lkml.org 
[lkml]   [1999]   [Jul]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: QUESTION: modifying kernel functions in a running kernel
On Tue, 20 Jul 1999, noupe wrote:

> Is it possible to change a function (not a syscall) which is public
> (i.e shown in /proc/ksyms) from a module? Something like changing the
> address to the function so my function will be called instead of the
> public one?

Depends on how much you like code that is too ugly to exist...

I am currently doing something similar and have my own questions because
on occassion it doesn't work. The actual code to patch the "call
absolute" instruction was provided by my co-worker and is kinda long, so
I'd prefer to only send it to those who ask... It is also x86 specific
right now.

Basically it searches for an instruction that starts with 0xE8 (the call
instruction), and then checks to see if the address pointed to is the
function that we want to intercept. If so, it replaces the address with
the calculated address of our function.

In the interception function it then calls the original function in our
case. Warning: Due to a (minor) bug in egcs (and probally older gcc
versions) if you call an address directly you have to do it as shown
below:

int (* volatile orig)(int) = 0x12345678;
return orig(i);

You can't use "((int (*)(int))0x12345678)(i);". The generated code will
jump to the wrong location.

This works most of the time, but for some reason I can not figure out if I
try and intercept the call of copy_files() in do_fork() any forking
threads will hang... but intercepting get_pid() works fine. Any ideas?

Doug
--
dougk@tislabs.com
dkilpatr@nai.com



-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:53    [W:0.071 / U:0.136 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site