Linux函数调用劫持的方法总结(带图）

参考文章：

https://www.cnblogs.com/LittleHann/p/3854977.html

https://lwn.net/Articles/132196/

https://blog.csdn.net/andy205214/article/details/77148573

https://www.cnblogs.com/arnoldlu/p/9752061.html

1.概览

Ring3中劫持
1. 基于环境变量LD_PRELOAD的动态库劫持
Ring0中劫持
1. Kernel Inline Hook
2. syscall table修改
3. 内核调试机制Kprobe

2. Ring3函数调用劫持

在Linux中，动态库加载的时候，会按照以下顺序进行搜索：LD_PRELOAD >LD_LIBRARY_PATH >/etc/ld.so.cache>/lib>/usr/lib

方法原理：通过LD_PERELOAD设置编写自己的so库函数在原正常函数前执行

例子：劫持gets()函数

#mermaid-svg-o2lgcCYmd77zXwys .label{font-family:'trebuchet ms', verdana, arial;font-family:var(--mermaid-font-family);fill:#333;color:#333}#mermaid-svg-o2lgcCYmd77zXwys .label text{fill:#333}#mermaid-svg-o2lgcCYmd77zXwys .node rect,#mermaid-svg-o2lgcCYmd77zXwys .node circle,#mermaid-svg-o2lgcCYmd77zXwys .node ellipse,#mermaid-svg-o2lgcCYmd77zXwys .node polygon,#mermaid-svg-o2lgcCYmd77zXwys .node path{fill:#ECECFF;stroke:#9370db;stroke-width:1px}#mermaid-svg-o2lgcCYmd77zXwys .node .label{text-align:center;fill:#333}#mermaid-svg-o2lgcCYmd77zXwys .node.clickable{cursor:pointer}#mermaid-svg-o2lgcCYmd77zXwys .arrowheadPath{fill:#333}#mermaid-svg-o2lgcCYmd77zXwys .edgePath .path{stroke:#333;stroke-width:1.5px}#mermaid-svg-o2lgcCYmd77zXwys .flowchart-link{stroke:#333;fill:none}#mermaid-svg-o2lgcCYmd77zXwys .edgeLabel{background-color:#e8e8e8;text-align:center}#mermaid-svg-o2lgcCYmd77zXwys .edgeLabel rect{opacity:0.9}#mermaid-svg-o2lgcCYmd77zXwys .edgeLabel span{color:#333}#mermaid-svg-o2lgcCYmd77zXwys .cluster rect{fill:#ffffde;stroke:#aa3;stroke-width:1px}#mermaid-svg-o2lgcCYmd77zXwys .cluster text{fill:#333}#mermaid-svg-o2lgcCYmd77zXwys div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:'trebuchet ms', verdana, arial;font-family:var(--mermaid-font-family);font-size:12px;background:#ffffde;border:1px solid #aa3;border-radius:2px;pointer-events:none;z-index:100}#mermaid-svg-o2lgcCYmd77zXwys .actor{stroke:#ccf;fill:#ECECFF}#mermaid-svg-o2lgcCYmd77zXwys text.actor>tspan{fill:#000;stroke:none}#mermaid-svg-o2lgcCYmd77zXwys .actor-line{stroke:grey}#mermaid-svg-o2lgcCYmd77zXwys .messageLine0{stroke-width:1.5;stroke-dasharray:none;stroke:#333}#mermaid-svg-o2lgcCYmd77zXwys .messageLine1{stroke-width:1.5;stroke-dasharray:2, 2;stroke:#333}#mermaid-svg-o2lgcCYmd77zXwys #arrowhead path{fill:#333;stroke:#333}#mermaid-svg-o2lgcCYmd77zXwys .sequenceNumber{fill:#fff}#mermaid-svg-o2lgcCYmd77zXwys #sequencenumber{fill:#333}#mermaid-svg-o2lgcCYmd77zXwys #crosshead path{fill:#333;stroke:#333}#mermaid-svg-o2lgcCYmd77zXwys .messageText{fill:#333;stroke:#333}#mermaid-svg-o2lgcCYmd77zXwys .labelBox{stroke:#ccf;fill:#ECECFF}#mermaid-svg-o2lgcCYmd77zXwys .labelText,#mermaid-svg-o2lgcCYmd77zXwys .labelText>tspan{fill:#000;stroke:none}#mermaid-svg-o2lgcCYmd77zXwys .loopText,#mermaid-svg-o2lgcCYmd77zXwys .loopText>tspan{fill:#000;stroke:none}#mermaid-svg-o2lgcCYmd77zXwys .loopLine{stroke-width:2px;stroke-dasharray:2, 2;stroke:#ccf;fill:#ccf}#mermaid-svg-o2lgcCYmd77zXwys .note{stroke:#aa3;fill:#fff5ad}#mermaid-svg-o2lgcCYmd77zXwys .noteText,#mermaid-svg-o2lgcCYmd77zXwys .noteText>tspan{fill:#000;stroke:none}#mermaid-svg-o2lgcCYmd77zXwys .activation0{fill:#f4f4f4;stroke:#666}#mermaid-svg-o2lgcCYmd77zXwys .activation1{fill:#f4f4f4;stroke:#666}#mermaid-svg-o2lgcCYmd77zXwys .activation2{fill:#f4f4f4;stroke:#666}#mermaid-svg-o2lgcCYmd77zXwys .mermaid-main-font{font-family:"trebuchet ms", verdana, arial;font-family:var(--mermaid-font-family)}#mermaid-svg-o2lgcCYmd77zXwys .section{stroke:none;opacity:0.2}#mermaid-svg-o2lgcCYmd77zXwys .section0{fill:rgba(102,102,255,0.49)}#mermaid-svg-o2lgcCYmd77zXwys .section2{fill:#fff400}#mermaid-svg-o2lgcCYmd77zXwys .section1,#mermaid-svg-o2lgcCYmd77zXwys .section3{fill:#fff;opacity:0.2}#mermaid-svg-o2lgcCYmd77zXwys .sectionTitle0{fill:#333}#mermaid-svg-o2lgcCYmd77zXwys .sectionTitle1{fill:#333}#mermaid-svg-o2lgcCYmd77zXwys .sectionTitle2{fill:#333}#mermaid-svg-o2lgcCYmd77zXwys .sectionTitle3{fill:#333}#mermaid-svg-o2lgcCYmd77zXwys .sectionTitle{text-anchor:start;font-size:11px;text-height:14px;font-family:'trebuchet ms', verdana, arial;font-family:var(--mermaid-font-family)}#mermaid-svg-o2lgcCYmd77zXwys .grid .tick{stroke:#d3d3d3;opacity:0.8;shape-rendering:crispEdges}#mermaid-svg-o2lgcCYmd77zXwys .grid .tick text{font-family:'trebuchet ms', verdana, arial;font-family:var(--mermaid-font-family)}#mermaid-svg-o2lgcCYmd77zXwys .grid path{stroke-width:0}#mermaid-svg-o2lgcCYmd77zXwys .today{fill:none;stroke:red;stroke-width:2px}#mermaid-svg-o2lgcCYmd77zXwys .task{stroke-width:2}#mermaid-svg-o2lgcCYmd77zXwys .taskText{text-anchor:middle;font-family:'trebuchet ms', verdana, arial;font-family:var(--mermaid-font-family)}#mermaid-svg-o2lgcCYmd77zXwys .taskText:not([font-size]){font-size:11px}#mermaid-svg-o2lgcCYmd77zXwys .taskTextOutsideRight{fill:#000;text-anchor:start;font-size:11px;font-family:'trebuchet ms', verdana, arial;font-family:var(--mermaid-font-family)}#mermaid-svg-o2lgcCYmd77zXwys .taskTextOutsideLeft{fill:#000;text-anchor:end;font-size:11px}#mermaid-svg-o2lgcCYmd77zXwys .task.clickable{cursor:pointer}#mermaid-svg-o2lgcCYmd77zXwys .taskText.clickable{cursor:pointer;fill:#003163 !important;font-weight:bold}#mermaid-svg-o2lgcCYmd77zXwys .taskTextOutsideLeft.clickable{cursor:pointer;fill:#003163 !important;font-weight:bold}#mermaid-svg-o2lgcCYmd77zXwys .taskTextOutsideRight.clickable{cursor:pointer;fill:#003163 !important;font-weight:bold}#mermaid-svg-o2lgcCYmd77zXwys .taskText0,#mermaid-svg-o2lgcCYmd77zXwys .taskText1,#mermaid-svg-o2lgcCYmd77zXwys .taskText2,#mermaid-svg-o2lgcCYmd77zXwys .taskText3{fill:#fff}#mermaid-svg-o2lgcCYmd77zXwys .task0,#mermaid-svg-o2lgcCYmd77zXwys .task1,#mermaid-svg-o2lgcCYmd77zXwys .task2,#mermaid-svg-o2lgcCYmd77zXwys .task3{fill:#8a90dd;stroke:#534fbc}#mermaid-svg-o2lgcCYmd77zXwys .taskTextOutside0,#mermaid-svg-o2lgcCYmd77zXwys .taskTextOutside2{fill:#000}#mermaid-svg-o2lgcCYmd77zXwys .taskTextOutside1,#mermaid-svg-o2lgcCYmd77zXwys .taskTextOutside3{fill:#000}#mermaid-svg-o2lgcCYmd77zXwys .active0,#mermaid-svg-o2lgcCYmd77zXwys .active1,#mermaid-svg-o2lgcCYmd77zXwys .active2,#mermaid-svg-o2lgcCYmd77zXwys .active3{fill:#bfc7ff;stroke:#534fbc}#mermaid-svg-o2lgcCYmd77zXwys .activeText0,#mermaid-svg-o2lgcCYmd77zXwys .activeText1,#mermaid-svg-o2lgcCYmd77zXwys .activeText2,#mermaid-svg-o2lgcCYmd77zXwys .activeText3{fill:#000 !important}#mermaid-svg-o2lgcCYmd77zXwys .done0,#mermaid-svg-o2lgcCYmd77zXwys .done1,#mermaid-svg-o2lgcCYmd77zXwys .done2,#mermaid-svg-o2lgcCYmd77zXwys .done3{stroke:grey;fill:#d3d3d3;stroke-width:2}#mermaid-svg-o2lgcCYmd77zXwys .doneText0,#mermaid-svg-o2lgcCYmd77zXwys .doneText1,#mermaid-svg-o2lgcCYmd77zXwys .doneText2,#mermaid-svg-o2lgcCYmd77zXwys .doneText3{fill:#000 !important}#mermaid-svg-o2lgcCYmd77zXwys .crit0,#mermaid-svg-o2lgcCYmd77zXwys .crit1,#mermaid-svg-o2lgcCYmd77zXwys .crit2,#mermaid-svg-o2lgcCYmd77zXwys .crit3{stroke:#f88;fill:red;stroke-width:2}#mermaid-svg-o2lgcCYmd77zXwys .activeCrit0,#mermaid-svg-o2lgcCYmd77zXwys .activeCrit1,#mermaid-svg-o2lgcCYmd77zXwys .activeCrit2,#mermaid-svg-o2lgcCYmd77zXwys .activeCrit3{stroke:#f88;fill:#bfc7ff;stroke-width:2}#mermaid-svg-o2lgcCYmd77zXwys .doneCrit0,#mermaid-svg-o2lgcCYmd77zXwys .doneCrit1,#mermaid-svg-o2lgcCYmd77zXwys .doneCrit2,#mermaid-svg-o2lgcCYmd77zXwys .doneCrit3{stroke:#f88;fill:#d3d3d3;stroke-width:2;cursor:pointer;shape-rendering:crispEdges}#mermaid-svg-o2lgcCYmd77zXwys .milestone{transform:rotate(45deg) scale(0.8, 0.8)}#mermaid-svg-o2lgcCYmd77zXwys .milestoneText{font-style:italic}#mermaid-svg-o2lgcCYmd77zXwys .doneCritText0,#mermaid-svg-o2lgcCYmd77zXwys .doneCritText1,#mermaid-svg-o2lgcCYmd77zXwys .doneCritText2,#mermaid-svg-o2lgcCYmd77zXwys .doneCritText3{fill:#000 !important}#mermaid-svg-o2lgcCYmd77zXwys .activeCritText0,#mermaid-svg-o2lgcCYmd77zXwys .activeCritText1,#mermaid-svg-o2lgcCYmd77zXwys .activeCritText2,#mermaid-svg-o2lgcCYmd77zXwys .activeCritText3{fill:#000 !important}#mermaid-svg-o2lgcCYmd77zXwys .titleText{text-anchor:middle;font-size:18px;fill:#000;font-family:'trebuchet ms', verdana, arial;font-family:var(--mermaid-font-family)}#mermaid-svg-o2lgcCYmd77zXwys g.classGroup text{fill:#9370db;stroke:none;font-family:'trebuchet ms', verdana, arial;font-family:var(--mermaid-font-family);font-size:10px}#mermaid-svg-o2lgcCYmd77zXwys g.classGroup text .title{font-weight:bolder}#mermaid-svg-o2lgcCYmd77zXwys g.clickable{cursor:pointer}#mermaid-svg-o2lgcCYmd77zXwys g.classGroup rect{fill:#ECECFF;stroke:#9370db}#mermaid-svg-o2lgcCYmd77zXwys g.classGroup line{stroke:#9370db;stroke-width:1}#mermaid-svg-o2lgcCYmd77zXwys .classLabel .box{stroke:none;stroke-width:0;fill:#ECECFF;opacity:0.5}#mermaid-svg-o2lgcCYmd77zXwys .classLabel .label{fill:#9370db;font-size:10px}#mermaid-svg-o2lgcCYmd77zXwys .relation{stroke:#9370db;stroke-width:1;fill:none}#mermaid-svg-o2lgcCYmd77zXwys .dashed-line{stroke-dasharray:3}#mermaid-svg-o2lgcCYmd77zXwys #compositionStart{fill:#9370db;stroke:#9370db;stroke-width:1}#mermaid-svg-o2lgcCYmd77zXwys #compositionEnd{fill:#9370db;stroke:#9370db;stroke-width:1}#mermaid-svg-o2lgcCYmd77zXwys #aggregationStart{fill:#ECECFF;stroke:#9370db;stroke-width:1}#mermaid-svg-o2lgcCYmd77zXwys #aggregationEnd{fill:#ECECFF;stroke:#9370db;stroke-width:1}#mermaid-svg-o2lgcCYmd77zXwys #dependencyStart{fill:#9370db;stroke:#9370db;stroke-width:1}#mermaid-svg-o2lgcCYmd77zXwys #dependencyEnd{fill:#9370db;stroke:#9370db;stroke-width:1}#mermaid-svg-o2lgcCYmd77zXwys #extensionStart{fill:#9370db;stroke:#9370db;stroke-width:1}#mermaid-svg-o2lgcCYmd77zXwys #extensionEnd{fill:#9370db;stroke:#9370db;stroke-width:1}#mermaid-svg-o2lgcCYmd77zXwys .commit-id,#mermaid-svg-o2lgcCYmd77zXwys .commit-msg,#mermaid-svg-o2lgcCYmd77zXwys .branch-label{fill:lightgrey;color:lightgrey;font-family:'trebuchet ms', verdana, arial;font-family:var(--mermaid-font-family)}#mermaid-svg-o2lgcCYmd77zXwys .pieTitleText{text-anchor:middle;font-size:25px;fill:#000;font-family:'trebuchet ms', verdana, arial;font-family:var(--mermaid-font-family)}#mermaid-svg-o2lgcCYmd77zXwys .slice{font-family:'trebuchet ms', verdana, arial;font-family:var(--mermaid-font-family)}#mermaid-svg-o2lgcCYmd77zXwys g.stateGroup text{fill:#9370db;stroke:none;font-size:10px;font-family:'trebuchet ms', verdana, arial;font-family:var(--mermaid-font-family)}#mermaid-svg-o2lgcCYmd77zXwys g.stateGroup text{fill:#9370db;fill:#333;stroke:none;font-size:10px}#mermaid-svg-o2lgcCYmd77zXwys g.statediagram-cluster .cluster-label text{fill:#333}#mermaid-svg-o2lgcCYmd77zXwys g.stateGroup .state-title{font-weight:bolder;fill:#000}#mermaid-svg-o2lgcCYmd77zXwys g.stateGroup rect{fill:#ECECFF;stroke:#9370db}#mermaid-svg-o2lgcCYmd77zXwys g.stateGroup line{stroke:#9370db;stroke-width:1}#mermaid-svg-o2lgcCYmd77zXwys .transition{stroke:#9370db;stroke-width:1;fill:none}#mermaid-svg-o2lgcCYmd77zXwys .stateGroup .composit{fill:white;border-bottom:1px}#mermaid-svg-o2lgcCYmd77zXwys .stateGroup .alt-composit{fill:#e0e0e0;border-bottom:1px}#mermaid-svg-o2lgcCYmd77zXwys .state-note{stroke:#aa3;fill:#fff5ad}#mermaid-svg-o2lgcCYmd77zXwys .state-note text{fill:black;stroke:none;font-size:10px}#mermaid-svg-o2lgcCYmd77zXwys .stateLabel .box{stroke:none;stroke-width:0;fill:#ECECFF;opacity:0.7}#mermaid-svg-o2lgcCYmd77zXwys .edgeLabel text{fill:#333}#mermaid-svg-o2lgcCYmd77zXwys .stateLabel text{fill:#000;font-size:10px;font-weight:bold;font-family:'trebuchet ms', verdana, arial;font-family:var(--mermaid-font-family)}#mermaid-svg-o2lgcCYmd77zXwys .node circle.state-start{fill:black;stroke:black}#mermaid-svg-o2lgcCYmd77zXwys .node circle.state-end{fill:black;stroke:white;stroke-width:1.5}#mermaid-svg-o2lgcCYmd77zXwys #statediagram-barbEnd{fill:#9370db}#mermaid-svg-o2lgcCYmd77zXwys .statediagram-cluster rect{fill:#ECECFF;stroke:#9370db;stroke-width:1px}#mermaid-svg-o2lgcCYmd77zXwys .statediagram-cluster rect.outer{rx:5px;ry:5px}#mermaid-svg-o2lgcCYmd77zXwys .statediagram-state .divider{stroke:#9370db}#mermaid-svg-o2lgcCYmd77zXwys .statediagram-state .title-state{rx:5px;ry:5px}#mermaid-svg-o2lgcCYmd77zXwys .statediagram-cluster.statediagram-cluster .inner{fill:white}#mermaid-svg-o2lgcCYmd77zXwys .statediagram-cluster.statediagram-cluster-alt .inner{fill:#e0e0e0}#mermaid-svg-o2lgcCYmd77zXwys .statediagram-cluster .inner{rx:0;ry:0}#mermaid-svg-o2lgcCYmd77zXwys .statediagram-state rect.basic{rx:5px;ry:5px}#mermaid-svg-o2lgcCYmd77zXwys .statediagram-state rect.divider{stroke-dasharray:10,10;fill:#efefef}#mermaid-svg-o2lgcCYmd77zXwys .note-edge{stroke-dasharray:5}#mermaid-svg-o2lgcCYmd77zXwys .statediagram-note rect{fill:#fff5ad;stroke:#aa3;stroke-width:1px;rx:0;ry:0}:root{--mermaid-font-family: '"trebuchet ms", verdana, arial';--mermaid-font-family: "Comic Sans MS", "Comic Sans", cursive}#mermaid-svg-o2lgcCYmd77zXwys .error-icon{fill:#522}#mermaid-svg-o2lgcCYmd77zXwys .error-text{fill:#522;stroke:#522}#mermaid-svg-o2lgcCYmd77zXwys .edge-thickness-normal{stroke-width:2px}#mermaid-svg-o2lgcCYmd77zXwys .edge-thickness-thick{stroke-width:3.5px}#mermaid-svg-o2lgcCYmd77zXwys .edge-pattern-solid{stroke-dasharray:0}#mermaid-svg-o2lgcCYmd77zXwys .edge-pattern-dashed{stroke-dasharray:3}#mermaid-svg-o2lgcCYmd77zXwys .edge-pattern-dotted{stroke-dasharray:2}#mermaid-svg-o2lgcCYmd77zXwys .marker{fill:#333}#mermaid-svg-o2lgcCYmd77zXwys .marker.cross{stroke:#333}:root { --mermaid-font-family: "trebuchet ms", verdana, arial;}#mermaid-svg-o2lgcCYmd77zXwys {color: rgba(0, 0, 0, 0.75);font: ;}程序hook.solibc.soLD_PRELOAD优先链接(此处执行额外的操作)dlsym调用原函数正常执行，返回值执行完成，返回值程序hook.solibc.so

1. 编写自定义的动态链接库源码hook.c

#include<stdio.h>
#include<dlfcn.h> //用于搜索原函数/* 要求：函数的形式必须和原函数一样（返回类型，函数名，函数参数）*/
char* gets(char* str){/* 自定义的操作区域 */printf("hook gets! str: %s\n ",str);/* 调用原函数*/typeof(gets)  *func;//函数指针func=dlsym(RTLD_NEXT,"gets");//查找malloc函数位置  dlsym:在打开的动态库里找一个函数return (*func)(str); //调用原函数执行
}

2.编译成共享库

gcc hook.c -fPIC -shared -ldl -D_GNU_SOURCE -o hook.so

-fPIC: 编译器就输出位置无关目标码.适用于动态连接
-shared: 生成共享目标文件

3.设置LD_PRELOAD

通过设置环境变量的方法

临时设置 export LD_PRELOAD=$PWD/hook.so

永久设置
修改profile文件加入 export LD_PRELOAD=${YOUR PATH}/hook.so

修改.bashrc文件加入 export LD_PRELOAD=${YOUR PATH}/hook.so

编写一个测试程序test.c

#include <stdio.h>int main(){char str[20]="\0";printf("请输入\n");gets(str);return 0;
}

函数调用劫持效果

3.Ring0系统调用劫持

3.1 Kernel Inline Hook

原理：一个系统调用会调用子函数的，这是通过段内偏移的方式完成的，我们可以通过设置这个偏移指向我们Hook的原函数

例子：劫持sys_read系统调用

3.2 sys_call_table修改方法进行系统调用劫持

原理：将系统调用表中对应的服务例程修改为自己Hook函数的地址

例子：劫持fork()

查找syscall_table位置的方法

代码模拟出call *sys_call_table(,%eax,4)，然后查看机器码查找
通过/boot/System.map-2.6.32-358.el6.i686文件查找
通过/proc/kallsyms进行搜索

3.3 内核调试机制kprobe进行系统调用劫持

Kprobe介绍

轻量级内核调试机制

Kprobe两种使用方法

模块加载
debugfs接口

Kprobe三种探测手段

kprobe 基本的探测手段基础可以在函数内任意位置放置探测点
jprobe 探测在函数的入口，可以方便的获得函数参数，但是每个函数只能有一个探针
Kretprobe 探测在函数的返回值

例子:劫持execve()


#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/kprobes.h>int jsys_execve(const char __user *filename,const char __user *const __user *__argv,const char __user *const __user *__envp)
{pr_info("jprobe: execve: %s\n", filename);/* Always end with a call to jprobe_return(). */jprobe_return();return 0;
}static struct jprobe jprobe_execve = {.entry= jsys_execve,.kp = {.symbol_name   = "sys_execve",},
};static int __init mymodule_init(void){int ret;/* 挂载 hook */ret = register_jprobe(&jprobe_execve);if (ret < 0) {pr_info("register_jprobe failed, returned %d\n", ret);return -1;}pr_info("Planted jprobe execve at %p, handler addr %p\n",jprobe_execve.kp.addr, jprobe_execve.entry);return 0;
}static void __exit mymodule_exit(void)
{unregister_jprobe(&jprobe_execve);
}module_init(mymodule_init)
module_exit(mymodule_exit)
MODULE_LICENSE("GPL");

运行效果：

4.总结

方法	优点	缺点
LD_PRELOAD	针对函数调用，简单	1.容易发生循环调用问题 2. 部分情况不适用（文件的SUID或SGID位被置1，加载的时候会忽略LD_PRELOAD）
Kernel Inline Hook		实现比较难
sys_call_table修改	负载小	需要查找系统调用表地址
kprobe	内核支持使用简单安全性高	需要内核特性keprobe特性支持，一些系统需要重新编译内核