BSD ROOTKIT 设计--内核黑客指引书(第2章)

2挂钩
2.1 系统调用挂钩
2.2 击键记录
2.3
[url=javascript:;]内核[/url]
进程追踪
2.4 常用的系统调用挂钩
2.5 通信协议
    2.5.1 protosw 结构
    2.5.2 inetsw[] 转换表
    2.5.3 mbuf
[url=javascript:;]结构体[/url]
2.6 通信协议挂钩
2.7 小结
2
HOOKING
挂钩
We’ll start our discussion of kernel-mode rootkits with call hooking, or simply hooking, which is arguably the most popular
[url=javascript:;]rootkit[/url]
technique.
我们将开始探讨使用了调用挂钩或普通挂钩技术的内核模式rootkit。挂钩无疑是最流行的rootikit技术。
Hooking is a programming technique that employs handler functions (called hooks) to modify control flow. A
[url=javascript:;]new[/url]
hook registers its address as the location for a specific function, so
that when that function is called, the hook is run instead. Typically,
a hook will call the original function at some point in order to
preserve the original behavior. Figure 2-1 illustrates the control flow
of a subroutine before and after installing a call hook.
挂钩是一种使用处理程序(叫做挂钩)来修改控制流的编程技术。新的挂钩把它的地址注册为特定函数的地址，这样当那个函数被调用时，挂钩程序就代替它运行。一般，挂钩还会调用原先的函数，目的是维为了持原来的行为。图2-1描绘了调用挂钩在
[url=javascript:;]安装[/url]
前和安装后，一个子程序的控制流。
Normal Execution                        Hooked Execution
Function A----->Function B     Function A----->Hook------>Function B
Figure 2-1: Normal execution versus hooked execution
As
you can see, hooking is used to extend (or decrease) the functionality
of a subroutine. In terms of rootkit design, hooking is used to alter
the results of the operating system’s application programming
interfaces (APIs), most commonly those involved with bookkeeping and
reporting.
可以看出，挂钩可用来扩展(或削弱)一个子程序的功能。挂钩可按照rootkit的设计目的来修改操作系统的应用程序编程接口(API)的运行效果。通常，我们关心的是那些有记录和报告功能的API。
Now, let’s start abusing the KLD interface.
现在，我们玩弄玩弄KLD接口。
2.1 Hooking a System Call
2.1 系统调用挂钩
Recall
from Chapter 1 that a system call is the entry point through which an
application program requests service from the operating system’s
[url=javascript:;]kernel[/url]
.
By hooking these entry points, a rootkit can alter the data the kernel
returns to any or every user space process. In fact, hooking system
calls is so effective that most (publicly available) rootkits employ it
in some way.
第一章提到，系统调用是一种入口点，应用程序通过它向操作系统请求服务。通过挂住这些入口点，rootkit就能改变内核返回给某个或所有用户空间进程的数据。实际上，系统调用挂钩非常地有效，以至被大多数(可公开获取到的)rootkit在某种程度上都使用到了。

标签：

版权申明：本站文章部分自网络，如有侵权，请联系：west999com@outlook.com
特别注意：本站所有转载文章言论不代表本站观点，本站所提供的摄影照片，插画，设计作品，如需使用，请与原作者联系，版权归原作者所有