Hello, We are working on a LKM for the 2.6 kernel. We HAVE to intercept system calls. I understand this could be something developers are no encouraged to do these days, but we need this.
Too bad.
Patching kernel to export sys_call_table is not an option. The fast and dirty way to do this would be by using System.map, but I would rather we find a cleaner approach.
There is none. And even System.map can be unreliable. Some distros/kernels only include exported symbols in System.map, and sys_call_table is not exported in 2.6.
I did some research on google and I know this issue has been raised before, but unfortunately I could not find a coherent answer. Does anyone know of any tutorial or open source code where I could look at how this is done? I think that IDT should give me the entry point, but where do I get system call table address?
You don't.
You're just going to have to accept that fact that what you want to do, the way you want to do it, is just not going to happen. Sorry.
Your best bet is to design and implement a clean and safe mechanisming for intercepting system calls, and submit that to the kernel. It will probably get rejected, but it still might be worth a shot.
-- Timur Tabi Staff Software Engineer [EMAIL PROTECTED] - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/