{"topic":{"id":13904,"title":"计算机操作系统实验动态模块篡改系统调用为什么返回值不正确","slug":"topic","categoryId":54,"createdAt":"2024-11-24 07:22:40.257352","bumpedAt":"2024-12-01 15:12:13.858859","views":309,"postsCount":12,"highestPostNumber":12,"likeCount":1,"closed":false,"pinned":false,"pinnedGlobally":false,"pinnedAt":null,"pinnedUntil":null,"isBanner":false,"excerpt":"在完成操作系统实验动态模块与字符设备时，我已经成功的将 78 号系统调用修改为自定义函数，更改后的自定义函数如下： asmlinkage int hello(int a,int b) //new function { printk(\"No 78 syscall has changed to hello\"); return a+b; } 模块加载结果如下： [ 3604.213062] Module loading... [ 3604.2…","deletedAt":null,"isAnonymous":false,"category":{"id":54,"name":"学术专区","slug":"academic","color":"9EB83B"},"author":{"id":3788,"username":"yuaay7","name":"yuaay","avatarUrl":"/uploads/image/0a/56/0a56f8ca9eb19b35fa0731a93f3ff4851612f1de917fa84fbd936f8a3d95da4f.avif"},"tags":[]},"posts":[{"id":43541,"postNumber":1,"raw":"在完成操作系统实验动态模块与字符设备时，我已经成功的将 78 号系统调用修改为自定义函数，更改后的自定义函数如下：\n```c\nasmlinkage int hello(int a,int b) //new function\n{\n printk(\"No 78 syscall has changed to hello\");\n return a+b;\n}\n```\n模块加载结果如下：\n```bash\n[ 3604.213062] Module loading...\n[ 3604.228647] sys_call_addr: 00000000bca137c4\n[ 3604.228941] old_sys_call_func: ffff0000083735e0\n[ 3604.229251] syscall 78 replaced successfully with hello function\n[ 3604.231748] No 78 syscall has changed to hello\n[ 3604.232071] a: 537460416, b: 14352384\n```\n但是在用户程序中调用时，返回的结果却不对\n```c\nmodify_new_syscall.c\n#include\n#include\n#include\nint main()\n{ \n int ret=syscall(78,10,20); //after modify syscall 78\n printf(\"%d\\n\",ret);\n return 0;\n}\n```\n```bash\n[root@kp-test01 modify_syscall]# ./modify_new_syscall \n570293952\n[root@kp-test01 modify_syscall]# ./modify_new_syscall \n572391104\n```\n如上，会返回一个很大的数，不知道为什么会这样 :drooling:，想知道这种会不会影响验收","cooked":"

在完成操作系统实验动态模块与字符设备时，我已经成功的将 78 号系统调用修改为自定义函数，更改后的自定义函数如下：

asmlinkage int hello(int a,int b) //new function\n{\n    printk(\"No 78  syscall has changed to hello\");\n    return a+b;\n}\n

模块加载结果如下：

[ 3604.213062] Module loading...\n[ 3604.228647] sys_call_addr: 00000000bca137c4\n[ 3604.228941] old_sys_call_func: ffff0000083735e0\n[ 3604.229251] syscall 78 replaced successfully with hello function\n[ 3604.231748] No 78 syscall has changed to hello\n[ 3604.232071] a: 537460416, b: 14352384\n

但是在用户程序中调用时，返回的结果却不对

modify_new_syscall.c\n#include<stdio.h>\n#include<sys/time.h>\n#include<unistd.h>\nint main()\n{ \n    int ret=syscall(78,10,20); //after modify syscall 78\n    printf(\"%d\\n\",ret);\n    return 0;\n}\n

[root@kp-test01 modify_syscall]# ./modify_new_syscall \n570293952\n[root@kp-test01 modify_syscall]# ./modify_new_syscall \n572391104\n

如上，会返回一个很大的数，不知道为什么会这样 🤤，想知道这种会不会影响验收

\n","createdAt":"2024-11-24 07:22:40.453746","updatedAt":"2024-11-24 07:26:46.765323","replyToPostNumber":null,"replyCount":0,"likeCount":0,"wordCount":205,"liked":false,"bookmarked":false,"polls":[],"reactions":[],"wiki":false,"version":2,"publicVersion":2,"deletedAt":null,"isAnonymous":false,"user":{"id":3788,"username":"yuaay7","name":"yuaay","avatarUrl":"/uploads/image/0a/56/0a56f8ca9eb19b35fa0731a93f3ff4851612f1de917fa84fbd936f8a3d95da4f.avif","admin":false,"moderator":false,"signatureRaw":null,"signatureCooked":null}},{"id":43545,"postNumber":2,"raw":"猜测是初始化问题","cooked":"

猜测是初始化问题

\n","createdAt":"2024-11-24 08:56:49.652885","updatedAt":"2024-11-24 08:56:49.652885","replyToPostNumber":null,"replyCount":1,"likeCount":0,"wordCount":8,"liked":false,"bookmarked":false,"polls":[],"reactions":[],"wiki":false,"version":1,"publicVersion":1,"deletedAt":null,"isAnonymous":false,"user":{"id":178,"username":"Hypocrisy","name":"rotartsinimdA","avatarUrl":"/uploads/image/ce/f3/cef3773e378e161524cc7523c8a63dff0698d22802b0c1ab669894d395ee36a3.avif","admin":false,"moderator":true,"signatureRaw":null,"signatureCooked":null}},{"id":43557,"postNumber":3,"raw":"感谢😊我再试试","cooked":"

感谢😊我再试试

\n","createdAt":"2024-11-24 16:50:36.434731","updatedAt":"2024-11-24 16:50:36.434731","replyToPostNumber":2,"replyCount":0,"likeCount":0,"wordCount":7,"liked":false,"bookmarked":false,"polls":[],"reactions":[],"wiki":false,"version":1,"publicVersion":1,"deletedAt":null,"isAnonymous":false,"user":{"id":3788,"username":"yuaay7","name":"yuaay","avatarUrl":"/uploads/image/0a/56/0a56f8ca9eb19b35fa0731a93f3ff4851612f1de917fa84fbd936f8a3d95da4f.avif","admin":false,"moderator":false,"signatureRaw":null,"signatureCooked":null}},{"id":43580,"postNumber":4,"raw":"解决了。在尝试的过程中发现，传入的参数中，a 实际上是地址，使用*a 可以从日志中看见是正确的值，但是 b 我就不知道了，即使当作地址来解析还是不正确。\n最终的解决方案是读取寄存器 x0，和 x1 的值，这两个寄存器中的值是正确的。\n```c\n// 新的系统调用函数\nasmlinkage int hello(/* int *a, int *b */void) {\n int a = (int)current_pt_regs()->regs[0]; // 从寄存器 x0 获取参数 a\n int b = (int)current_pt_regs()->regs[1]; // 从寄存器 x1 获取参数 b\n \n printk(\"No 78 syscall has changed to hello\\n\");\n printk(\"a: %d, b: %d\\n\", a, b);\n \n return a + b; // 返回 a 和 b 的和\n}\n```","cooked":"

解决了。在尝试的过程中发现，传入的参数中，a 实际上是地址，使用*a 可以从日志中看见是正确的值，但是 b 我就不知道了，即使当作地址来解析还是不正确。
\n最终的解决方案是读取寄存器 x0，和 x1 的值，这两个寄存器中的值是正确的。

// 新的系统调用函数\nasmlinkage int hello(/* int *a, int *b */void) {\n    int a = (int)current_pt_regs()->regs[0]; // 从寄存器 x0 获取参数 a\n    int b = (int)current_pt_regs()->regs[1]; // 从寄存器 x1 获取参数 b\n    \n    printk(\"No 78 syscall has changed to hello\\n\");\n    printk(\"a: %d, b: %d\\n\", a, b);\n    \n    return a + b; // 返回 a 和 b 的和\n}\n

\n","createdAt":"2024-11-25 12:29:08.224819","updatedAt":"2024-11-25 12:29:08.224819","replyToPostNumber":null,"replyCount":0,"likeCount":1,"wordCount":179,"liked":false,"bookmarked":false,"polls":[],"reactions":[{"reaction":"❤️","count":1,"users":[{"id":4668,"username":"IO","name":null}],"hasReacted":false}],"wiki":false,"version":1,"publicVersion":1,"deletedAt":null,"isAnonymous":false,"user":{"id":3788,"username":"yuaay7","name":"yuaay","avatarUrl":"/uploads/image/0a/56/0a56f8ca9eb19b35fa0731a93f3ff4851612f1de917fa84fbd936f8a3d95da4f.avif","admin":false,"moderator":false,"signatureRaw":null,"signatureCooked":null}},{"id":43593,"postNumber":5,"raw":"总之就是由于地址空间的问题这里只应该从寄存器里拿，关于*a 能取到正确的值的话如果不是偶然现象可能是因为 a 被“拷贝”到了内核栈用于加速 syscall(?)，这是一个 linux 使用的系统调用加速手段，但这里我也不太确定","cooked":"

总之就是由于地址空间的问题这里只应该从寄存器里拿，关于*a 能取到正确的值的话如果不是偶然现象可能是因为 a 被“拷贝”到了内核栈用于加速 syscall(?)，这是一个 linux 使用的系统调用加速手段，但这里我也不太确定

\n","createdAt":"2024-11-26 00:35:55.503767","updatedAt":"2024-11-26 00:36:02.957083","replyToPostNumber":null,"replyCount":1,"likeCount":0,"wordCount":92,"liked":false,"bookmarked":false,"polls":[],"reactions":[],"wiki":false,"version":1,"publicVersion":1,"deletedAt":null,"isAnonymous":false,"user":{"id":2877,"username":"Zerick","name":null,"avatarUrl":"/uploads/image/a7/a3/a7a3f86ac04b30a3177766813966fa48ce68b0e1cc009a8d274e34ab13a43ce9.avif","admin":false,"moderator":false,"signatureRaw":null,"signatureCooked":null}},{"id":43727,"postNumber":6,"raw":"好的，感谢","cooked":"

好的，感谢

\n","createdAt":"2024-11-28 05:39:20.305208","updatedAt":"2024-11-28 05:39:20.305208","replyToPostNumber":5,"replyCount":0,"likeCount":0,"wordCount":5,"liked":false,"bookmarked":false,"polls":[],"reactions":[],"wiki":false,"version":1,"publicVersion":1,"deletedAt":null,"isAnonymous":false,"user":{"id":3788,"username":"yuaay7","name":"yuaay","avatarUrl":"/uploads/image/0a/56/0a56f8ca9eb19b35fa0731a93f3ff4851612f1de917fa84fbd936f8a3d95da4f.avif","admin":false,"moderator":false,"signatureRaw":null,"signatureCooked":null}},{"id":43803,"postNumber":7,"raw":"同学你好，请问你是怎么修改地址的呢，运行环境是什么？详细信息我私发你了","cooked":"

同学你好，请问你是怎么修改地址的呢，运行环境是什么？详细信息我私发你了

\n","createdAt":"2024-11-30 14:00:46.23303","updatedAt":"2024-11-30 14:00:46.23303","replyToPostNumber":null,"replyCount":0,"likeCount":0,"wordCount":35,"liked":false,"bookmarked":false,"polls":[],"reactions":[],"wiki":false,"version":1,"publicVersion":1,"deletedAt":null,"isAnonymous":false,"user":{"id":1202,"username":"shinnrryuu","name":"神竜","avatarUrl":"/uploads/image/bc/31/bc31850c60444497d7b0f17ffcdc4665bc4f1cdebdce58efd973839de6349398.avif","admin":false,"moderator":false,"signatureRaw":null,"signatureCooked":null}},{"id":43831,"postNumber":8,"raw":"同学请问你初期有没有遇到一挂载就重启的问题，是怎么解决的 :cry:","cooked":"

同学请问你初期有没有遇到一挂载就重启的问题，是怎么解决的 😢

\n","createdAt":"2024-12-01 13:41:31.657205","updatedAt":"2024-12-01 13:41:31.657205","replyToPostNumber":null,"replyCount":2,"likeCount":0,"wordCount":29,"liked":false,"bookmarked":false,"polls":[],"reactions":[],"wiki":false,"version":1,"publicVersion":1,"deletedAt":null,"isAnonymous":false,"user":{"id":213,"username":"Nikola","name":"Kk","avatarUrl":null,"admin":false,"moderator":false,"signatureRaw":null,"signatureCooked":null}},{"id":43833,"postNumber":9,"raw":"我就是这样。。。感觉我修改的 syscalltable 的地址也是对的","cooked":"

我就是这样。。。感觉我修改的 syscalltable 的地址也是对的

\n","createdAt":"2024-12-01 14:04:20.623659","updatedAt":"2024-12-01 14:04:20.623659","replyToPostNumber":8,"replyCount":1,"likeCount":0,"wordCount":20,"liked":false,"bookmarked":false,"polls":[],"reactions":[],"wiki":false,"version":1,"publicVersion":1,"deletedAt":null,"isAnonymous":false,"user":{"id":1202,"username":"shinnrryuu","name":"神竜","avatarUrl":"/uploads/image/bc/31/bc31850c60444497d7b0f17ffcdc4665bc4f1cdebdce58efd973839de6349398.avif","admin":false,"moderator":false,"signatureRaw":null,"signatureCooked":null}},{"id":43839,"postNumber":10,"raw":"解决了 :smiling_face_with_3_hearts:\n\n* 先在 IDTR 寄存器中获得 IDT_TABLE 的地址，再在 IDT_TABLE 中获得 int0x80 的地址，int0x80 对应的是 system_call 函数的地址。最后通过 system_call 函数的地址获得 sys_call_table 的地址。这个文章末尾\n[一](https://blog.csdn.net/inthat/article/details/119931358)\n* 自己定义 `kallsyms_lookup_name` 函数查找**syscalltable**的地址\n[二](https://blog.csdn.net/weixin_45030965/article/details/132497956)。","cooked":"

解决了 🥰

先在 IDTR 寄存器中获得 IDT_TABLE 的地址，再在 IDT_TABLE 中获得 int0x80 的地址，int0x80 对应的是 system_call 函数的地址。最后通过 system_call 函数的地址获得 sys_call_table 的地址。这个文章末尾
\n一
自己定义 kallsyms_lookup_name 函数查找syscalltable的地址
\n二。

\n","createdAt":"2024-12-01 15:11:27.980781","updatedAt":"2024-12-01 15:11:27.980781","replyToPostNumber":9,"replyCount":0,"likeCount":0,"wordCount":84,"liked":false,"bookmarked":false,"polls":[],"reactions":[],"wiki":false,"version":1,"publicVersion":1,"deletedAt":null,"isAnonymous":false,"user":{"id":213,"username":"Nikola","name":"Kk","avatarUrl":null,"admin":false,"moderator":false,"signatureRaw":null,"signatureCooked":null}},{"id":43840,"postNumber":11,"raw":"关闭对应位置的写保护。此外，使用的符号地址我是通过函数动态获取的，最后打印到日志发现动态查找的地址和在文件中找到的地址也并不一样，这部分可能也会影响","cooked":"

关闭对应位置的写保护。此外，使用的符号地址我是通过函数动态获取的，最后打印到日志发现动态查找的地址和在文件中找到的地址也并不一样，这部分可能也会影响

\n","createdAt":"2024-12-01 15:11:31.57783","updatedAt":"2024-12-01 15:11:31.57783","replyToPostNumber":8,"replyCount":1,"likeCount":0,"wordCount":74,"liked":false,"bookmarked":false,"polls":[],"reactions":[],"wiki":false,"version":1,"publicVersion":1,"deletedAt":null,"isAnonymous":false,"user":{"id":3788,"username":"yuaay7","name":"yuaay","avatarUrl":"/uploads/image/0a/56/0a56f8ca9eb19b35fa0731a93f3ff4851612f1de917fa84fbd936f8a3d95da4f.avif","admin":false,"moderator":false,"signatureRaw":null,"signatureCooked":null}},{"id":43841,"postNumber":12,"raw":"感谢已解决","cooked":"

感谢已解决

\n","createdAt":"2024-12-01 15:12:13.858859","updatedAt":"2024-12-01 15:12:13.858859","replyToPostNumber":11,"replyCount":0,"likeCount":0,"wordCount":5,"liked":false,"bookmarked":false,"polls":[],"reactions":[],"wiki":false,"version":1,"publicVersion":1,"deletedAt":null,"isAnonymous":false,"user":{"id":213,"username":"Nikola","name":"Kk","avatarUrl":null,"admin":false,"moderator":false,"signatureRaw":null,"signatureCooked":null}}],"hasMore":false,"lastReadPostNumber":7,"hasUrlPostNumber":true}