用户进程如何访问我的模块加载的字符设备
我正在尝试动态地将系统调用加载到内核中（无需重新启动内核并对其进行编译），以尝试（一旦处于内核模式）写入用户进程的内存。
（我知道有一种方法可以使用 ptrace 接口执行此操作，但它不是一个选项。）
我知道执行此操作的唯一方法是加载模块。为了允许用户与其通信，我被告知使用字符设备（应该位于 /dev/ 中，对吗？）。我成功加载了一个。 我的问题是我不知道用户进程如何在没有系统调用的情况下访问它。 （我被告知使用 ioctl） 任何人都可以展示用户进程如何调用 ioctl 例如由我的模块加载的吗？
谢谢， 沙伊
I am trying to load into the kernel a system-call dynamically (without restarting the kernel and compailing it) in an attempt to (once in kernel mode) write to user process's memory.
(I know there is a way to do this with the ptrace interface but it is not an option.)
I know the only way to do this is to load a module. In order to allow the user communicating with it, i was told to use a character device (which is supposed to be in /dev/, right?). I loaded one successfully.
My problem is that i don't know how the user process access it without an system call.
(i was told to use ioctl)
Could anyone show how a user process can call ioctl for example that was loaded by my module?
Thanks,
Shai
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
有几种与内核驱动程序通信的机制：
/proc条目（又名 procfs）最常用的技术最后一个使用
read()和/或write()系统调用来引起驱动程序操作。虽然这些系统调用通常传递纯数据，但没有什么可以阻止特定驱动程序传递元数据输入/输出接口。另一方面，如果驱动程序已经具有有用的纯数据规则，而
read()和write()不适用于元数据，则ioctl ()系统调用是一种通用的瑞士军刀，用于执行与文件相关的各种操作，例如加载或卸载磁带、弹出 DVD、查找网卡的以太网地址或查找找出发生了多少个磁盘驱动器错误。已经定义了如此多的ioctl操作代码，您可能可以找到一个合理的代码来重用您的目的。 ioctl 接口的一个很大的缺点是它最适合由自定义程序使用，因此通过连接到标准程序的管道。/proc接口结合了前两种技术的优点：它可以在标准实用程序中使用stdin/stdout约定，但它还通过常规驱动程序机制提供独立于任何 I/O 的设备驱动程序接口。例如，在 Linux 系统上尝试cat /proc/net/tcp。它显示所有TCP连接的状态。关于实现 procfs 功能的好文章位于
create_proc_entry ()。 此处详细介绍了 ioctl 的实现。元数据方法与任何其他设备驱动程序一样易于编码，尽管它可能会给经验丰富的实施者带来概念上的障碍。There are several mechanisms for communicating with a kernel driver:
/procentry (aka procfs)The most common technique is the last which uses
read()and/orwrite()system calls to cause driver action. While these system calls ordinarily pass pure data, there is nothing stopping a particular driver from instead passing metadata through the i/o interface.On the other hand, if the driver already has a useful pure data discipline for which
read()andwrite()are not good for metadata, then theioctl()system call is a kind of general purpose Swiss army knife for doing all kinds of things related to a file, such as loading or unloading a magnetic tape, ejecting a DVD, finding a network card's Ethernet address, or finding out how many disk drive errors have occurred. There have been so many ioctl operation codes defined, you can probably find a reasonable one to reuse for your purposes. A big disadvantage of theioctlinterface is that it is best suited for use by a custom program, so it would be awkward or difficult to transfer data through anioctlconnected to a pipeline of standard programs.The
/procinterface combines the best of the previous two techniques: it is amenable to usingstdin/stdoutconventions with standard utility programs, but it also provides an interface to a device driver which is independent of any i/o through the regular driver mechanism. For example, trycat /proc/net/tcpon your Linux system. It shows the status of allTCPconnections.A good article on implementing the procfs feature is at
create_proc_entry(). Implementing an ioctl is well covered here. The metadata approach is as easy to code as any other device driver, though it might present conceptual hurdles for an experienced implementer.