From 389cc1ba8d9e673f1313fd966820c6d9d463525f Mon Sep 17 00:00:00 2001 From: 0xwille Date: Tue, 12 Jul 2011 20:51:00 +0200 Subject: Añadido pid --- Makefile | 9 ------- cr0.c | 22 ---------------- lists.c | 41 ----------------------------- lists/Makefile | 7 +++++ lists/lists.c | 41 +++++++++++++++++++++++++++++ pid/Makefile | 7 +++++ pid/pid.c | 34 ++++++++++++++++++++++++ syscall.c | 77 ------------------------------------------------------- syscall/Makefile | 7 +++++ syscall/syscall.c | 77 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 10 files changed, 173 insertions(+), 149 deletions(-) delete mode 100644 Makefile delete mode 100644 cr0.c delete mode 100644 lists.c create mode 100644 lists/Makefile create mode 100644 lists/lists.c create mode 100644 pid/Makefile create mode 100644 pid/pid.c delete mode 100644 syscall.c create mode 100644 syscall/Makefile create mode 100644 syscall/syscall.c diff --git a/Makefile b/Makefile deleted file mode 100644 index f314971..0000000 --- a/Makefile +++ /dev/null @@ -1,9 +0,0 @@ -#obj-m += syscall.o -#obj-m += cr0.o -obj-m += lists.o - -all: - make -C /lib/modules/$(shell uname -r)/build M=$(PWD) modules - -clean: - make -C /lib/modules/$(shell uname -r)/build M=$(PWD) clean diff --git a/cr0.c b/cr0.c deleted file mode 100644 index 9265d61..0000000 --- a/cr0.c +++ /dev/null @@ -1,22 +0,0 @@ -#include -#include -#include - -int init_module(void) -{ - int cr0 = native_read_cr0(); - printk(KERN_INFO "cr0 before: %x\n", cr0); - cr0 = cr0 >> 1; - cr0 = cr0 << 1; - native_write_cr0(cr0); - cr0 = native_read_cr0(); - printk(KERN_INFO "cr0 after: %x\n", cr0); - return 0; -} - -void cleanup_module(void) -{ - printk(KERN_INFO "cr0 unloaded\n"); -} - -MODULE_LICENSE("GPL"); diff --git a/lists.c b/lists.c deleted file mode 100644 index 2eee70c..0000000 --- a/lists.c +++ /dev/null @@ -1,41 +0,0 @@ -#include -#include - -#define LENGTH 5 - -struct node { - struct list_head l; - int dato; -}; - -int init_module(void) -{ - int i; - struct node head, aux[LENGTH], *aux2; - struct list_head* iter; - - INIT_LIST_HEAD(&head.l); - head.dato = 666; - - for (i = 0; i < LENGTH; i++) { - aux[i].dato = i; - - list_add_tail(&aux[i].l, &head.l); - } - - list_for_each(iter, &head.l) { - aux2 = list_entry(iter, struct node, l); - printk(KERN_INFO "%d", aux2->dato); - } - - printk(KERN_INFO "Por cierto, en 0x0 hay: %d", ((struct node *)0)->dato); - - return 0; -} - -void cleanup_module(void) -{ -} - -MODULE_AUTHOR("Guillermo Ramos"); -MODULE_LICENSE("GPL"); diff --git a/lists/Makefile b/lists/Makefile new file mode 100644 index 0000000..813420c --- /dev/null +++ b/lists/Makefile @@ -0,0 +1,7 @@ +obj-m += lists.o + +all: + make -C /lib/modules/$(shell uname -r)/build M=$(PWD) modules + +clean: + make -C /lib/modules/$(shell uname -r)/build M=$(PWD) clean diff --git a/lists/lists.c b/lists/lists.c new file mode 100644 index 0000000..2eee70c --- /dev/null +++ b/lists/lists.c @@ -0,0 +1,41 @@ +#include +#include + +#define LENGTH 5 + +struct node { + struct list_head l; + int dato; +}; + +int init_module(void) +{ + int i; + struct node head, aux[LENGTH], *aux2; + struct list_head* iter; + + INIT_LIST_HEAD(&head.l); + head.dato = 666; + + for (i = 0; i < LENGTH; i++) { + aux[i].dato = i; + + list_add_tail(&aux[i].l, &head.l); + } + + list_for_each(iter, &head.l) { + aux2 = list_entry(iter, struct node, l); + printk(KERN_INFO "%d", aux2->dato); + } + + printk(KERN_INFO "Por cierto, en 0x0 hay: %d", ((struct node *)0)->dato); + + return 0; +} + +void cleanup_module(void) +{ +} + +MODULE_AUTHOR("Guillermo Ramos"); +MODULE_LICENSE("GPL"); diff --git a/pid/Makefile b/pid/Makefile new file mode 100644 index 0000000..b9e7cfd --- /dev/null +++ b/pid/Makefile @@ -0,0 +1,7 @@ +obj-m += pid.o + +all: + make -C /lib/modules/$(shell uname -r)/build M=$(PWD) modules + +clean: + make -C /lib/modules/$(shell uname -r)/build M=$(PWD) clean diff --git a/pid/pid.c b/pid/pid.c new file mode 100644 index 0000000..b930fe6 --- /dev/null +++ b/pid/pid.c @@ -0,0 +1,34 @@ +#include +#include +#include +#include + +static char modname[] = "pid.ko"; +static struct task_struct *mytask; +static struct task_struct *parent; + +static int __init init(void) +{ + mytask = current; + printk(KERN_ALERT "%s loaded by %s (%d)\n", + modname, mytask->comm, mytask->pid); + parent = mytask->parent; + while (mytask->pid != parent->pid) { + printk(KERN_ALERT "current: %s (%d) - parent: %s (%d)\n", + mytask->comm, mytask->pid, parent->comm, parent->pid); + mytask = mytask->parent; + parent = mytask->parent; + } + + return 0; +} + +static void __exit exit(void) +{ + printk(KERN_ALERT "%s unloaded\n", modname); +} + +module_init(init); +module_exit(exit); + +MODULE_LICENSE("GPL"); diff --git a/syscall.c b/syscall.c deleted file mode 100644 index 8decf5c..0000000 --- a/syscall.c +++ /dev/null @@ -1,77 +0,0 @@ -#include -#include -#include -#include -#include -#include -#include - -extern void* sys_call_table[]; - -static int uid; -module_param(uid, int, 0644); - -//extern asmlinkage long (*sys_open) (const char __user *filename, int flags, int mode); - -asmlinkage int (*original_call) (const char*, int, int); - -asmlinkage int our_sys_open(const char* filename, int flags, int mode) -{ - int i = 0; - char ch; - - if (uid == current->cred->uid) { - printk("Opened file by %d: ", uid); - do { - get_user(ch, filename + i++); - printk("%c", ch); - } while (ch != 0); - printk("\n"); - } - - return original_call(filename, flags, mode); -} - -//unsigned long** find_sys_call_table(void) -//{ -// unsigned long** sctable; -// unsigned long ptr; -// -// extern int loops_per_jiffy; -// -// sctable = NULL; -// for (ptr = (unsigned long)&loops_per_jiffy; -// ptr < (unsigned long)&boot_cpu_data; ptr += sizeof(void*)) { -// unsigned long *p; -// p = (unsigned long*)ptr; -// if (p[__NR_open] == (unsigned long) sys_open) { -// sctable = (unsigned long**)p; -// return sctable; -// } -// } -// -// return sctable; -//} - -int init_module(void) -{ - original_call = sys_call_table[__NR_open]; - sys_call_table[__NR_open] = our_sys_open; - - printk(KERN_INFO "Spying on uid: %d\n", uid); -// printk(KERN_INFO "sys_call_table[__NR_open] = %p\n", find_sys_call_table()[__NR_open]); - - return 0; -} - -void cleanup_module(void) -{ - if (sys_call_table[__NR_open] != our_sys_open) { - printk(KERN_ALERT "Somebody else also played with the open syscall\n"); - printk(KERN_ALERT "The system may be left in an unstable state\n"); - } - - sys_call_table[__NR_open] = original_call; -} - -MODULE_LICENSE("GPL"); diff --git a/syscall/Makefile b/syscall/Makefile new file mode 100644 index 0000000..332678d --- /dev/null +++ b/syscall/Makefile @@ -0,0 +1,7 @@ +obj-m += syscall.o + +all: + make -C /lib/modules/$(shell uname -r)/build M=$(PWD) modules + +clean: + make -C /lib/modules/$(shell uname -r)/build M=$(PWD) clean diff --git a/syscall/syscall.c b/syscall/syscall.c new file mode 100644 index 0000000..8decf5c --- /dev/null +++ b/syscall/syscall.c @@ -0,0 +1,77 @@ +#include +#include +#include +#include +#include +#include +#include + +extern void* sys_call_table[]; + +static int uid; +module_param(uid, int, 0644); + +//extern asmlinkage long (*sys_open) (const char __user *filename, int flags, int mode); + +asmlinkage int (*original_call) (const char*, int, int); + +asmlinkage int our_sys_open(const char* filename, int flags, int mode) +{ + int i = 0; + char ch; + + if (uid == current->cred->uid) { + printk("Opened file by %d: ", uid); + do { + get_user(ch, filename + i++); + printk("%c", ch); + } while (ch != 0); + printk("\n"); + } + + return original_call(filename, flags, mode); +} + +//unsigned long** find_sys_call_table(void) +//{ +// unsigned long** sctable; +// unsigned long ptr; +// +// extern int loops_per_jiffy; +// +// sctable = NULL; +// for (ptr = (unsigned long)&loops_per_jiffy; +// ptr < (unsigned long)&boot_cpu_data; ptr += sizeof(void*)) { +// unsigned long *p; +// p = (unsigned long*)ptr; +// if (p[__NR_open] == (unsigned long) sys_open) { +// sctable = (unsigned long**)p; +// return sctable; +// } +// } +// +// return sctable; +//} + +int init_module(void) +{ + original_call = sys_call_table[__NR_open]; + sys_call_table[__NR_open] = our_sys_open; + + printk(KERN_INFO "Spying on uid: %d\n", uid); +// printk(KERN_INFO "sys_call_table[__NR_open] = %p\n", find_sys_call_table()[__NR_open]); + + return 0; +} + +void cleanup_module(void) +{ + if (sys_call_table[__NR_open] != our_sys_open) { + printk(KERN_ALERT "Somebody else also played with the open syscall\n"); + printk(KERN_ALERT "The system may be left in an unstable state\n"); + } + + sys_call_table[__NR_open] = original_call; +} + +MODULE_LICENSE("GPL"); -- cgit v1.2.3