Storing SYSCALL functions in array of function pointers

Vis

I'm working on a project in which I have to hook 80%-90% of the system call functions on OSX (10.10.5). I'm doing this from a kernel extension. Since I have to (un)hook many functions, I want to store the original kernel function into an array of function pointers, to that I can do a quick lookup into the array in order to restore the original function upon unhooking.

    int (*kern_open)(struct proc *, struct open_args *, int *);
    int mon_open(struct proc *p, struct open_args *uap, int *retval) {
    kern_open = sysent[SYS_open].sy_call;
    sysent[SYS_open].sy_call = mon_open;

This works, the kern_open function is used to store the original kernel function that s called upon a system call. mon_open is my hooking function.

What I want to achieve is the following; so that upon unhooking, I can just iterate thru the KernSysCall array and restore the functions.

    // global array of function pointers that all have the same func def.
    static int (*KernSysCall[SYS_MAXSYSCALL])(struct proc *, struct args *, int *);
    KernSysCall[SYS_open] = sysent[SYS_open].sy_call;
    sysent[SYS_open].sy_call = mon_open;

Restoring: sysent[SYS_open].sy_call = KernSysCall[SYS_open];

However, storing the original kernel function inside the array of function pointers is causing a kernel panic. I haven't been able to attach the lldb yet, due to a error: KDP_REATTACH failed error. I'm hoping someone knows what is causing the kernel panic.

Below is a log of the kernel panic.

Anonymous UUID:       052D64D2-A43C-99F8-D221-B591991E54AF

Wed Nov 11 12:55:06 2015

*** Panic Report ***
panic(cpu 0 caller 0xffffff80093f0024): Kernel trap at 0x0000000000000000, type 14=page fault, registers:
CR0: 0x0000000080010033, CR2: 0x0000000000000000, CR3: 0x00000000769bb018, CR4: 0x00000000001606e0
RAX: 0x0000000000000000, RBX: 0xffffff80115e3fc0, RCX: 0x0000000000000001, RDX: 0xffffff80115e3fc0
RSP: 0xffffff8068dabaf8, RBP: 0xffffff8068dabf50, RSI: 0xffffff80115e3f80, RDI: 0xffffff8010059cf0
R8:  0xffffff7f8afaccdf, R9:  0xffffff8009ae2a18, R10: 0xffffff8009939740, R11: 0x0000000000000000
R12: 0xffffff8010059cf0, R13: 0x0000000000000005, R14: 0xffffff80115e3f80, R15: 0xffffff801188b480
RFL: 0x0000000000010282, RIP: 0x0000000000000000, CS:  0x0000000000000008, SS:  0x0000000000000010
Fault CR2: 0x0000000000000000, Error code: 0x0000000000000010, Fault CPU: 0x0 VMM

Backtrace (CPU 0), Frame : Return Address
0xffffff8068dab790 : 0xffffff80092e4ed1 mach_kernel : _panic + 0xd1
0xffffff8068dab810 : 0xffffff80093f0024 mach_kernel : _kernel_trap + 0x664
0xffffff8068dab9e0 : 0xffffff800940de53 mach_kernel : trap_from_kernel + 0x26
0xffffff8068daba00 : 0x0 
0xffffff8068dabf50 : 0xffffff800982c0c1 mach_kernel : _unix_syscall64 + 0x2f1
0xffffff8068dabfb0 : 0xffffff800940e656 mach_kernel : _hndl_unix_scall64 + 0x16

BSD process name corresponding to current thread: xpcproxy
Boot args: debug=0x14e kext-dev-mode=1 -v keepsyms=1 kmem=1

Mac OS version:
14F27

Kernel version:
Darwin Kernel Version 14.5.0: Wed Jul 29 02:26:53 PDT 2015; root:xnu-2782.40.9~1/DEVELOPMENT_X86_64
Kernel UUID: C75BDFDD-9F27-3694-BB80-73CF991C13D8
Kernel slide:     0x0000000009000000
Kernel text base: 0xffffff8009200000
__HIB  text base: 0xffffff8009100000
System model name: VMware7,1 (Mac-66F35F19FE2A0D05)

System uptime in nanoseconds: 251264993940
last loaded kext at 249789197520: my.kext   1 (addr 0xffffff7f8afa9000, size 57344)
last unloaded kext at 116769666233: com.apple.driver.AppleFileSystemDriver  3.0.1 (addr 0xffffff7f8aed3000, size 16384)
loaded kexts:
my.kext 1

[more kexts here]

In request, the code for mon_open():

int
mon_open(struct proc *p, struct open_args *uap, int *r) {
    int error;
    char processname[MAXCOMLEN+1];
    char intercepted_path[MAXPATHLEN];

    pid_t pid = proc_pid(p);

    proc_name(pid, processname, sizeof(processname));

    size_t dummy = 0;
    error = copyinstr((void *)uap->path, (void *)intercepted_path, MAXPATHLEN, &dummy);
    if (!error) {
        printf("[MYKEXT] open called with path: %s, PID: %d, processname: %s\n", intercepted_path, pid, processname);
    }

    return kern_open(p, uap, r);
}

Thank you very much in advance!

Vis

Amazingly stupid, I forgot to point kern_open (the return value of mon_open) to the function pointer in the array. kern_open was NULL, so this caused the NULL-pointer exception. Now the array of function pointers is working correctly.

@pmdj, thank you very much for your help.

Collected from the Internet

Please contact [email protected] to delete if infringement.

edited at
0

Comments

0 comments
Login to comment

Related

From Dev

trouble storing pointers in an array of pointers

From Dev

Storing a container of pointers to member functions

From Dev

Storing function pointers in a std::map

From Dev

Trouble retrieving and storing pointers to OpenGL functions manually

From Dev

Functions vs function pointers

From Dev

Pointers to functions / Function Tables

From Dev

Array of constant pointers to functions

From Dev

Array of Function-Pointers with different functions return value (in C)

From Dev

Functions and function pointers in C++

From Dev

Passing "array of pointers" to function

From Dev

C array of function pointers

From Dev

Free array of function pointers

From Dev

Passing An Array of Pointers to Function

From Dev

Accessing array of function pointers

From Dev

Array of Function Pointers in JavaScript?

From Dev

C -- Array of Function Pointers

From Dev

Malloc an array of function pointers

From Dev

Passing array of pointers into a function

From Dev

C -- Array of Function Pointers

From Dev

Filling an array of pointers in a function

From Dev

Free array of function pointers

From Dev

Passing An Array of Pointers to Function

From Dev

Passing array of pointers into a function

From Dev

array of pointers as argument in c functions

From Dev

Storing objects in an array in javascript is storing the function

From Dev

Array of Array of function pointers in C

From Dev

Storing closure functions within array using loop

From Dev

PHP: Storing callback functions with arguments on array

From Dev

Storing function pointers with different types c++ boost::bind