URL: https://linuxfr.org/forums/linux-noyau/posts/lecture-devmem-sous-fedora Title: Lecture /dev/mem sous Fedora Authors: bibo Date: 2006年03月22日T17:00:45+01:00 Tags: fedora Score: 0 Salut à tous, La table des syscall, sys_call_table, n'étant plus exportée sous ma Fedora 2 (2.6.5-1.358), j'essaie de lire la partition /dev/mem (/dev/kmem est en access denied) en m'inspirant du rootkit Phalanx: #include <stdio.h> #include <stdlib.h> #include <sys/types.h> #include <sys/stat.h> #include <fcntl.h> #include <unistd.h> #include <sys/mman.h> struct idtr { unsigned short limit; unsigned int base; } __attribute__ ((packed)); struct idt { unsigned short off1; unsigned short sel; unsigned char none,flags; unsigned short off2; } __attribute__ ((packed)); unsigned sys_call_off; long idt_table; int main(int argc, char **argv){ struct idtr idtr; struct idt *idt; int fd; char *adr; unsigned long system_call; fd = open ("/dev/mem", O_RDWR); asm ("sidt %0" : "=m" (idtr)); printf("*[+] idtr.base: 0x%.08x\n",idtr.base); adr = mmap (0,500*1024*1024, PROT_READ, MAP_SHARED, fd, 0); if (adr==MAP_FAILED) { perror("mmap") ; exit(0) ;} printf("*[+] adr: 0x%.08x\n",adr); /*system_call = (*(short *) (adr + (idtr.base & 0x00ffffff) + (8 * 0x80) + 6) << 16) | *(short *) (adr + (idtr.base & 0x00ffffff) + (8 * 0x80) + 0); printf("system_call; 0x%.08x\n",system_call);*/ printf ("\n"); close (fd); return 0; } Le résultat est malheureusement :mmap: Bad address et dans /var/log/messages: localhost kernel: Access to 0x101000 by idt denied Est-ce qq'un saurait déjà pourquoi on se place à l'offset 500*1024*1024 (500 Mo) (pas trouver grd chose avec google) et ensuite pourquoi j'ai cette erreur? Est-encore une protection Fedora Merci pour l'aide Bibo