An example of Hooking Linux System Call

SystemCallHooking.c

#include <linux/module.h>
#include <linux/printk.h>
#include <linux/fs.h>
#include <linux/sched.h>
#include <asm/unistd.h>
#include <asm/pgtable_types.h>
#include <linux/highmem.h>

#include "hook_function_ptr.h"

MODULE_LICENSE("GPL");
MODULE_AUTHOR("MicroMike");
MODULE_DESCRIPTION("Hello World Module");


/* sys_call_table address */
unsigned long *sys_call_table = SYS_CALL_TABLE_ADDR;


/* 
 * user function pointer for some linux kernel function call 
 * since some of the function didn't export to the module.
 */
int (*real_do_execve)(const char *, 
		const char __user *const __user *, 
		const char __user *const __user *) = DO_EXECVE_ADDR;

int (*real_do_execve_common)(const char *,
			struct user_arg_ptr argv,
			struct user_arg_ptr envp) = DO_EXECVE_COMMON_ADDR;

void (*real_putname)(struct filename *name) = PUTNAME_ADDR;

/* real_execve address */
asmlinkage int (*real_execve)(const char __user *, 
			const char __user *const __user *, 
			const char __user *const __user *);

/* 
 * custom do_execve for firefox process.
 * which will insert two new arguments which is our usermode monitor program,
 * append the rest of the arguments as the new argument for the usermdoe monitor.
 */
int custom_do_execve(const char __user *filename,
		const char __user *const __user *__argv,
		const char __user *const __user *__envp)
{
	/* 
         * log some information you want .... 
         * ...
 	 * ...
	 */

	result = real_do_execve_common(filename, __argv, __envp);
	return result;
	
}
/* hook sys_execve which is */
asmlinkage int custom_execve(const char __user *filename, const char __user *const __user *argv, const char __user *const __user *envp)
{
	/* if the current process is firefox, hook it  */
	if( strstr(current->comm, "firefox")) {
		struct filename *path = getname(filename);
		int error = PTR_ERR(path);
		if (!IS_ERR(path)) {
			error = custom_do_execve(path->name, argv, envp);
			real_putname(path);
		}
		return error;
	}

	return real_execve(filename, argv, envp);
}

int make_rw(unsigned long address) 
{
	unsigned int level;
	pte_t *pte = lookup_address(address, &level);
	if(pte->pte &~ _PAGE_RW)
		pte->pte |= _PAGE_RW;
	return 0;
}


int make_ro(unsigned long address)
{
	unsigned int level;
	pte_t *pte = lookup_address(address, &level);
	pte->pte = pte->pte & ~_PAGE_RW;
	return 0;
}


static int __init test_init(void) 
{
	/* hook execve system call*/
	make_rw((unsigned long)sys_call_table);
	real_execve = (int (*)(const char __user *, 
			       const char __user *const __user *, 
			       const char __user *const __user *))
	*(sys_call_table + __NR_execve);
	*(sys_call_table + __NR_execve) = (unsigned long)custom_execve;
	make_ro((unsigned long)sys_call_table);

	return 0;
}

static void __exit test_exit(void)
{
	/* resume what it should be */
	make_rw((unsigned long)sys_call_table);
	*(sys_call_table + __NR_execve) = (unsigned long)real_execve;
	make_ro((unsigned long)sys_call_table);
}


module_init(test_init);
module_exit(test_exit);

SystemCallHooking.h

#ifndef HOOK_FUNCTION_PTR
#define HOOK_FUNCTION_PTR

/* copy from fs/exec.c */
struct user_arg_ptr {
	union {
		const char __user *const __user *native;
	} ptr;
};


#define SYS_CALL_TABLE_ADDR \
(unsigned long*)0xc16390a0

#define DO_EXECVE_ADDR \
(int (*)(const char *, const char __user *const __user *, const char __user *const __user *))0xc116b330

#define DO_EXECVE_COMMON_ADDR \
(int (*)(const char *, struct user_arg_ptr argv, struct user_arg_ptr envp))0xc116b080

#define PUTNAME_ADDR \
(void (*)(struct filename *))0xc1171cc0

#endif