Hooking interrupt descriptor table Hook interrupt descriptor table

Hooking interrupt table is very interesting thing with it you can dissallow some operations to be made or watch what happening in system. This article is more like review and more tehnical description is in link 1

First thing that we should know that it will done trought kernel module there is 2 commands for loading and unloading modules

insmod

and

rmmod

there is way how we can check system call addresses and position of syscall table

grep sys_call_table /proc/kallsyms

grep system_call /proc/kallsyms

also we can use it for detecting our module functions and syscall addreses

grep sys_write /proc/kallsyms

or if we whant check out module functions

grep hook_idt /proc/kallsyms

We will now try to hook sys_mkdir. I usualy using some minimalistic windowmanagers but some browsers or other GUIsh programs like such directories "Download" or "Desktop" all my directories in ~/ is lowercase and I realy hate anoying "Download" and "Desktop" directories that are made without my permission and for my lowercase /home directory style is agly. With this hook they will be denied to make such thing.

Out kernel module consist of such functions:

static int __init hook_init(void) //stufff on module init,idt hooking
static void __exit hook_exit(void) //stuff on module exit, restore idt table

asmlinkage long hooked_mkdir(const char *filename, mode_t mode) //our hook function

//how works this functions you can find in link number 1 
void *get_writable_sct(void *sct_addr)
void *get_syscall_table(void)

Basic hooked function is:

asmlinkage long hooked_mkdir(const char *filename, mode_t mode)
{
    return mkdir(filename, mode);
}

but now we need to add check for ("Desktop","Download"). First we need some error that will returned when some one whant to make bad directory we will use EACCES error.

here is modified functions for out task:

//hook mkfile command
asmlinkage long hooked_mkdir(const char *filename, mode_t mode)
{
    //it will disallow all files that starts with Desktop&&Download
    if (((strncmp(filename,"Desktop",7) == 0) && (strlen(filename) == 7)) ||
        ((strncmp(filename,"Download",8) == 0) && (strlen(filename) == 8)))
    {
        printk(KERN_INFO "Mkdir hook\n");
        return EACCES;
    }
    return real_mkdir(filename, mode);
}

For module compiling:

make

This is tested with kernel version 2.6.38

Links

http://codenull.net/articles/kmh_en.html
http://www.gadgetweb.de/linux/40-how-to-hijacking-the-syscall-table-on-latest-26x-kernel-systems.html

Downloads

hook_idt.zip - 5KiB - http://archive.main.lv/files/writeup/hooking_interrupt_descriptor_table/hook_idt.zip