Re: How to hook the system call?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

On Wed, Nov 23, 2011 at 10:40 AM, Geraint Yang <geraint0923@xxxxxxxxx> wrote:
> Hello everyone,
> I am going to hook a system call like 'read' or 'send' by modifying the
> sys_call_table, but it seems that the sys_call_table is in read only page,
> how can I set modify the sys_call_table ? Or if there any method that I can
> use to hook a system call in module without modify the kernel source?
> Thanks!

On a 2.6.35 kernel, it worked for me just by changing an entry in the
sys_call_table, within a kernel module.  Something like this:

old_sys_calls[sys_call] = sys_call_table[sys_call];
sys_call_table[sys_call] = interceptor;
is_intercepted[sys_call] = 1;

asmlinkage long interceptor(struct syscall_params sp)
        long sys_call=sp.eax, r=0;
        r = old_sys_calls[sys_call](sp);
        return r;

Alexandru Juncu

Kernelnewbies mailing list

[Newbies FAQ]     [Linux Kernel Mentors]     [Linux Kernel Development]     [IETF Annouce]     [Git]     [Networking]     [Security]     [Bugtraq]     [Photo]     [Yosemite]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux Networking]     [Linux RAID]     [Linux SCSI]     [Linux ACPI]

Add to Google Powered by Linux