Skip to content

Instantly share code, notes, and snippets.

@GoldenOak
Created February 1, 2020 13:44
Show Gist options
  • Save GoldenOak/0ba31054e0ca396a864997d54f32abce to your computer and use it in GitHub Desktop.
Save GoldenOak/0ba31054e0ca396a864997d54f32abce to your computer and use it in GitHub Desktop.
Snippet of system call hooking for the Linux kernel
/*
* This is not a whole code, but only a snippet.
* Some functions *is* missing.
*/
asmlinkage long (*orig_shutdown)(int, int);
unsigned long *sys_call_table;
hooking_syscall(void *hook_addr, uint16_t syscall_offset, unsigned long *sys_call_tabe)
{
unprotect_memory();
sys_call_table[syscall_offset] = (unsigned long)hook_addr;
protect_memory();
}
unhooking_syscall(void *orig_addr, uint16_t syscall_offset)
{
unprotect_memory();
sys_call_table[syscall_offset] = (unsigned long)hook_addr;
protect_memory();
}
asmlinkage int hooked_shutdown(int magic1, int magic2)
{
printk("Hello from hook!");
return orig_shutdown(magic1, magic2);
}
static int __init module_init(void)
{
unsigned long *sys_call_table = kallsyms_lookup_name("sys_call_table"));
orig_shutdown = (void*)sys_call_table[__NR_shutdown];
hooking_syscall(hooked_shutdown, __NR_shutdown, sys_call_tabe);
}
static void __exit module_cleanup(void)
{
unhooking_syscall(orig_shutdown, __NE_shutdown, sys_call_table);
}
@Kaliendo
Copy link

Kaliendo commented Oct 1, 2022

Shouldn't line 19 set the sys_call_table[syscall_offset] to (unsigned long)orig_addr instead of (unsigned long)hook_addr?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment