Re: Hooking into kernel by overriding internal functions

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi Kamyar...

On Wed, Aug 4, 2010 at 01:44, Kamyar Mohajerani <kammoh@xxxxxxxxx> wrote:
> I have studied and tried kprobe too but I guess I doesn't exactly do what I
> need here. I could still be wrong.

You mean, kprobe doesn't do what you wanna do?

> the printk replacement is an exact copy from printk's definition in
> kernel/printk.c. It calls vprintk with it's arguements. I have also removed
> all the statements in function's body and tested. The same result. By "with
> a one" I mean <a function>, which is my printk replacement.

All I know, if something brings havoc in kernel, it could be one of
these things:
- null reference
- sleep inside atomic or interrupt context
- stack overflow (won't be obvious...)
- deadlock or race condition
- possibly many more...

So ask yourself, which one it might be? The displayed/ emitted Error
message, possibly in kernel panic could give you a clue.

But I also have something for you to check: perhaps you also need to
flush instruction and/or TLB. The reason: the address of the symbol
could be cached somewhere by the current callers. Thus, it clash with
the interceptor function.

Try to google about it...i completely forgot where I read it...maybe
in one of the phrack issues too...which talk about PaX..specifically
emulating NX bit.

-- 
regards,

Mulyadi Santosa
Freelance Linux trainer and consultant

blog: the-hydra.blogspot.com
training: mulyaditraining.blogspot.com

--
To unsubscribe from this list: send an email with
"unsubscribe kernelnewbies" to ecartis@xxxxxxxxxxxx
Please read the FAQ at http://kernelnewbies.org/FAQ



[Index of Archives]     [Newbies FAQ]     [Linux Kernel Mentors]     [Linux Kernel Development]     [IETF Annouce]     [Git]     [Networking]     [Security]     [Bugtraq]     [Yosemite]     [MIPS Linux]     [ARM Linux]     [Linux RAID]     [Linux SCSI]     [Linux ACPI]
  Powered by Linux