Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Hijacking the realtime clock in linux

I want to write a LKM (Linux Kernel Module) that hijacks the realtime clock (interrupt 8). So I want the interrupt to be set to my function and at some point send it back to the old function.

I have tried to use the request_irq function without any success, probably because the kernel function that is there is not willing to share the interrupt (which is a good decision I guess).
I also tried to edit the IDT (Interrupt Descriptor Table), according to some pages I found. Non of them worked, most didn't even compile since they where written for kernel 2.6, and I'm working with 3.10.

This is a simplified code that I have just to give you the idea of what I'm doing.

kpage =__get_free_page( GFP_KERNEL);
asm("sidt %0": : "m"(*idtr) : );
memcpy(kpage, idtr, 256*sizeof(kpage));
newidt = (unsigned long long *)(*(unsigned long*)(idtr+1));
newidt[8] = &my_function;
asm("lidt %0": "=m"(newidt):);

All my attempts ended in good times with a segmentation fault, and in bad times with the kernel crashing forcing me to reboot (luckily I work with a virtual machine and snapshots).

So how can I hijack the realtime interrupt so it does my stuff? (And then send it back to the original function to get executed.)

Here is some nice code to change the pagefault function on the IDT. I couldn't make it work, since it's also written for kernel 2.6. This question is also worth looking into.

To get the bounty please publish working code, or at least sufficient info to make it run.

like image 808
Ramzi Khahil Avatar asked Dec 06 '13 10:12

Ramzi Khahil


1 Answers

This can help you : http://cormander.com/2011/12/how-to-hook-into-hijack-linux-kernel-functions-via-lkm/

Why not you simply hook a function that is call every x steps like you want and execute what ever you need ?

like image 141
Thomas Leclercq Avatar answered Oct 05 '22 04:10

Thomas Leclercq