c - Generalizing system call hijacking to any kernel symbol -

i know how hijack system calls in modern linux kernels enough engineer simple replacements them. code use hijack system call looks like:

static unsigned long *sys_call_table = (unsigned long*)<address of system call table>; … int make_rw(unsigned long address) {     unsigned int level;     pte_t *pte = lookup_address(address, &level);     if (pte->pte &~ _page_rw) {         pte->pte |= _page_rw;     }     return 0; } int make_ro(unsigned long address) {     unsigned int level;     pte_t *pte = lookup_address(address, &level);     pte->pte = pte->pte &~ _page_rw;     return 0; } … asmlinkage long (*real_<system call name>)(<system call arguments>);  asmlinkage long hijacked_<system call name>(<hijacked system call arguments>) {     // replacement code goes here } … void hack(void) {     make_rw((unsigned long)sys_call_table);     real_<system call name> = (void*)*(sys_call_table + __nr_<system call name>);     *(sys_call_table + __nr_<system call name>) = (unsigned long)hijacked_<system call name>;     make_ro((unsigned long)sys_call_table); } void restore(void) {     make_rw((unsigned long)sys_call_table);     *(sys_call_table + __nr_<system call name>) = (unsigned long)real_<system call name>;     make_ro((unsigned long)sys_call_table); } 

linux exports other functions (i think called "symbols") used internally kernel. 1 such symbol capable, defined in linux/capability.c as:

bool capable(int cap) {     return ns_capable(&init_user_ns, cap); } 

my theory can use same code use hijacking system calls, without bits sys_call_table , __nr_<system call name>. suspect might case system calls, since hijacking them involves replacing pointers addresses. work other symbols? if not, how can hijack them in simple way?

the short answer: method won't work generic functions , want @ kprobes.

the long answer below:

the reason easy hijack system calls because replacing memory address of original system call own function when system call table looked function there instead of original function. system call functions called indirectly via system call table. if code directly called system call function hijack not work.

for hijacking function not have simple method generic function can called various ways. example, can't scan text , replace call instructions calls function function address might stored in data (think c function pointer).

the typical way done replace beginning of function wish hijack call function. if not care every returning original function isn't difficult, placing trampoline whenever intended function called first thing , thing intended function call function. if want return intended function, i.e. want have function called every time target function called , go target function, things little more difficult. because replaced machine code @ beginning of function need. can handled generating machine code replaced machine code , jumps rest of original function code. kprobes doing except kprobes puts debug instruction (int 3 x86) @ beginning of function , debug handler calls probe function opposed placing call instruction.

note high level explanation details architecture specific. example, when replace intended instructions if instructions instruction pointer relative instructions things complicated instruction pointer not typically be. suggest looking @ kprobes of architecture specific details.