Keyboard Interrupt Hook using I/O APIC

最新推荐文章于 2019-12-10 16:53:11 发布

转载最新推荐文章于 2019-12-10 16:53:11 发布 · 1.2k 阅读

标签

#keyboard #hook #signal #vector #thread

收录于

windows底层核心編程专栏收录该内容

743 篇文章

订阅专栏

本文介绍了一种通过操纵I/O APIC来实现键盘中断信号劫持的方法，并在Windows XP和Pentium D超线程环境下进行了测试。该方法通过8259A兼容的PIC将中断信号作为ExtINT传递给I/O APIC，从而绕过I/O APIC重定向表的限制。

By: chpie

Keyboard Interrupt Hooking by manipulating the I/O APIC
tested on the winXP, Pentium D Hyper-threading Enabled.

Summary :: Using the 8259a compatible PIC to be deliver the interrupt
signal by Delivery mode of the I/O APIC to be the ExtINT,
the interrupt related by the IRQ 1 able to be not refer
the I/O APIC's Redirection Table.

- It is higher priority of the hooking than the direct
modification of the I/O APIC's vector.
- The vector can be hidden on the thread getting the keyboard
vector from the I/O APIC.

Flow ::

1. IRQ 1 Assert !!!
2. The I/O APIC receives the signal and refers the I/O Redirection table.
3. Sending the signal from the destination Local APIC.
4. Local APIC pass the signal to the processor for its delivery mode ExtINT
5. A processor receives the signal.
6. The processor Assert the INTA signal.
7. The I/O APIC acknowledged.
8. The processor Assert the second INTA signal.
9. The I/O APIC delivers the signal to the 8259a compatible PIC
for ExtINT to its Delivery mode.
10. 8259a compatible PIC sends 2 bytes after second INTA pulse.
11. The processor execute 2 bytes sended.
12. our interrupt handler executed.

sourcecode and binary are available on the
http://www.rootkit.com/vault/chpie/apic_keyboard.zip