Messages in this thread | | | Date | Tue, 20 Jul 1999 12:11:49 -0400 (EDT) | From | Douglas Kilpatrick <> | Subject | Re: QUESTION: modifying kernel functions in a running kernel |
| |
On Tue, 20 Jul 1999, noupe wrote:
> Is it possible to change a function (not a syscall) which is public > (i.e shown in /proc/ksyms) from a module? Something like changing the > address to the function so my function will be called instead of the > public one?
Depends on how much you like code that is too ugly to exist...
I am currently doing something similar and have my own questions because on occassion it doesn't work. The actual code to patch the "call absolute" instruction was provided by my co-worker and is kinda long, so I'd prefer to only send it to those who ask... It is also x86 specific right now.
Basically it searches for an instruction that starts with 0xE8 (the call instruction), and then checks to see if the address pointed to is the function that we want to intercept. If so, it replaces the address with the calculated address of our function.
In the interception function it then calls the original function in our case. Warning: Due to a (minor) bug in egcs (and probally older gcc versions) if you call an address directly you have to do it as shown below:
int (* volatile orig)(int) = 0x12345678; return orig(i);
You can't use "((int (*)(int))0x12345678)(i);". The generated code will jump to the wrong location.
This works most of the time, but for some reason I can not figure out if I try and intercept the call of copy_files() in do_fork() any forking threads will hang... but intercepting get_pid() works fine. Any ideas?
Doug -- dougk@tislabs.com dkilpatr@nai.com
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |