日本免费全黄少妇一区二区三区-高清无码一区二区三区四区-欧美中文字幕日韩在线观看-国产福利诱惑在线网站-国产中文字幕一区在线-亚洲欧美精品日韩一区-久久国产精品国产精品国产-国产精久久久久久一区二区三区-欧美亚洲国产精品久久久久

  1. 首頁 > 云知道 > >

通過讀取/dev/mem檢查系統(tǒng)調(diào)用是否被替換

云知道

/*利用這段代碼可以看看前面的newhide.c和newjmp.c之間的區(qū)別.

你會發(fā)現(xiàn)newjmp.c的方法沒有辦法通過這段代碼檢查出來*/

#include
#include
#include
#include
#include
#include
#include
#include
struct call{

char *name;

unsigned int num;

};

struct call all_call[]={/*可以自己加想要check的調(diào)用*/

{"fork",2},

{"read",3},

{"write",4},

{"open",5},

{"close",6},

{"kill", 37},

{"getdirentrIEs",196},

{"__sysctl",202},

{NULL},



};

int main(int argc,char ** argv)

{

/*看不懂那些kvm函數(shù)時請man kvm*/

int i=0;

kvm_t *kd;

char errbuf[_POSIX2_LINE_MAX];

struct nlist nl[]={{NULL},{NULL},{NULL},};

struct sysent sysent_call;

unsigned int callnum;

unsigned int addr;

nl[0].n_name="sysent";

if(argc>=3)

{

/*check單個系統(tǒng)調(diào)用

usage: ./checkcall name id (fix)*/

nl[1].n_name=argv[1];

callnum=atoi(argv[2]);

kd=kvm_openfiles(NULL,NULL,NULL,O_RDWR,errbuf);

if(kd<0)

{

printf("error is:%sn",errbuf);

exit(-1);

}

if(kvm_nlist(kd,nl)<0)

{

printf("error is %sn",kvm_geterr(kd));

exit(-1);

}

if(!nl[1].n_value)

{

printf("%s is not foundn",nl[1].n_name);

exit(-1);

}

addr =nl[0].n_value callnum*sizeof(struct sysent);

kvm_read(kd,addr,&sysent_call,sizeof(struct sysent));

printf("sysent[=] is begin at 0x%x and the function addr is at 0x%xn",callnum,addr,sysent_call.sy_call );

if((u_int32_t)sysent_call.sy_call!=nl[1].n_value)

printf("ALERT!! the function %s should be 0x%xn",nl[1].n_name,nl[1].n_value);

if(argv[3]&&!strcmp(argv[3],"fix"))

{

(u_int32_t)sysent_call.sy_call=nl[1].n_value;

printf("begin to fix itn");

kvm_write(kd,addr,&sysent_call,sizeof(struct sysent));

}



}

else

{

/*不加參數(shù)check all_call數(shù)組里面的系統(tǒng)調(diào)用*/

printf("will check all calln");

while(all_call[i].name)

{



i;

nl[1].n_name=all_call[i-1].name;

callnum=all_call[i-1].num;

kd=kvm_openfiles(NULL,NULL,NULL,O_RDONLY,errbuf);

if (kd<0)

{

printf("the %d error is:%sn",i,errbuf);

continue;

}

if(kvm_nlist(kd,nl)<0)

{

printf("error is %sn",kvm_geterr(kd));

continue;

}

if(!nl[1].n_value)

{

printf("%s is not foundn",nl[1].n_name);

continue;

}

addr =nl[0].n_value callnum*sizeof(struct sysent);

kvm_read(kd,addr,&sysent_call,sizeof(struct sysent));

printf("sysent[=] is begin at 0x%x the function addr is at 0x%xn",callnum,addr,sysent_call.sy_call );

if((u_int32_t)sysent_call.sy_call!=nl[1].n_value)

printf("ALERT!! the function %s should be 0x%xn",nl[1].n_name,nl[1].n_value);

nl[1].n_name=NULL;

nl[1].n_value=https://www.rkxy.com.cn/dnjc/NULL;

}
}

return 0;

}

    推薦閱讀