Linux 内核模块检查内存完整性
我正在编写一个内核模块，它通过控制校验和来检查正在运行的任务的代码段的完整性。我遇到了一些障碍：
- 如果
module_list变量不是由内核导出的（ksyms中没有这样的符号），我如何获取它？我可以看到所有调用 lsmod 命令的模块，那么如何在我的模块中获取它呢？ - 当我的模块运行时，它显示一些代码段已被更改。某些库总是会发生这种情况。为什么会发生这种情况？我认为代码段是不变的。
- 控制内核模块中进程数据的内存访问是否可行？如何实现？
I'm writing a kernel module that checks the integrity of code segments for running tasks by controlling checksums. I ran into a few hurdles:
- How can I get the
module_listvariable if it isn't exported by the kernel (there is no such symbol inksyms)? I can see all modules calling thelsmodcommand, so how can I get it in my module? - While my module is running it shows that some code segments have been changed. It always happens with certain libraries. Why does it happen? I thought that code segments were constant.
- Is it feasible to control memory access for process data from a kernel module and how to do it?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
完全支持自修改代码。没什么毛病，各种东西都用它。您关于代码恒定的假设根本不正确。可能是，但也可能不是。
一个典型的例子是 SMP 与 UP 系统。例如，在 Pentium 4 级 Xeon 机器上，解锁增量可以比锁定增量少 60 个周期。仅在 SMP 机器上需要锁定增量。为了使相同的代码在 UP 和 SMP 机器上工作而没有运行时条件的开销，通常使用自修改代码。使用
ud2等非法操作码代替lock指令。非法指令中断被捕获，ud2在 SMP 系统上被lock替换，在 UP 系统上被nop替换。内核导出一个模块接口。导出的是：
如果您确实愿意，您还可以解析
/proc/modules。Self-modifying code is fully supported. There is nothing wrong with it, and it is used for all kinds of things. Your assumption that code is constant is simply not correct. It may be, but it may not be.
One typical example is in SMP versus UP systems. On Pentium 4 class Xeon machines, for example, an unlocked increment can take 60 cycles fewer than a locked increment. The locked increment is needed only on SMP machines. To make the same code work on both UP and SMP machines without the overhead of a condition at run time, self-modifying code is typically used. In the place of the
lockinstruction, an illegal opcode such asud2is used. The illegal instruction interrupt is caught and theud2is replaced bylockon an SMP system andnopon a UP system.The kernel exports a module interface. Exported are:
You could also parse
/proc/modulesif you really wanted to.