finding hidden modules on 2.6 kernel_module_hunter(zz)
来源:互联网 发布:2012-2013MVP数据 编辑:程序博客网 时间:2024/06/01 08:32
http://www.linuxforum.net/forum/showflat.php?Cat=&Board=security&Number=512152&page=0&view=collapsed&sb=5&o=31&fpart=
文章标题 [精华] finding hidden modules on 2.6 kernel_module_hunter 回复
张贴者: madsys (old hand)
张贴日期 09/08/04 14:47
/* name: module hunter 2.6 ver 1.0 9.6.04
author: madsys
usage: cat /proc/showmodules
*/
#undef KBUILD_MODNAME
#define KBUILD_MODNAME mh26
#include <linux/config.h>
#ifdef CONFIG_SMP
#define __SMP__
#endif
#if CONFIG_MODVERSIONS == 1
#define MODVERSIONS
//#include <linux/modversions.h>
#endif
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/version.h>
#include <linux/unistd.h>
#include <linux/string.h>
#include <linux/mm.h>
#include <linux/proc_fs.h> //must need
#include <linux/errno.h>
#include <asm/uaccess.h>
#include <asm/pgtable.h>
#include <asm/fixmap.h>
#include <asm/page.h>
//static int errno;
#define HARDCORE 0xc041f000
#define STEPPING (PAGE_SIZE/32)
int valid_addr(unsigned long address)
{
unsigned long page;
if (!address)
return 0;
page = ((unsigned long *)HARDCORE)[address >> 22]; //pde
if (page & 1)
{
page &= PAGE_MASK;
address &= 0x003ff000;
page = ((unsigned long *) __va(page))[address >> PAGE_SHIFT]; //pte
if (page)
return 1;
}
return 0;
}
ssize_t showmodule_read(struct file *unused_file, char *buffer, size_t len, loff_t*off)
{
struct module *p;
printk("/naddress name size core_addr flags /n/n");
for (p=(struct module *)VMALLOC_START; p<=(structmodule*)(VMALLOC_START+VMALLOC_RESERVE-PAGE_SIZE); p=(struct module *)((unsignedlong)p+STEPPING))
{
if (valid_addr((unsigned long)p+ (unsigned long)&((struct module*)NULL)->name) )
if (((p->name[0]>=0x30 && p->name[0]<=0x39) ||(p->name[0]> 0x41 && p->name[0]<=0x7a )) &&(p->core_size < 1 <<20) && (p->core_size> 128) &&p->state <3 && (int)p->init >0xc6800000) //never seen module over1M
printk("0x%p%18s %6lu 0x%4p %3d/n", p, p->name, p->core_size,p->module_core, p->state);
}
return 0;
}
static struct file_operations showmodules_ops = {
read: showmodule_read,
};
int init_module(void)
{
struct proc_dir_entry *entry;
entry = create_proc_entry("showmodules", S_IRUSR, &proc_root);
entry->proc_fops = &showmodules_ops;
return 0;
}
void cleanup_module()
{
remove_proc_entry("showmodules", &proc_root);
}
MODULE_LICENSE("GPL");
MODULE_AUTHOR("madsys madsys<at>ercist.iscas.ac.cn");
文章标题 [精华] finding hidden modules on 2.6 kernel_module_hunter 回复
张贴者: madsys (old hand)
张贴日期 09/08/04 14:47
/* name: module hunter 2.6 ver 1.0 9.6.04
author: madsys
usage: cat /proc/showmodules
*/
#undef KBUILD_MODNAME
#define KBUILD_MODNAME mh26
#include <linux/config.h>
#ifdef CONFIG_SMP
#define __SMP__
#endif
#if CONFIG_MODVERSIONS == 1
#define MODVERSIONS
//#include <linux/modversions.h>
#endif
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/version.h>
#include <linux/unistd.h>
#include <linux/string.h>
#include <linux/mm.h>
#include <linux/proc_fs.h> //must need
#include <linux/errno.h>
#include <asm/uaccess.h>
#include <asm/pgtable.h>
#include <asm/fixmap.h>
#include <asm/page.h>
//static int errno;
#define HARDCORE 0xc041f000
#define STEPPING (PAGE_SIZE/32)
int valid_addr(unsigned long address)
{
unsigned long page;
if (!address)
return 0;
page = ((unsigned long *)HARDCORE)[address >> 22]; //pde
if (page & 1)
{
page &= PAGE_MASK;
address &= 0x003ff000;
page = ((unsigned long *) __va(page))[address >> PAGE_SHIFT]; //pte
if (page)
return 1;
}
return 0;
}
ssize_t showmodule_read(struct file *unused_file, char *buffer, size_t len, loff_t*off)
{
struct module *p;
printk("/naddress name size core_addr flags /n/n");
for (p=(struct module *)VMALLOC_START; p<=(structmodule*)(VMALLOC_START+VMALLOC_RESERVE-PAGE_SIZE); p=(struct module *)((unsignedlong)p+STEPPING))
{
if (valid_addr((unsigned long)p+ (unsigned long)&((struct module*)NULL)->name) )
if (((p->name[0]>=0x30 && p->name[0]<=0x39) ||(p->name[0]> 0x41 && p->name[0]<=0x7a )) &&(p->core_size < 1 <<20) && (p->core_size> 128) &&p->state <3 && (int)p->init >0xc6800000) //never seen module over1M
printk("0x%p%18s %6lu 0x%4p %3d/n", p, p->name, p->core_size,p->module_core, p->state);
}
return 0;
}
static struct file_operations showmodules_ops = {
read: showmodule_read,
};
int init_module(void)
{
struct proc_dir_entry *entry;
entry = create_proc_entry("showmodules", S_IRUSR, &proc_root);
entry->proc_fops = &showmodules_ops;
return 0;
}
void cleanup_module()
{
remove_proc_entry("showmodules", &proc_root);
}
MODULE_LICENSE("GPL");
MODULE_AUTHOR("madsys madsys<at>ercist.iscas.ac.cn");
- finding hidden modules on 2.6 kernel_module_hunter(zz)
- Hidden Users on Windows
- finding lock details on database
- Finding SQL Servers on the Network
- Finding my frequency on my Samsung phone
- (ZZ)debug on rails
- Compiling C extension modules on Windows
- modules
- Modules
- Modules
- modules
- experiment:Finding crash information using the MAP file on vs2005
- sikuli core: Finding GUI Patterns on the Screen
- Finding Path/Route Between two points on MapKit in iPhone
- Finding the mosting accessed Table/Region on an HBase
- Ways of Finding element on android with Appium
- How to load Additional Supplied Modules for Postgres on Windows
- Could not perform immediate configuration on 'perl-modules'
- 树形结构在开发中的应用
- Word编程中,事件的作用和顺序
- .NET平台下Web树形结构程序设计
- CCproxy 6 Exploit CN Version
- IFRAME 元素 | iframe 对象
- finding hidden modules on 2.6 kernel_module_hunter(zz)
- asp.net中合并DataGrid行
- 男人都是被女人逼坏的?!(转载)
- 网站标题设计与搜索引擎
- Samba
- 在Linux下安装Oracle9i
- Introducing to Spring Framework
- Java API的Date, Calendar日期处理相关类分析
- Tomcat下Session的使用与管理