|
| 1 | +#include <linux/module.h> |
| 2 | +#include <linux/tty.h> |
| 3 | +#include <linux/miscdevice.h> |
| 4 | +#include "comm.h" |
| 5 | +#include "memory.h" |
| 6 | +#include "process.h" |
| 7 | +#include "verify.h" |
| 8 | + |
| 9 | +#define DEVICE_NAME "kernel_hack" |
| 10 | + |
| 11 | +int dispatch_open(struct inode *node, struct file *file) |
| 12 | +{ |
| 13 | + return 0; |
| 14 | +} |
| 15 | + |
| 16 | +int dispatch_close(struct inode *node, struct file *file) |
| 17 | +{ |
| 18 | + return 0; |
| 19 | +} |
| 20 | + |
| 21 | +long dispatch_ioctl(struct file* const file, unsigned int const cmd, unsigned long const arg) |
| 22 | +{ |
| 23 | + COPY_MEMORY cm; |
| 24 | + MODULE_BASE mb; |
| 25 | + char key[0x100] = {0}; |
| 26 | + char name[0x100] = {0}; |
| 27 | + static bool is_verified = false; |
| 28 | + |
| 29 | + if (cmd == OP_INIT_KEY && !is_verified) { |
| 30 | + if (copy_from_user(key, (void __user*)arg, sizeof(key)-1) != 0) { |
| 31 | + return -1; |
| 32 | + } |
| 33 | + is_verified = init_key(key, sizeof(key)); |
| 34 | + } |
| 35 | + if (is_verified == false) { |
| 36 | + return -1; |
| 37 | + } |
| 38 | + switch (cmd) { |
| 39 | + case OP_READ_MEM: |
| 40 | + { |
| 41 | + if (copy_from_user(&cm, (void __user*)arg, sizeof(cm)) != 0) { |
| 42 | + return -1; |
| 43 | + } |
| 44 | + if (read_process_memory(cm.pid, cm.addr, cm.buffer, cm.size) == false) { |
| 45 | + return -1; |
| 46 | + } |
| 47 | + } |
| 48 | + break; |
| 49 | + case OP_WRITE_MEM: |
| 50 | + { |
| 51 | + if (copy_from_user(&cm, (void __user*)arg, sizeof(cm)) != 0) { |
| 52 | + return -1; |
| 53 | + } |
| 54 | + if (write_process_memory(cm.pid, cm.addr, cm.buffer, cm.size) == false) { |
| 55 | + return -1; |
| 56 | + } |
| 57 | + } |
| 58 | + break; |
| 59 | + case OP_MODULE_BASE: |
| 60 | + { |
| 61 | + if (copy_from_user(&mb, (void __user*)arg, sizeof(mb)) != 0 |
| 62 | + || copy_from_user(name, (void __user*)mb.name, sizeof(name)-1) !=0) { |
| 63 | + return -1; |
| 64 | + } |
| 65 | + mb.base = get_module_base(mb.pid, name); |
| 66 | + if (copy_to_user((void __user*)arg, &mb, sizeof(mb)) !=0) { |
| 67 | + return -1; |
| 68 | + } |
| 69 | + } |
| 70 | + break; |
| 71 | + default: |
| 72 | + break; |
| 73 | + } |
| 74 | + return 0; |
| 75 | +} |
| 76 | + |
| 77 | +struct file_operations dispatch_functions = { |
| 78 | + .owner = THIS_MODULE, |
| 79 | + .open = dispatch_open, |
| 80 | + .release = dispatch_close, |
| 81 | + .unlocked_ioctl = dispatch_ioctl, |
| 82 | +}; |
| 83 | + |
| 84 | +struct miscdevice misc = { |
| 85 | + .minor = MISC_DYNAMIC_MINOR, |
| 86 | + .name = DEVICE_NAME, |
| 87 | + .fops = &dispatch_functions, |
| 88 | +}; |
| 89 | + |
| 90 | +int __init driver_entry(void) |
| 91 | +{ |
| 92 | + int ret; |
| 93 | + printk("[+] driver_entry"); |
| 94 | + ret = misc_register(&misc); |
| 95 | + return ret; |
| 96 | +} |
| 97 | + |
| 98 | +void __exit driver_unload(void) |
| 99 | +{ |
| 100 | + printk("[+] driver_unload"); |
| 101 | + misc_deregister(&misc); |
| 102 | +} |
| 103 | + |
| 104 | +module_init(driver_entry); |
| 105 | +module_exit(driver_unload); |
| 106 | + |
| 107 | +MODULE_DESCRIPTION("Linux Kernel H4cking."); |
| 108 | +MODULE_LICENSE("GPL"); |
| 109 | +MODULE_AUTHOR("Rog"); |
0 commit comments