+++ /dev/null
-/*++
-
-Copyright (c) 1998-2001 Klaus P. Gerlicher
-
-Module Name:
-
- syscall.c
-
-Abstract:
-
-Environment:
-
- Kernel mode only
-
-Author:
-
- Klaus P. Gerlicher
-
-Revision History:
-
- 12-Nov-1999: created
- 15-Nov-2000: general cleanup of source files
-
-Copyright notice:
-
- This file may be distributed under the terms of the GNU Public License.
-
---*/
-
-////////////////////////////////////////////////////
-// INCLUDES
-////
-#include "remods.h"
-#include "precomp.h"
-
-char syscallTemp[1024];
-
-typedef struct _FRAME_SYSCALL
-{
- ULONG eip;
- ULONG cs;
- ULONG eflags;
-}FRAME_SYSCALL;
-
-BOOLEAN bReportProcessEvents = TRUE;
-
-ULONG OldSyscallHandler=0;
-
-ULONG ulFreeModule=0;
-
-PDEBUG_MODULE pModJustFreed=NULL;
-void (*old_cleanup_module)(void)=NULL;
-
-void other_module_cleanup_module(void)
-{
- DPRINT((0,"other_module_cleanup_module()\n"));
-
- if(old_cleanup_module)
- {
- DPRINT((0,"other_module_cleanup_module(): calling %x\n",(ULONG)old_cleanup_module));
- old_cleanup_module();
- }
-
- if(pModJustFreed)
- {
- DPRINT((0,"other_module_cleanup_module(): calling RevirtualizeBreakpointsForModule(%x)\n",(ULONG)pModJustFreed));
- RevirtualizeBreakpointsForModule(pModJustFreed);
- }
-}
-
-void CSyscallHandler(FRAME_SYSCALL* ptr,ULONG ulSysCall,ULONG ebx)
-{
-// DPRINT((0,"CSyscallHandler(): %.4X:%.8X (syscall = %u)\n",ptr->cs,ptr->eip,ulSysCall));
-/*
- switch(ulSysCall)
- {
- case 1: // sys_exit
- DPRINT((0,"CSysCallHandler(): 1\n"));
- if(bReportProcessEvents)
- {
- PICE_sprintf(syscallTemp,"pICE: process destroyed \"%s\" PID=%.4X\n",current->comm,current->pid);
- AddToRingBuffer(syscallTemp);
- }
- break;
- case 11: // sys_execve
- DPRINT((0,"CSysCallHandler(): 11\n"));
- if(bReportProcessEvents)
- {
- if(PICE_strlen((char*)ebx))
- PICE_sprintf(syscallTemp,"pICE: process created \"%s\" PID=%.4X (parent \"%s\")\n",(char *)ebx,current->pid,current->comm);
- else
- PICE_sprintf(syscallTemp,"pICE: process created PID=%.4X (parent \"%s\")\n",current->pid,current->comm);
- AddToRingBuffer(syscallTemp);
- }
- break;
- case 128: // sys_init_module
- DPRINT((0,"CSysCallHandler(): 128\n"));
- if(PICE_strlen((char *)ebx))
- {
- if(pmodule_list)
- {
- struct module* pMod = *pmodule_list;
- do
- {
- if(PICE_strcmpi((char*)ebx,(LPSTR)pMod->name)==0)
- {
- ULONG ulInitAddress;
- PICE_sprintf(syscallTemp,"pICE: module \"%s\" loaded (%x-%x init @ %x)\n",(char*)ebx,pMod,(ULONG)pMod+pMod->size,pMod->init);
- if((ulInitAddress=FindFunctionInModuleByName("init_module",pMod)))
- {
- DPRINT((0,"setting DR1=%.8x\n",ulInitAddress));
-
- SetHardwareBreakPoint(ulInitAddress,1);
- }
- }
- }while((pMod = pMod->next));
- }
- else
- {
- PICE_sprintf(syscallTemp,"pICE: module loaded \"%s\"\n",(char *)ebx);
- }
- }
- else
- PICE_sprintf(syscallTemp,"pICE: module loaded\n");
- AddToRingBuffer(syscallTemp);
- break;
- case 129: // sys_delete_module
- DPRINT((0,"CSysCallHandler(): 129\n"));
- if(PICE_strlen((char *)ebx))
- {
- if(IsModuleLoaded((LPSTR)ebx)!=NULL && PICE_strcmpi((char*)ebx,"pice")!=0 )
- {
- PICE_sprintf(syscallTemp,"pICE: module freed \"%s\"\n",(char *)ebx);
- Print(OUTPUT_WINDOW,syscallTemp);
- if((pModJustFreed = FindModuleByName((char*)ebx)) )
- {
- if(pModJustFreed->cleanup)
- {
- old_cleanup_module = pModJustFreed->cleanup;
- pModJustFreed->cleanup = other_module_cleanup_module;
- }
- else
- {
- RevirtualizeBreakpointsForModule(pModJustFreed);
- }
- }
- }
- }
- else
- {
- PICE_sprintf(syscallTemp,"pICE: module freed\n");
- AddToRingBuffer(syscallTemp);
- }
- break;
- }
- */
-}
-
-__asm__ ("\n\t \
-NewSyscallHandler:\n\t \
- // save used regs\n\t \
- pushfl\n\t \
- cli\n\t \
- cld\n\t \
- pushal\n\t \
- pushl %ds\n\t \
-\n\t \
- // push the syscall number\n\t \
- pushl %ebx\n\t \
- pushl %eax\n\t \
-\n\t \
- // frame ptr\n\t \
- lea 48(%esp),%eax\n\t \
- pushl %eax\n\t \
-\n\t \
- // setup default data selectors\n\t \
- movw %ss,%ax\n\t \
- movw %ax,%ds\n\t \
-\n\t \
- call _CSyscallHandler\n\t \
-\n\t \
- // remove pushed params\n\t \
- add $12,%esp\n\t \
-\n\t \
- // restore used regs\n\t \
- popl %ds\n\t \
- popal\n\t \
- popfl\n\t \
-\n\t \
- // chain to old handler\n\t \
- .byte 0x2e\n\t \
- jmp *_OldSyscallHandler");
-
-void InstallSyscallHook(void)
-{
- ULONG LocalSyscallHandler;
-
- ENTER_FUNC();
-/*ei fix later
- MaskIrqs();
- if(!OldSyscallHandler)
- {
- __asm__("mov $NewSyscallHandler,%0"
- :"=r" (LocalSyscallHandler)
- :
- :"eax");
- OldSyscallHandler=SetGlobalInt(0x2e,(ULONG)LocalSyscallHandler);
-
- ScanExports("free_module",(PULONG)&ulFreeModule);
-
- DPRINT((0,"InstallSyscallHook(): free_module @ %x\n",ulFreeModule));
- }
- UnmaskIrqs();
- */
- LEAVE_FUNC();
-}
-
-void DeInstallSyscallHook(void)
-{
- ENTER_FUNC();
-/*ei
- MaskIrqs();
- if(OldSyscallHandler)
- {
- SetGlobalInt(0x2e,(ULONG)OldSyscallHandler);
- (ULONG)OldSyscallHandler=0;
- }
- UnmaskIrqs();
-*/
- LEAVE_FUNC();
-}