|=-----------------=[ Obtain sys_call_table on amd64(x86_64) ]=---------------=|
|=----------------------------------------------------------------------------=|
|=-----------------------=[ pouik <pouik@zeppoo.net> ]=----------------------=|
--[ Summary
1 - Introduction
2 - IDT
3 - System_call
4 - Sys_call_table
5 - Test
6 - Conclusion
--[ 1 Introduction
Some people remember the article written by sd & devik in phrack 58 [1] which
introduce for the first time (or it's silvio?) the way to find the
sys_call_table on X86 in userland with /dev/(k)mem and how to use it, in order
to create rootkits on Linux.
With this article you'll be able to obtain the sys_call_table on archi Amd64
Most Linux distributions have its kernel compiled with option
CONFIG_IA32_EMULATION=y which, simply ensure the compatibility between
architecture 32 bits and 64 bits.
Kernel developers' have inserted the ia32_sys_call_table and this is very
interesting... so ladies and gentlemens go to next part ! in order to know
why :p
--[ 2 IDT
On x86, we can obtain IDT (Interrupt Descriptor Table) with asm instruction
asm("sidt %0" : "=m" (idtr)); which fill the structure idtr :
struct {
unsigned short limit;
unsigned int base;
} __attribute__((packed)) idtr;
On amd64, the base needs 8 octects (and not 4 octets), so we use the next
structure :
struct {
unsigned short limit;
unsigned long base;
} __attribute__((packed)) idtr;
--[ 3 System_call
Then, the idea of sd & devik was to obtain the IDT corresponding to
int $0x80 :
readkmem (&idt,idtr.base+8*0x80,sizeof(idt));
sys_call_off = (idt.off2 << 16) | idt.off1;
Here that's ok, but we must read 16 bits:
readkmem (&idt,idtr.base+16*0x80,sizeof(idt));
sys_call_off = (idt.off2 << 16) | idt.off1;
Take a moment, in the introduction, we indicate that kernel developers have
inserted a compatibility with software 32 bits, and here, the syscall should be
on ia32 :
promethee kernel # pwd
/usr/src/linux/arch/x86_64/kernel
promethee kernel # grep SYSCALL_VECTOR *
i8259.c: if (vector != IA32_SYSCALL_VECTOR)
io_apic.c: if (current_vector == IA32_SYSCALL_VECTOR)
traps.c: set_system_gate(IA32_SYSCALL_VECTOR, ia32_syscall);
So bingo, we obtain the system_call which is,in reality, ia32_syscall. :)
--[ 4 Sys_call_table
Now that we have ia32_syscall, keep a close eye on execution:
(gdb) disassemble ia32_syscall
Dump of assembler code for function ia32_syscall:
0xffffffff8021f6fc <ia32_syscall+0>: swapgs
0xffffffff8021f6ff <ia32_syscall+3>: sti
0xffffffff8021f700 <ia32_syscall+4>: mov %eax,%eax
0xffffffff8021f702 <ia32_syscall+6>: push %rax
0xffffffff8021f703 <ia32_syscall+7>: cld
0xffffffff8021f704 <ia32_syscall+8>: sub $0x48,%rsp
0xffffffff8021f708 <ia32_syscall+12>: mov %rdi,0x40(%rsp)
0xffffffff8021f70d <ia32_syscall+17>: mov %rsi,0x38(%rsp)
0xffffffff8021f712 <ia32_syscall+22>: mov %rdx,0x30(%rsp)
0xffffffff8021f717 <ia32_syscall+27>: mov %rcx,0x28(%rsp)
0xffffffff8021f71c <ia32_syscall+32>: mov %rax,0x20(%rsp)
0xffffffff8021f721 <ia32_syscall+37>: mov %gs:0x10,%r10
0xffffffff8021f72a <ia32_syscall+46>: sub $0x1fd8,%r10
0xffffffff8021f731 <ia32_syscall+53>: orl $0x2,0x14(%r10)
0xffffffff8021f736 <ia32_syscall+58>: testl $0x181,0x10(%r10)
0xffffffff8021f73e <ia32_syscall+66>: jne 0xffffffff8021f768 <ia32_tracesys>
End of assembler dump.
(gdb) disassemble ia32_tracesys
Dump of assembler code for function ia32_tracesys:
0xffffffff8021f768 <ia32_tracesys+0>: sub $0x30,%rsp
0xffffffff8021f76c <ia32_tracesys+4>: mov %rbx,0x28(%rsp)
0xffffffff8021f771 <ia32_tracesys+9>: mov %rbp,0x20(%rsp)
0xffffffff8021f776 <ia32_tracesys+14>: mov %r12,0x18(%rsp)
0xffffffff8021f77b <ia32_tracesys+19>: mov %r13,0x10(%rsp)
0xffffffff8021f780 <ia32_tracesys+24>: mov %r14,0x8(%rsp)
0xffffffff8021f785 <ia32_tracesys+29>: mov %r15,(%rsp)
0xffffffff8021f789 <ia32_tracesys+33>: movq $0xffffffffffffffda,0x50(%rsp)
0xffffffff8021f792 <ia32_tracesys+42>: mov %rsp,%rdi
0xffffffff8021f795 <ia32_tracesys+45>: callq 0xffffffff8020c684 <syscall_trace_enter>
0xffffffff8021f79a <ia32_tracesys+50>: mov 0x30(%rsp),%r11
0xffffffff8021f79f <ia32_tracesys+55>: mov 0x38(%rsp),%r10
0xffffffff8021f7a4 <ia32_tracesys+60>: mov 0x40(%rsp),%r9
0xffffffff8021f7a9 <ia32_tracesys+65>: mov 0x48(%rsp),%r8
0xffffffff8021f7ae <ia32_tracesys+70>: mov 0x58(%rsp),%rcx
0xffffffff8021f7b3 <ia32_tracesys+75>: mov 0x60(%rsp),%rdx
0xffffffff8021f7b8 <ia32_tracesys+80>: mov 0x68(%rsp),%rsi
0xffffffff8021f7bd <ia32_tracesys+85>: mov 0x70(%rsp),%rdi
0xffffffff8021f7c2 <ia32_tracesys+90>: mov 0x78(%rsp),%rax
0xffffffff8021f7c7 <ia32_tracesys+95>: mov (%rsp),%r15
0xffffffff8021f7cb <ia32_tracesys+99>: mov 0x8(%rsp),%r14
0xffffffff8021f7d0 <ia32_tracesys+104>: mov 0x10(%rsp),%r13
0xffffffff8021f7d5 <ia32_tracesys+109>: mov 0x18(%rsp),%r12
0xffffffff8021f7da <ia32_tracesys+114>: mov 0x20(%rsp),%rbp
0xffffffff8021f7df <ia32_tracesys+119>: mov 0x28(%rsp),%rbx
0xffffffff8021f7e4 <ia32_tracesys+124>: add $0x30,%rsp
0xffffffff8021f7e8 <ia32_tracesys+128>: jmpq 0xffffffff8021f740 <ia32_do_syscall>
End of assembler dump.
(gdb) disassemble ia32_do_syscall
Dump of assembler code for function ia32_do_syscall:
0xffffffff8021f740 <ia32_do_syscall+0>: cmp $0x13c,%eax
0xffffffff8021f745 <ia32_do_syscall+5>: ja 0xffffffff8021f7ed <ia32_badsys>
0xffffffff8021f74b <ia32_do_syscall+11>: mov %edi,%r8d
0xffffffff8021f74e <ia32_do_syscall+14>: mov %ebp,%r9d
0xffffffff8021f751 <ia32_do_syscall+17>: xchg %ecx,%esi
0xffffffff8021f753 <ia32_do_syscall+19>: mov %ebx,%edi
0xffffffff8021f755 <ia32_do_syscall+21>: mov %edx,%edx
0xffffffff8021f757 <ia32_do_syscall+23>: callq *0xffffffff804f6110(,%rax,8)
End of assembler dump.
After visiting ia32_tracesys, we jump on ia32_di_syscall, which makes a call :
callq *0xffffffff804f6110(,%rax,8)
promethee linux # grep ffffffff804f6110 /boot/System.map
ffffffff804f6110 R ia32_sys_call_table
And that work, we obtain the ia32_sys_call_table :p
In order to obtain it from system_call, sd & devik read 256 characters and
search pattern "\xff\x14\x85":
readkmem (sc_asm,sys_call_off,CALLOFF);
p = (char*)memmem (sc_asm,CALLOFF,"\xff\x14\x85",3);
sct = *(unsigned*)(p+3);
Why don't apply this method?
(gdb) x/xw ia32_do_syscall+23
0xffffffff8021f757 <ia32_do_syscall+23>: 0x10c514ff
We just search pattern "\xff\x14\xc5" from ia32_syscall.
If you have understood until then, you think, perhaps,there are errors.
Indeed, we normally have a jump to do with ia32_tracesys in order to arrive
in ia32_dosyscall. And it's right... but we can use the fact that these
functions are consecutive in memory for jump tracesys.
We obtain :
readkmem (sc_asm,sys_call_off,CALLOFF);
p = (char*)memmem (sc_asm,CALLOFF,"\xff\x14\xc5",3);
sct = *(unsigned long*)(p+3);
sct = (sct & 0x00000000ffffffff) | 0xffffffff00000000;
We apply a mask in order to ignore useless informations.
Bonus Track :
An other way to find ia32_sys_call_table is using the function walk_krstab
writing in phalanx rootkit because :
promethee linux # grep ia32_sys_call_table /boot/System.map
ffffffff804f6110 R ia32_sys_call_table
ffffffff8055feb0 r __ksymtab_ia32_sys_call_table
ffffffff8056c9d0 r __kstrtab_ia32_sys_call_table
For more informations, please look at the previous article.
--[ 5 Test
promethee linux # grep ia32_syscall /boot/System.map
ffffffff8021f6fc T ia32_syscall
ffffffff804f6af8 r ia32_syscall_end
promethee linux # grep ia32_sys_call_table /boot/System.map
ffffffff804f6110 R ia32_sys_call_table
ffffffff8055feb0 r __ksymtab_ia32_sys_call_table
ffffffff8056c9d0 r __kstrtab_ia32_sys_call_table
Try the first method :
promethee linux # zeppoo -s -d /dev/mem
Kernel : 2.6.17.11
Kernel : 2.617110
proc : x86_64
KERNEL_START 0xffffffff80000000
KERNEL_END 0xffffffff81000000
PAGE_OFFSET 0xffff810000000000
PAGE_MAX 0xffffffffffffffff
Memory : /dev/mem
IDTR BASE 0xffffffff8067e000 LIMIT 0xfff
idt80: flags = 238 flags=EE sel=10 off1=f6fc off2=8021
SYSTEM_CALL : 0xffffffff8021f6fc
Sys Call Table 0xffffffff804f6110
With the second method :
promethee linux # zeppoo -s -d /dev/mem -m
Kernel : 2.6.17.11
Kernel : 2.617110
proc : x86_64
KERNEL_START 0xffffffff80000000
KERNEL_END 0xffffffff81000000
PAGE_OFFSET 0xffff810000000000
PAGE_MAX 0xffffffffffffffff
Memory : /dev/mem
IDTR BASE 0xffffffff8067e000 LIMIT 0xfff
idt80: flags = 238 flags=EE sel=10 off1=f6fc off2=8021
SYSTEM_CALL : 0xffffffff8021f6fc
????kstrtab = 0xffffffff8056c9d0
??????Sys Call Table 0xffffffff804f6110
--[ 6 Conclusion
So, it's the end of this small article, the source code is avaible on
http://www.zeppoo.netand on the svn (repertory libzeppoo)
'svn checkout https://subversion.cru.fr/zeppoo/trunk/ zeppoo'.
Now that you have the sys_call_table, techniques which work on i386
can work on amd64...:)
Reference :
[1] http://phrack.org/archives/58/p58-0x07
Thanks :
Yperite, n0name, tbowan et aryliin pour me supporter :p
Translated by Yperite (aime pas les chauSettes)
"End of your world, the beginning of mine"
# milw0rm.com [2006-10-12]
