🚀 go-pugleaf

hola gente.

estaba intentando jugar con las
syscall asi que me arme un modulo precario.
encontrar la sys_call_table fue lo que
mas me costo, por suerte encontre un ejemplo.

ptracehook.c
/*
 * PTrace access control module.
 * 
 *
 https://listas.hispalinux.es/pipermail/
\nucleo-desarrollo/2003-February/000001.html
 *
 https://listas.hispalinux.es/pipermail/\
nucleo-desarrollo/2004-August/000501.html
 *
 *
 */

#include <linux/kernel.h>
#include <linux/module.h> 

#include <linux/syscalls.h>
#include <asm/unistd.h>

MODULE_AUTHOR("eldani ...");
MODULE_DESCRIPTION("Limits ptrace() syscall access.");
MODULE_LICENSE("GPL");

#define GID 4

int (*o_ptrace)(int, int, int *, int *);

unsigned long **sys_call_table;


extern void *get_system_call(void);
extern void *get_sys_call_table(void *system_call);

unsigned long **locate_sys_call_table(void)
{
	void *s_call;
	s_call = get_system_call();
	sys_call_table = get_sys_call_table(s_call);
	return(sys_call_table);
}

int my_ptrace(int request, int pid, void *addr, void *data)
{
	int returnvalue;

	returnvalue = ( ( current->uid == 0 ) || ( current->gid == GID ) ) \
		      ? (*o_ptrace)(request, pid, addr, data) : -1;
	
	return(returnvalue);
}

int __init init_module()
{
	sys_call_table = locate_sys_call_table();
	o_ptrace = (void *) sys_call_table[__NR_ptrace];
	sys_call_table[__NR_ptrace] =  (void *) my_ptrace;

	printk("ptrace hook loaded correctly\n");
	return(0);
}

void __exit cleanup_module()
{
	sys_call_table[__NR_ptrace] = (void *) o_ptrace;
	printk("ptrace hook removed\n");
}


get_table.c:

/*
 * http://www.enye-sec.org/textos/\
lkm.rootkits.en.linux.x86.v2.6.txt
 */
#include <linux/types.h>
#include <linux/stddef.h>
#include <linux/unistd.h>
#include <linux/config.h>
#include <linux/module.h>
#include <linux/version.h>
#include <linux/kernel.h>
#include <linux/string.h>
#include <linux/mm.h>
#include <linux/slab.h>
#include <linux/sched.h>
#include <linux/in.h>
#include <linux/skbuff.h>
#include <linux/netdevice.h>
#include <linux/dirent.h>
#include <asm/processor.h>
#include <asm/uaccess.h>
#include <asm/unistd.h>

#define __NO_VERSION__


void *get_system_call(void);
void *get_sys_call_table(void *system_call);

struct idt_descriptor
{
	unsigned short off_low;
	unsigned short sel;
	unsigned char none, flags;
	unsigned short off_high;
};

void *get_system_call(void)
{
	unsigned char idtr[6];
	unsigned long base;
	struct idt_descriptor desc;

	asm ("sidt %0" : "=m" (idtr));
	base = *((unsigned long *) &idtr[2]);
	memcpy(&desc, (void *) (base + (0x80*8)), sizeof(desc));

	return((void *) ((desc.off_high << 16) + desc.off_low));
}

void *get_sys_call_table(void *system_call)
{
	unsigned char *p;
	unsigned long s_c_t;
	int count = 0;

	p = (unsigned char *) system_call;

	while (!((*p == 0xff) && (*(p+1) == 0x14) && (*(p+2) == 0x85)))
	{
		p++;

		if (count++ > 500)
		{
			count = -1;
			break;
		}
	}

	if (count != -1)
	{
		p += 3;
		s_c_t = *((unsigned long *) p);
	}
	else
		s_c_t = 0;

	return((void *) s_c_t);
}



links...
el que quiera bajarlo: http://lhsdg.110mb.com/phook.tgz

saludos ;)