一、hello world

編寫hello.c

#include <linux/module.h>

MODULE_LICENSE("GPL");

static int __init syscall_init(void){

    printk("hello world !\n");

    return 0;
}

static void __exit syscall_release(void){

    printk("bye bye !\n");
}

module_init(syscall_init);
module_exit(syscall_release);

編寫Makefile

obj-m := hello.o
CURRENT_PATH := $(shell pwd)
LINUX_KERNEL := $(shell uname -r)
LINUX_KERNEL_PATH := /usr/src/linux-headers-$(LINUX_KERNEL)

all:
        make -C $(LINUX_KERNEL_PATH) M=$(CURRENT_PATH) modules
clean:
        make -C $(LINUX_KERNEL_PATH) M=$(CURRENT_PATH) clean

編譯和測試：

sudo make

安裝模組：

insmod hello.ko

解除安裝模組：

rmmod hello

檢視輸出資訊：

dmesg 或tail -f /var/log/syslog

#######################################################################

資料：

syscall函式原型 https://elixir.bootlin.com/linux/v5.0/source/include/linux/syscalls.h

syscall呼叫號https://elixir.bootlin.com/linux/v5.0/source/arch/sh/include/uapi/asm/unistd_64.h

syscall引數 http://blog.rchapman.org/posts/Linux_System_Call_Table_for_x86_64/

ftrace hookhttps://xz.aliyun.com/t/2948

hook in higher kernel versionhttps://stackoverflow.com/questions/48912653/how-to-hook-sys-clone-in-newer-linux-kernel/48965890

https://stackoverflow.com/questions/47115802/hooking-sys-execve-on-linux-kernel-4-6-or-higher

hook方案比較https://xz.aliyun.com/t/2947

案例：

https://github.com/sssokar/Proxy

https://github.com/milabs/awesome-linux-rootkits

https://github.com/m0nad/Diamorphine