程序代码见附件
部分代码如下:
ldt_fs_t* Setup_LDT_Keeper(void)
{
struct modify_ldt_ldt_s array;
int ret;
ldt_fs_t* ldt_fs = (ldt_fs_t*) malloc(sizeof(ldt_fs_t));
if (!ldt_fs)
return NULL;
ldt_fs->fd = open("/dev/zero", O_RDWR);
if(ldt_fs->fd<0){
perror( "Cannot open /dev/zero for READ+WRITE. Check permissions! error: ");
return NULL;
}
fs_seg=
ldt_fs->fs_seg = mmap(NULL, getpagesize(), PROT_READ | PROT_WRITE, MAP_PRIVATE,
ldt_fs->fd, 0);
if (ldt_fs->fs_seg == (void*)-1)
{
perror("ERROR: Couldn't allocate memory for fs segment");
close(ldt_fs->fd);
free(ldt_fs);
return NULL;
}
*(void**)((char*)ldt_fs->fs_seg+0x18) = ldt_fs->fs_seg;
array.base_addr=(int)ldt_fs->fs_seg;
array.entry_number=TEB_SEL_IDX;
array.limit=array.base_addr+getpagesize()-1;
array.seg_32bit=1;
array.read_exec_only=0;
array.seg_not_present=0;
array.contents=MODIFY_LDT_CONTENTS_DATA;
array.limit_in_pages=0;
#ifdef __linux__
//ret=LDT_Modify(0x1, &array, sizeof(struct modify_ldt_ldt_s));
ret=modify_ldt(0x1, &array, sizeof(struct modify_ldt_ldt_s));
if(ret<0)
{
perror("install_fs");
printf("Couldn't install fs segment, expect segfault\n");
}
#endif /*linux*/ |