All pastes #265028 Raw Edit

Someone

public text v1 · immutable
·published 2006-12-02 23:07 UTC
rendered paste body
int get_syscalltable_int80()
{
        struct {
                unsigned short limit;
                unsigned int base;
        } __attribute__ ((packed)) idtr;

        struct {
                unsigned short off1;
                unsigned short sel;
                unsigned char none,flags;
                unsigned short off2;
        } __attribute__ ((packed)) idt;

        int             ret, i;
        unsigned int    scall, sys_call_off;
        char            *s, sig[3] = {'\xFF', '\x14', '\x85'};

        ret = -1;

        asm ("sidt %0" : "=m" (idtr));

        memcpy(&idt, idtr.base + 8 * 0x80, sizeof(idt));
        sys_call_off = (idt.off2 << 16) | idt.off1;

        s = (char *)sys_call_off;

        printk("syscall_enter at %X\n", (unsigned int)s);

        for(i = 0; i < 512; i++) {
                if(!memcmp(s, sig, 3))
                        break;
                s++;
        }

        if(i == 512) {
                printk(KERN_WARNING "lorax: failed to find syscall address\n");
                return -1;
        }

        s += 3;
        sys_call_table = *(unsigned int*)s;


        printk(KERN_WARNING "lorax: found syscall at %X, sys_call_table at %X\n", (unsigned int)s, sys_call_table);

        return 0;

}