-
Notifications
You must be signed in to change notification settings - Fork 0
/
hijack.c
101 lines (55 loc) · 1.37 KB
/
hijack.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
#include <linux/slab.h>
#include <linux/preempt.h>
#include "hijack.h"
#include "mantis.h"
inline unsigned long disable_wp(void)
{
unsigned long cr0;
preempt_disable();
barrier();
cr0 = read_cr0();
write_cr0(cr0 & ~X86_CR0_WP);
return cr0;
}
inline void restore_wp(unsigned long cr0)
{
write_cr0(cr0);
barrier();
preempt_enable();
}
ksym_hook_t *ksym_hook_init(void *target, void* hook) {
ksym_hook_t *h;
if (!(h = kmalloc(sizeof(h), GFP_KERNEL))) {
DEBUG("Could not alloc new ksym_hook_t\n");
return NULL;
}
memcpy(h->hooked, JUMP_CODE, JUMP_SIZE);
memcpy(h->original, target, JUMP_SIZE);
*(unsigned long*)&h->hooked[JUMP_OFFSET] = (unsigned long)hook;
h->addr = target;
h->is_hooked = false;
return h;
}
void ksym_hook(ksym_hook_t *hook) {
unsigned long cr0;
if (!hook || hook->is_hooked) {
return;
}
cr0 = disable_wp();
memcpy(hook->addr, hook->hooked, JUMP_SIZE);
restore_wp(cr0);
hook->is_hooked = true;
}
void ksym_unhook(ksym_hook_t *hook) {
unsigned long cr0;
if (!hook || !hook->is_hooked) {
return;
}
cr0 = disable_wp();
memcpy(hook->addr, hook->original, JUMP_SIZE);
restore_wp(cr0);
hook->is_hooked = false;
}
void *ksym_get_addr(ksym_hook_t *hook) {
return hook->addr;
}