Trying to hook a linux kernel system call

Question

I am trying to hook a system call from a linux kernel custom module.

The module loads but printk doesn't seem to print anything to dmesg from the new function.

#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/unistd.h>
#include <linux/kallsyms.h>

void **sys_call_table;

int (*original_call) (const char*, int, mode_t);

int our_sys_open(const char* file, int flags, mode_t mode)
{
   printk(KERN_INFO "A file was opened\n");

   return original_call(file, flags, mode);
}

void set_addr_rw(unsigned long addr)
{
    unsigned int level;
    pte_t *pte = lookup_address(addr, &level);

    if (pte->pte &~ _PAGE_RW) pte->pte |= _PAGE_RW;
}

void set_addr_ro(unsigned long addr)
{
    unsigned int level;
    pte_t *pte = lookup_address(addr, &level);

    pte->pte = pte->pte &~_PAGE_RW;
}

int init_module()
{
    printk("Loading custom module\n");

    sys_call_table = (void *) kallsyms_lookup_name("sys_call_table");
    original_call = sys_call_table[__NR_open];

    set_addr_rw((unsigned long) sys_call_table);
    sys_call_table[__NR_open] = our_sys_open;

    return 0;
}

void cleanup_module()
{
    printk("Unloading custom module\n");

    // Restore the original call
    sys_call_table[__NR_open] = original_call;

    set_addr_ro((unsigned long) sys_call_table);
}

MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("Simple Module");
MODULE_AUTHOR("OTO");
MODULE_VERSION("0.1");

I try opening/closing files on the system, but no trace in /var/log/kern.log.

My code is mostly based on the info from this thread.

EDIT: I can also give is the sys_call_table entry before and after module load:

crash> x/1g &sys_call_table[2]
0xffffffffb7c013b0:     0xffffffffb6eda7e0

After module load:

crash> x/1g &sys_call_table[2]
0xffffffffb7c013b0:     0xffffffffc06d508f

So, changes are actually taking place.

Try running `grep` for part of your `printk()` strings in the same directory. Any interesting output from running `dmesg`? Also can you view console output? — Milag, Sep 22 '20 at 18:52
grepping didn't give anything and ```dmesg``` and ```tail /var/log/kern.log``` give the same result: "Loading custom module" (from init_module) and nothing more. And, what do you mean by console output? — Otar Magaldadze, Sep 22 '20 at 19:10

score 0 · Accepted Answer · answered Sep 24 '20 at 12:28

Turned out I had to replace openat instead of open. And the way you do it is:

#include <linux/module.h>
#include <linux/kallsyms.h>
#include <asm/uaccess.h>
#include <linux/ratelimit.h>

MODULE_LICENSE("GPL");

asmlinkage int (*old_openat)(const struct pt_regs *);
static void **sys_call_table;

static asmlinkage long my_openat(const struct pt_regs *regs)
{
    printk_ratelimited("%s. proc:%s, pid:%d\n", __func__, current->group_leader->comm, current->tgid);

    return old_openat(regs);
}

void disable_write_protect(void)
{
    unsigned long value;
    asm volatile("mov %%cr0,%0" : "=r" (value));
    if (value & 0x00010000)
    {
        value &= ~0x00010000;
        asm volatile("mov %0,%%cr0": : "r" (value));
    }
}

void enable_write_protect(void)
{
    unsigned long value;
    asm volatile("mov %%cr0,%0" : "=r" (value));
    if (!(value & 0x00010000))
    {
        value |= 0x00010000;
        asm volatile("mov %0,%%cr0": : "r" (value));
    }
}

static int __init test_init(void)
{
    sys_call_table = (void *)kallsyms_lookup_name("sys_call_table");
    old_openat = sys_call_table[__NR_openat];

    printk("[info] %s. old_openat:0x%p\n", __func__, old_openat);

    disable_write_protect();
    sys_call_table[__NR_openat] = my_openat;
    enable_write_protect();

    printk("%s inserted.\n",__func__);

    return 0;
}

static void __exit test_exit(void)
{
    disable_write_protect();
    sys_call_table[__NR_openat] = old_openat;
    enable_write_protect();

    printk("%s removed.\n",__func__);
}

module_init(test_init);
module_exit(test_exit);

Trying to hook a linux kernel system call

1 Answers1