Finding the sys call table in memory 64-bit on 4.x.x Kernel
<p>I'm trying to write a simple kernel module to find the sys_call_table in Linux and am having some trouble. I found a basic guide for 32-bit Linux here: <a href="https://memset.wordpress.com/2011/03/18/syscall-hijacking-dynamically-obtain-syscall-table-address-kernel-2-6-x-2/" rel="nofollow">https://memset.wordpress.com/2011/03/18/syscall-hijacking-dynamically-obtain-syscall-table-address-kernel-2-6-x-2/</a>. I tried to adapt it to a modern 64-bit kernel and am having some trouble. My code is here:</p>

<pre><code>#include&lt;linux/init.h&gt;
#include&lt;linux/module.h&gt;
#include&lt;linux/kernel.h&gt;
#include&lt;linux/errno.h&gt;
#include&lt;linux/types.h&gt;
#include&lt;linux/unistd.h&gt;
#include&lt;asm/current.h&gt;
#include&lt;linux/sched.h&gt;
#include&lt;linux/syscalls.h&gt;
#include&lt;linux/utsname.h&gt;
//#include&lt;asm/system.h&gt;
#include&lt;linux/slab.h&gt;

MODULE_LICENSE("GPL");

#define START_MEM   PAGE_OFFSET
#define END_MEM     ULLONG_MAX

unsigned long long *syscall_table;

unsigned long long **find(void) {
  unsigned long long **sctable;
  unsigned long long int i = START_MEM;
  while ( i &lt; END_MEM) {
      sctable = (unsigned long long **)i;
      if ( sctable[__NR_close] == (unsigned long long *) sys_close) {
          printk(KERN_WARNING "------%p---------\n", (unsigned long long *) sys_close);
          return &amp;sctable[0];
      }
      i += sizeof(void *);
  }
  return NULL;
}


static int __init init_load(void) {
  syscall_table = (unsigned long long *) find();
  if (syscall_table != NULL) {
    printk(KERN_WARNING "syscall table found at %p\n", syscall_table);
  }
  else {
    printk(KERN_WARNING "syscall table not found!");

  }
  return 0;
}

static void __exit exit_unload(void) {
  return;
}

module_init(init_load);
module_exit(exit_unload);
</code></pre>

<p>I compile the code using a simple makefile, no warnings or notices come up and here is what is printed (after insmod-ing):</p>

<pre><code>$ dmesg
&lt;snip&gt;
[39592.352209] ------ffffffff8120a2a0---------
[39592.352214] syscall table found at ffff880001a001c0
&lt;/snip&gt;
</code></pre>

<p>So all seems well right? But then I check out where the sys_call_table is by running:</p>

<pre><code>punk@punk-vbox:~/dev/m-dev/rootkit-examples$ sudo cat /boot/System.map-4.4.0-36-generic | grep sys_call_table
ffffffff81a001c0 R sys_call_table
ffffffff81a01500 R ia32_sys_call_table
</code></pre>

<p>..meaning that my code seemingly gets the location of the sys_call_table totally wrong. So ffff880001a001c0 instead of ffffffff81a001c0.</p>

<p>I'm not entirely sure where to start debugging this. Am I doing something obviously wrong here? What would be a good first step to debugging this on my own? I'm fairly new to writing kernel modules and any help would be appreciated!</p>