SCTF-flying_kernel/flying_kernel.c at main · pray77/SCTF-flying_kernel · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
#include <linux/module.h>
#include <linuxersion.h>
#include <linux/kernel.h>
#include <linuxpes.h>
#include <linux/kdev_t.h>
#include <linux/fs.h>
#include <linux/device.h>
#include <linuxev.h>
#include <asm/uaccess.h>
#include <linuxab.h>

static char *sctf_buf = NULL;
static struct class *devClass;
static struct cdev cdev;
static dev_t seven_dev_no;

static ssize_t seven_write(struct file *filp, const char __user *buf, u_int64_t len, loff_t *f_pos);

static long seven_ioctl(struct file *filp, unsigned int cmd, unsigned long arg);

static int seven_open(struct inode *i, struct file *f);

static int seven_close(struct inode *i, struct file *f);


static struct file_operations seven_fops =
        {
                .owner = THIS_MODULE,
                .open = seven_open,
                .release = seven_close,
                .write = seven_write,
                .unlocked_ioctl = seven_ioctl
        };


static int __init seven_init(void)
{
    if (alloc_chrdev_region(&seven_dev_no, 0, 1, "seven") < 0)
    {
        return -1;
    }
    if ((devClass = class_create(THIS_MODULE, "chardrv")) == NULL)
    {
        unregister_chrdev_region(seven_dev_no, 1);
        return -1;
    }
    if (device_create(devClass, NULL, seven_dev_no, NULL, "seven") == NULL)
    {
        class_destroy(devClass);
        unregister_chrdev_region(seven_dev_no, 1);
        return -1;
    }
    cdev_init(&cdev, &seven_fops);
    if (cdev_add(&cdev, seven_dev_no, 1) == -1)
    {
        device_destroy(devClass, seven_dev_no);
        class_destroy(devClass);
        unregister_chrdev_region(seven_dev_no, 1);
        return -1;
    }
    return 0;
}


static void __exit seven_exit(void)
{
    unregister_chrdev_region(seven_dev_no, 1);
    cdev_del(&cdev);
}


ssize_t seven_write(struct file *filp, const char __user *buf, u_int64_t len, loff_t *f_pos)
{
    if (sctf_buf)
    {
        if (len <= 0x80)
        {
            printk(KERN_INFO "write()\n" );
            u_int64_t offset = 0x80 - len;
            copy_from_user((u_int64_t)((char *)sctf_buf) + offset, buf, len);
        }
    }
    else
    {
        printk("What are you doing?");
    }

    return len;
}


// ioctl函数命令控制
long seven_ioctl(struct file *filp, unsigned int cmd, unsigned long size)
{
    int retval = 0;
    switch (cmd) {

        case 0x5555://add
            if (size == 0x80)
            {
                sctf_buf = (char *)kmalloc(size,GFP_KERNEL);
                printk("Add Success!\n");
            }
            else
            {
                printk("It's not that simple\n");
            }
            break;

        case 0x6666:
            if (sctf_buf)
            {
                kfree(sctf_buf);
            }
            else
            {
                printk("What are you doing?");
                retval = -1;
            }
            break;

        case 0x7777:
            if (sctf_buf)
            {
                printk(sctf_buf);
            }
            break;

        default:
            retval = -1;
            break;
    }

    return retval;
}


static int seven_open(struct inode *i, struct file *f)
{
    printk(KERN_INFO "open()\n");
    return 0;
}

static int seven_close(struct inode *i, struct file *f)
{
    printk(KERN_INFO "close()\n");
    return 0;
}

module_init(seven_init);
module_exit(seven_exit);

MODULE_LICENSE("GPL");