<br><br><div class="gmail_quote">On Wed, Nov 23, 2011 at 3:57 PM, Alexandru Juncu <span dir="ltr"><<a href="mailto:alex.juncu@rosedu.org">alex.juncu@rosedu.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div class="im">On Wed, Nov 23, 2011 at 12:10 PM, Daniel Baluta <<a href="mailto:daniel.baluta@gmail.com">daniel.baluta@gmail.com</a>> wrote:<br>
> On Wed, Nov 23, 2011 at 11:22 AM, Alexandru Juncu <<a href="mailto:alex.juncu@rosedu.org">alex.juncu@rosedu.org</a>> wrote:<br>
>> On Wed, Nov 23, 2011 at 10:40 AM, Geraint Yang <<a href="mailto:geraint0923@gmail.com">geraint0923@gmail.com</a>> wrote:<br>
>>> Hello everyone,<br>
>>><br>
>>> I am going to hook a system call like 'read' or 'send' by modifying the<br>
>>> sys_call_table, but it seems that the sys_call_table is in read only page,<br>
>>> how can I set modify the sys_call_table ? Or if there any method that I can<br>
>>> use to hook a system call in module without modify the kernel source?<br>
>>><br>
>>> Thanks!<br>
>><br>
>> On a 2.6.35 kernel, it worked for me just by changing an entry in the<br>
>> sys_call_table, within a kernel module. Something like this:<br>
><br>
> Alex,<br>
> I am pretty sure that you are using a hacked version of 2.6.35.<br>
><br>
> Geraint,<br>
> In order to be able to hook a syscall you must do the following:<br>
><br>
> 1. export syscall_table in arch/x86/kernel/i386_ksyms_32.c<br>
><br>
> extern void* sys_call_table[];<br>
> EXPORT_SYMBOL(sys_call_table);<br>
><br>
> 2. make sys_call_table writebale. In arch/x86/kernel/entry_32.S<br>
> you must have:<br>
><br>
> .section .data,"a"<br>
> #include "syscall_table_32.S"<br>
><br>
> thanks,<br>
> Daniel.<br>
><br>
<br>
</div>Ah, Daniel is right... I forgot about that part...<br>
<div><div></div><div class="h5"><br>
_______________________________________________<br>
Kernelnewbies mailing list<br>
<a href="mailto:Kernelnewbies@kernelnewbies.org">Kernelnewbies@kernelnewbies.org</a><br>
<a href="http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies" target="_blank">http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies</a><br>
</div></div></blockquote></div><br><div>You can get the address of the sys_call_table from the /proc/kallsyms and regarding the read-only section of the this symbol you can re-map the addresses by making use of vmap api in kernel. This will avoid the need for the compilation of the kernel. But I would not recommend you to do this. Their is LSM framework specifically available for this try to see if you can make use of that.</div>
<div><br></div><div>Regards,</div><div>Rohan Puri</div>