当前位置： 首页 > article >正文

linux kernel 5.0 inline hook框架

article 2025/1/10 14:02:58

github:https://github.com/WeiJiLab/kernel-hook-framework

一、项目介绍

Usually we want to hack a kernel function,

  • to insert customized code before or after a certain kernel function been called, or

  • to totally replace a function with new one.

How can we manage that? Well it’s time to bring inline hook technique to kernel space. By replacing the first few instructions of a specific function to conditionless jump, and store the original instructions to a trampoline function, we can customizing the functions calling, and do whatever we want do in the hook function. Isn’t is exciting?

二、代码结构

  • src/
    The hook framework itself. In normal cases, you needn’t modify its code, unless you are trying to fix bug, because we want to keep it as simple and independent to any customization. After compile, you will get hookFrame.ko.

  • sample/
    The customized hook/replacement functions. Write your code here, and you can take hook_vfs_read.c, replace_vfs_open.c as reference when writing your own function. Also in module.c, you can get a general view of how to register your function to hook framework. After compile, hookFrameTest.ko will be generated.

root@curtis-Aspire-E5-471G:/home/curtis/code/kernel-hook-framework# tree ./
./
├── make_hook_frame.sh
├── readme.md
├── sample
│   ├── aftvermagic.sh
│   ├── hook_fuse_open.c
│   ├── hook_vfs_read.c
│   ├── include
│   │   ├── common_data.h
│   │   ├── hijack_arm64.h
│   │   ├── hijack_arm.h
│   │   ├── hijack_x86_64.h
│   │   ├── hijack_x86.h
│   │   └── hook_framework.h
│   ├── Makefile
│   ├── module.c
│   ├── prevermagic.sh
│   └── replace_vfs_open.c
└── src
    ├── aftvermagic.sh
    ├── arch
    │   ├── arm
    │   │   ├── hijack_arm.c
    │   │   └── hijack_arm.h
    │   ├── arm64
    │   │   ├── hijack_arm64.c
    │   │   └── hijack_arm64.h
    │   ├── x86
    │   │   ├── common.c -> ../x86_64/common.c
    │   │   ├── distorm -> ../x86_64/distorm
    │   │   ├── hijack_x86.c
    │   │   └── hijack_x86.h
    │   └── x86_64
    │       ├── common.c
    │       ├── distorm
    │       │   ├── config.h
    │       │   ├── decoder.c
    │       │   ├── decoder.h
    │       │   ├── distorm.c
    │       │   ├── distorm.h
    │       │   ├── instructions.c
    │       │   ├── instructions.h
    │       │   ├── insts.c
    │       │   ├── insts.h
    │       │   ├── mnemonics.c
    │       │   ├── mnemonics.h
    │       │   ├── operands.c
    │       │   ├── operands.h
    │       │   ├── prefix.c
    │       │   ├── prefix.h
    │       │   ├── textdefs.c
    │       │   ├── textdefs.h
    │       │   ├── wstring.h
    │       │   └── x86defs.h
    │       ├── hijack_x86_64.c
    │       └── hijack_x86_64.h
    ├── framework
    │   ├── hijack_operation.c
    │   ├── module.c
    │   ├── proc_interface.c
    │   ├── stack_safety_check.c
    │   ├── symbol_resolver.c
    │   ├── write_map_page.c
    │   └── write_page.c
    ├── include
    │   └── common_data.h
    ├── Makefile
    └── prevermagic.sh

三、编译测试

Sometimes you will find the vermagic of hookFrame.ko and hookFrameTest.ko different from your target kernel. You can pass the target kernel’s vermagic string to make:

  • 测试环境
root@curtis-Aspire-E5-471G:/home/curtis/code/kernel-hook-framework# uname -a
Linux curtis-Aspire-E5-471G 5.15.0-52-generic #58~20.04.1-Ubuntu SMP Thu Oct 13 13:09:46 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
root@curtis-Aspire-E5-471G:/home/curtis/code/kernel-hook-framework# lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 20.04.3 LTS
Release:        20.04
Codename:       focal
  • 测试代码编译
# install bbe to modify vermagic string within .ko
# bbe用来修改内核模块的vermagic字符串
root@curtis-Aspire-E5-471G:/home/curtis/code/kernel-hook-framework# apt-get install bbe

# 查看编译环境gcc版本
root@curtis-Aspire-E5-471G:~# gcc -v
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/usr/lib/gcc/x86_64-linux-gnu/9/lto-wrapper
OFFLOAD_TARGET_NAMES=nvptx-none:hsa
OFFLOAD_TARGET_DEFAULT=1
Target: x86_64-linux-gnu
.....

# 查看目标环境内核驱动vermagic
root@curtis-Aspire-E5-471G:/home/kmodule/kprobe_example# modinfo probe_example.ko
filename:       /home/curtis/write_code/kmodule/kprobe_example/probe_example.ko
license:        GPL
srcversion:     C2BF47FCD744ABC53E80FE1
depends:
retpoline:      Y
name:           probe_example
vermagic:       5.15.0-52-generic SMP mod_unload modversions
parm:           symbol:string

# 编译内核驱动，发现如果带vermagic将会错误修改/generated/utsrelease.h
root@curtis-Aspire-E5-471G:/home/kernel-hook-framework/sample# make x86_64 KDIR=/usr/lib/modules/5.15.0-52-generic/build CROSS_COMPILE=x86_64-linux-gnu- vermagic="5.15.0-52-generic SMP mod_unload modversions"

# 编译示例驱动
root@curtis-Aspire-E5-471G:/home/kernel-hook-framework/sample# make x86_64 KDIR=/usr/lib/modules/5.15.0-52-generic/build CROSS_COMPILE=x86_64-linux-gnu-
make ARCH=x86_64 CROSS_COMPILE=x86_64-linux-gnu- KBUILD_EXTRA_SYMBOLS=/home/curtis/code/kernel-hook-framework/sample/../src/Module.symvers EXTRA_CFLAGS="-D_ARCH_X86_64_ -I/home/curtis/code/kernel-hook-framework/sample/include -fno-pic" -C /usr/lib/modules/5.15.0-52-generic/build M=/home/curtis/code/kernel-hook-framework/sample modules
make[1]: Entering directory '/usr/src/linux-headers-5.15.0-52-generic'
warning: the compiler differs from the one used to build the kernel
  The kernel was built by: gcc (Ubuntu 9.4.0-1ubuntu1~20.04.1) 9.4.0
  You are using:           x86_64-linux-gnu-gcc (Ubuntu 9.4.0-1ubuntu1~20.04.1) 9.4.0
WARNING: Symbol version dump "/home/curtis/code/kernel-hook-framework/sample/../src/Module.symvers" is missing.
         Modules may not have dependencies or modversions.
         You may get many unresolved symbol warnings.
  CC [M]  /home/curtis/code/kernel-hook-framework/sample/hookFrameTest.mod.o
  LD [M]  /home/curtis/code/kernel-hook-framework/sample/hookFrameTest.ko
  BTF [M] /home/curtis/code/kernel-hook-framework/sample/hookFrameTest.ko
Skipping BTF generation for /home/curtis/code/kernel-hook-framework/sample/hookFrameTest.ko due to unavailability of vmlinux
make[1]: Leaving directory '/usr/src/linux-headers-5.15.0-52-generic'

# 编译hook framework
root@curtis-Aspire-E5-471G:/home/curtis/code/kernel-hook-framework/src# make x86_64 KDIR=/usr/lib/modules/5.15.0-52-generic/build CROSS_COMPILE=x86_64-linux-gnu-
make ARCH=x86_64 CROSS_COMPILE=x86_64-linux-gnu- EXTRA_CFLAGS="-D_ARCH_X86_64_ -I/home/curtis/code/kernel-hook-framework/src -I/home/curtis/code/kernel-hook-framework/src/arch/x86_64 -fno-pic -fno-stack-protector" -C /usr/lib/modules/5.15.0-52-generic/build M=/home/curtis/code/kernel-hook-framework/src modules
make[1]: Entering directory '/usr/src/linux-headers-5.15.0-52-generic'
warning: the compiler differs from the one used to build the kernel
  The kernel was built by: gcc (Ubuntu 9.4.0-1ubuntu1~20.04.1) 9.4.0
  You are using:           x86_64-linux-gnu-gcc (Ubuntu 9.4.0-1ubuntu1~20.04.1) 9.4.0
  ......
  LD [M]  /home/curtis/code/kernel-hook-framework/src/hookFrame.o
  MODPOST /home/curtis/code/kernel-hook-framework/src/Module.symvers
  CC [M]  /home/curtis/code/kernel-hook-framework/src/hookFrame.mod.o
  LD [M]  /home/curtis/code/kernel-hook-framework/src/hookFrame.ko
  BTF [M] /home/curtis/code/kernel-hook-framework/src/hookFrame.ko
Skipping BTF generation for /home/curtis/code/kernel-hook-framework/src/hookFrame.ko due to unavailability of vmlinux
make[1]: Leaving directory '/usr/src/linux-headers-5.15.0-52-generic'

尝试安装驱动试试看，有没有Hook成功。

# 安装hook框架
root@curtis-Aspire-E5-471G:/home/kernel-hook-framework/src# insmod hookFrame.ko
[23927.370331] Symbol save_stack_trace_tsk not found!
[23927.370348] Your kernel should be "CONFIG_STACKTRACE && !CONFIG_ARCH_STACKWALK", skip stack safety check and use as your risk!!!
[23927.373527] load hook framework success!

# 安装测试驱动，从结果来看已经Hook成功了
root@curtis-Aspire-E5-471G:/home/kernel-hook-framework/sample# insmod hookFrameTest.ko
[24036.218182] reading /usr/lib/modules/5.15.0-52-generic/modules.builtin.bin
[24036.218200] in replaced vfs_open
[24036.218206] reading /sys/module/hookFrameTest/initstate
[24036.218215] reading /sys/module/hookFrameTest/initstate
[24036.218224] in replaced vfs_open
[24036.218239] in replaced vfs_open
[24036.218244] reading /sys/module/hookFrameTest/refcnt
[24036.218250] reading /sys/module/hookFrameTest/refcnt
[24036.218537] all hijacked target disabled and removed
[24036.218542] unload hook framework test!

Hook成功了并打印了打开文件的绝对路径。
在这里插入图片描述

四、构建自己的Hook函数流程

  • 获取原函数地址
    在这里插入图片描述
  • 调用hijack_target_prepare和hijack_target_enable使能hook函数。
    在这里插入图片描述

http://www.kler.cn/a/1578.html

相关文章：

  • api开发如何在代码中使用京东商品详情接口的参数？
  • Flutter：封装一个自用的bottom_picker选择器
  • Ubuntu上安装Apache Spark
  • 2025新春烟花代码（二）HTML5实现孔明灯和烟花效果
  • 【实用技能】如何使用 .NET C# 中的 Azure Key Vault 中的 PFX 证书对 PDF 文档进行签名
  • 黄仁勋CES 2025演讲重点内容
  • Mysql常用命令
  • 尚融宝07-前端模块化
  • 2023年网络安全最应该看的书籍，弯道超车，拒绝看烂书
  • 【C++编译】gcc、gdb、make、cmake
  • 论文阅读和分析：Mathematical formula recognition using graph grammar
  • 线程安全(重点)
  • 202304读书笔记|《不被定义的女孩》——做最真实最漂亮的自己，依心而行
  • 2023秋招前端面试必会的面试题
  • 多层多输入的CNN-LSTM时间序列回归预测（卷积神经网络-长短期记忆网络）——附代码
  • STM32开发（九）STM32F103 通信 —— I2C通信编程详解
  • springcloud3 nacos，sentinel，ribbon，openfegin等整合案例4[fallback+blockhandler完美整合]
  • 基于深度学习的农作物叶片病害检测系统（UI界面+YOLOv5+训练数据集）
  • 门面设计模式
  • C#等高级语言运行过程
  • CSDN周赛第37期题解（Python版）
  • 近期投简历、找日常实习的一些碎碎念（大二---测试岗）
  • uboot主目录下Makefile文件的分析，以及配置过程分析
  • 【动态规划】最长上升子序列（单调队列、贪心优化）
  • 指针进阶(上)
  • 《世界棒球》：黑人联盟