0

I am trying to set the sys exit call to a variable by

extern void *sys_call_table[];
real_sys_exit = sys_call_table[__NR_exit]

however, when I try to make, the console gives me the error

error: ‘__NR_exit’ undeclared (first use in this function)

Any tips would be appreciated :) Thank you

Tom
  • 43,810
  • 29
  • 138
  • 169
hwrd
  • 2,134
  • 6
  • 29
  • 36

2 Answers2

5

Since you are in kernel 2.6.x , sys_call_table isnt exported any more. If you want to avoid the compilation error try this include

#include<linux/unistd.h>

however, It will not work. So the work around to "play" with the sys_call_table is to find the address of sys_call_table in SystemXXXX.map (located at /boot) with this command:

grep sys_call System.map-2.6.X -i

this will give the addres, then this code should allow you to modify the table:

unsigned long *sys_call_table; 
sys_call_table = (unsigned long *) simple_strtoul("0xc0318500",NULL,16); 


original_mkdir = sys_call_table[__NR_mkdir];
sys_call_table[__NR_mkdir] = mkdir_modificado;

Hope it works for you, I have just tested it under kernel 2.6.24, so should work for 2.6.18

also check here, Its a very good http://commons.oreilly.com/wiki/index.php/Network_Security_Tools/Modifying_and_Hacking_Security_Tools/Fun_with_Linux_Kernel_Modules

llazzaro
  • 3,970
  • 4
  • 33
  • 47
  • 1
    ... why are you using `strtoul` on a static value? Why not just use a literal `0xc0318500`? Also, this will fail on a relocatable kernel. – bdonlan Jan 12 '12 at 21:17
2

If you haven't included the file syscall.h, you should do that ahead of the reference to __NR_exit. For example,

#include <syscall.h>
#include <stdio.h>

int main()
{
    printf("%d\n", __NR_exit);
    return 0;
}

which returns:

$ cc t.c
$ ./a.out 
60

Some other observations:

  1. If you've already included the file, the usual reasons __NR_exit wouldn't be defined are that the definition was being ignored due to conditional compilation (#ifdef or #ifndef at work somewhere) or because it's being removed elsewhere through a #undef.

  2. If you're writing the code for kernel space, you have a completely different set of headers to use. LXR (http://lxr.linux.no/linux) searchable, browsable archive of the kernel source is a helpful resource.

Andre Stechert
  • 214
  • 1
  • 4
  • i have, and actually for some reason its actually linux/syscalls.h in this kernel version... :( maybe i got that wrong? – hwrd Oct 19 '09 at 02:08
  • Sorry about the unhelpful answer. I have to guess a lot about your compilation environment to answer the question. E.g., I still don't know: what version of the linux kernel, what compiler version, compiler flags, whether the code is for cross-compiling, and whether you're trying to compile a kernel module or something for user-space. Can you provide any other information about your project? – Andre Stechert Oct 19 '09 at 15:33
  • Its linux kernel 2.6.18 Compiling with Makefile (gcc dunno what version) obj-m += file.c Making a kernel module to intercept syscalls. I looked at the lxr, and it listed a bunch of syscall.h for my linux version, but its a patched kernel, so I may just need to ask my professor. I tried a few of the headers from the lxr, and they were either missing, for the wrong architecture, or just didn't work. – hwrd Oct 19 '09 at 17:59