e9 66 ff ff ff 48 c7 c7 5c 42 [ 71.144062] RIP [<ffffffffa02770d4>] scsisniff_init_module+0xd4/0xf4 [scsi_sniff] [ 71.144065] RSP <ffff88020d435ed8> [ 71.144066] CR2: ffffffff806c63e0 [ 71.144067] ---[ end trace 5b3efe312296b588 ]---


Reply With Quote
