Linux Kernel: System call hooking example

Question

I'm trying to write some simple test code as a demonstration of hooking the system call table.

"sys_call_table" is no longer exported in 2.6, so I'm just grabbing the address from the System.map file, and I can see it is correct (Looking through the memory at the address I found, I can see the pointers to the system calls).

However, when I try to modify this table, the kernel gives an "Oops" with "unable to handle kernel paging request at virtual address c061e4f4" and the machine reboots.

This is CentOS 5.4 running 2.6.18-164.10.1.el5. Is there some sort of protection or do I just have a bug? I know it comes with SELinux, and I've tried putting it in to permissive mode, but it doesn't make a difference

Here's my code:

#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/moduleparam.h>
#include <linux/unistd.h>

void **sys_call_table;

asmlinkage int (*original_call) (const char*, int, int);

asmlinkage int our_sys_open(const char* file, int flags, int mode)
{
   printk("A file was opened\n");
   return original_call(file, flags, mode);
}

int init_module()
{
    // sys_call_table address in System.map
    sys_call_table = (void*)0xc061e4e0;
    original_call = sys_call_table[__NR_open];

    // Hook: Crashes here
    sys_call_table[__NR_open] = our_sys_open;
}

void cleanup_module()
{
   // Restore the original call
   sys_call_table[__NR_open] = original_call;
}

Have you experimented with `LD_PRELOAD` or `ptrace`? Do they not satisfy what you are trying to do? — ezpz, Jan 20 '10 at 17:15
Not really, the purpose of the exercise is to load a kernel module that will hook a system call for the entire system. It doesn't really matter what it does at that point. — Stephen, Jan 20 '10 at 17:17
Please note that for teaching purposes it might be OK to look into this, but it has both technical and licensing problems. Don't use this in the real world! — robert.berger, Dec 07 '11 at 18:41
what could be use case of this code? Can I hook any linux system call this way? — Incerteza, Apr 15 '14 at 15:05
@Tyler, I was thinking the same thing. I assume OP is building his own kernel to generate the System map file anyway. — sherrellbc, Dec 28 '16 at 20:11

Stephen · Accepted Answer · 2010-01-20T18:17:24.600

I finally found the answer myself.

http://www.linuxforums.org/forum/linux-kernel/133982-cannot-modify-sys_call_table.html

The kernel was changed at some point so that the system call table is read only.

cypherpunk:

Even if it is late but the Solution may interest others too: In the entry.S file you will find: Code:
.section .rodata,"a"
#include "syscall_table_32.S"
sys_call_table -> ReadOnly You have to compile the Kernel new if you want to "hack" around with sys_call_table...

The link also has an example of changing the memory to be writable.

nasekomoe:

Hi everybody. Thanks for replies. I solved the problem long ago by modifying access to memory pages. I have implemented two functions that do it for my upper level code:

#include <asm/cacheflush.h>
#ifdef KERN_2_6_24
#include <asm/semaphore.h>
int set_page_rw(long unsigned int _addr)
{
    struct page *pg;
    pgprot_t prot;
    pg = virt_to_page(_addr);
    prot.pgprot = VM_READ | VM_WRITE;
    return change_page_attr(pg, 1, prot);
}

int set_page_ro(long unsigned int _addr)
{
    struct page *pg;
    pgprot_t prot;
    pg = virt_to_page(_addr);
    prot.pgprot = VM_READ;
    return change_page_attr(pg, 1, prot);
}

#else
#include <linux/semaphore.h>
int set_page_rw(long unsigned int _addr)
{
    return set_memory_rw(_addr, 1);
}

int set_page_ro(long unsigned int _addr)
{
    return set_memory_ro(_addr, 1);
}

#endif // KERN_2_6_24

Here's a modified version of the original code that works for me.

#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/moduleparam.h>
#include <linux/unistd.h>
#include <asm/semaphore.h>
#include <asm/cacheflush.h>

void **sys_call_table;

asmlinkage int (*original_call) (const char*, int, int);

asmlinkage int our_sys_open(const char* file, int flags, int mode)
{
   printk("A file was opened\n");
   return original_call(file, flags, mode);
}

int set_page_rw(long unsigned int _addr)
{
   struct page *pg;
   pgprot_t prot;
   pg = virt_to_page(_addr);
   prot.pgprot = VM_READ | VM_WRITE;
   return change_page_attr(pg, 1, prot);
}

int init_module()
{
    // sys_call_table address in System.map
    sys_call_table = (void*)0xc061e4e0;
    original_call = sys_call_table[__NR_open];

    set_page_rw(sys_call_table);
    sys_call_table[__NR_open] = our_sys_open;
}

void cleanup_module()
{
   // Restore the original call
   sys_call_table[__NR_open] = original_call;
}

Note that in the provided link, Linuxerlive claims that change_page_attr will not work for kernels > 2.6.24, because it's depriciated. — Stephen, Jan 20 '10 at 18:28
+1 for documenting the solution that you came to for others to see. — jgottula, Oct 24 '10 at 00:18
Note that when you call set_memory_rw() and the address is not page aligned, you'll get this: WARNING: at arch/x86/mm/pageattr.c:877 change_page_attr_set_clr+0x343/0x530() (Not tainted). I'm using 2.6.32, still working out a solution (as the memory still appears to be read-only after I call this on it). — Corey Henderson, Jul 18 '11 at 00:49
Awesome response to your own question. Very detailed. +1 fer sure. Cheers man. — A.Smith, Jul 06 '12 at 13:02

score 26 · Answer 2 · answered Jul 19 '11 at 03:47

Thanks Stephen, your research here was helpful to me. I had a few problems, though, as I was trying this on a 2.6.32 kernel, and getting WARNING: at arch/x86/mm/pageattr.c:877 change_page_attr_set_clr+0x343/0x530() (Not tainted) followed by a kernel OOPS about not being able to write to the memory address.

The comment above the mentioned line states:

// People should not be passing in unaligned addresses

The following modified code works:

int set_page_rw(long unsigned int _addr)
{
    return set_memory_rw(PAGE_ALIGN(_addr) - PAGE_SIZE, 1);
}

int set_page_ro(long unsigned int _addr)
{
    return set_memory_ro(PAGE_ALIGN(_addr) - PAGE_SIZE, 1);
}

Note that this still doesn't actually set the page as read/write in some situations. The static_protections() function, which is called inside of set_memory_rw(), removes the _PAGE_RW flag if:

It's in the BIOS area
The address is inside .rodata
CONFIG_DEBUG_RODATA is set and the kernel is set to read-only

I found this out after debugging why I still got "unable to handle kernel paging request" when trying to modify the address of kernel functions. I was eventually able to solve that problem by finding the page table entry for the address myself and manually setting it to writable. Thankfully, the lookup_address() function is exported in version 2.6.26+. Here is the code I wrote to do that:

void set_addr_rw(unsigned long addr) {

    unsigned int level;
    pte_t *pte = lookup_address(addr, &level);

    if (pte->pte &~ _PAGE_RW) pte->pte |= _PAGE_RW;

}

void set_addr_ro(unsigned long addr) {

    unsigned int level;
    pte_t *pte = lookup_address(addr, &level);

    pte->pte = pte->pte &~_PAGE_RW;

}

Finally, while Mark's answer is technically correct, it'll case problem when ran inside Xen. If you want to disable write-protect, use the read/write cr0 functions. I macro them like this:

#define GPF_DISABLE write_cr0(read_cr0() & (~ 0x10000))
#define GPF_ENABLE write_cr0(read_cr0() | 0x10000)

Hope this helps anyone else who stumbles upon this question.

Hi, with regard to your comment about Mark's answer, just curious: what's the problem it causes when ran inside Xen? — mrduclaw, Jul 19 '11 at 03:54
On the xen kernels I've tried, it causes a "general protection fault". If you'll notice, xen defines its own xen_write_cr0() function that doesn't disable write-protect, as the hypervisor handles that, and the guest OS doesn't have that sort of access to the CPU registers. — Corey Henderson, Jul 19 '11 at 04:11
Corey, thank you very much for sharing your findings...wish I could upvote 100 more times! — loopforever, Jul 25 '11 at 13:18
You can find it here: https://github.com/cormander/tpe-lkm/blob/319e1e29ea23055cca1c0a3bce3c865def14d3d2/hijacks.c Note that I have those functions twice, for different kernel versions. — Corey Henderson, Nov 26 '11 at 19:30
Thanks for the code, solved my problem. Why did you use `unsigned long` for the parameter addr. This causes a lot of warnings. I used `void**` as the type for the addr parameter. Is there a special reason for using `unsigned long`? — BitSchupser, Dec 19 '11 at 13:32
Memory addresses are unsigned long. I'm not getting any compiler warnings. — Corey Henderson, Dec 19 '11 at 15:47

score 21 · Answer 3 · edited Oct 24 '10 at 00:13

21

Note that the following will also work instead of using change_page_attr and cannot be depreciated:

static void disable_page_protection(void) {

    unsigned long value;
    asm volatile("mov %%cr0,%0" : "=r" (value));
    if (value & 0x00010000) {
            value &= ~0x00010000;
            asm volatile("mov %0,%%cr0": : "r" (value));
    }
}

static void enable_page_protection(void) {

    unsigned long value;
    asm volatile("mov %%cr0,%0" : "=r" (value));
    if (!(value & 0x00010000)) {
            value |= 0x00010000;
            asm volatile("mov %0,%%cr0": : "r" (value));
    }
}

edited Oct 24 '10 at 00:13

osgx

85,909
48
329
491

answered Oct 22 '10 at 21:01

mark

211
2
2

2

what kind of vodou is done here? what loa spirit is called by 0x00010000 spell? – osgx Jul 19 '11 at 18:05
8

@osgx `cr0` is a control register. The 16th bit controls page protection enforcement - toggle it and suddenly pages being "read only" no longer matters. You can do this in kernel space because the code is marked at privilege level (ring) 0. Normal programs cannot do this to themselves. So basically, turn off write protection, trample over "read only" memory, turn it back on again, voila. You can't deprecate this because it's part of the kernel design, being monolithic, that all modules run in ring 0. – Dec 14 '11 at 18:44
3

If you are going to do this you should disable interrupts, `cli`, before modifying `cr0` and reenable interrupts, `sti`, once you are done. See http://vulnfactory.org/blog/2011/08/12/wp-safe-or-not/ for details. – mttrb May 02 '13 at 02:46
Does modifying `cr0` in this way imply its acting on the current page? – sherrellbc Dec 28 '16 at 20:20
if you modify cr0 it counts for cpu, so all instrucitons on the cpu when its disabled will have these protections disabled regardless of the address. (https://en.wikipedia.org/wiki/Control_register) – user7296055 Jul 20 '17 at 19:19

Sebastian Mountaniol · Answer 4 · 2016-08-29T09:02:05.920

14

If you are dealing with kernel 3.4 and later (it can also work with earlier kernels, I didn't test it) I would recommend a smarter way to acquire the system callы table location.

For example

#include <linux/module.h>
#include <linux/kallsyms.h>

static unsigned long **p_sys_call_table;
/* Aquire system calls table address */
p_sys_call_table = (void *) kallsyms_lookup_name("sys_call_table");

That's it. No addresses, it works fine with every kernel I've tested.

The same way you can use a not exported Kernel function from your module:

static int (*ref_access_remote_vm)(struct mm_struct *mm, unsigned long addr,
                void *buf, int len, int write);
ref_access_remote_vm = (void *)kallsyms_lookup_name("access_remote_vm");

Enjoy!

edited Aug 29 '16 at 09:02

answered Aug 29 '16 at 08:51

Sebastian Mountaniol

510
4
8

Is it that kallsyms_lookup_name will search in both code and data segments ? – ransh Aug 28 '17 at 10:51
1

Hum, I thought this was only possible if you have `KALLSYMS_ALL=yes` in your `.config` when you compiled the kernel. I do not know if it works if you do not have the symbol present in `/proc/kallsyms`. – perror Oct 03 '17 at 15:05
1

Of all the answers on the Internet, only this worked for me! Copying the address of sys_call_table from System.map generates a page fault oops in Kernel. – skrtbhtngr Jan 21 '18 at 07:38

Linux Kernel: System call hooking example

4 Answers4

Linked

Related