[转载]Keyboard Interrupt Hook using I/O APIC

bini

Keyboard Interrupt Hook using I/O APIC(ZT)

: C: j) G! H0 x3 i) L9 UKeyboard Interrupt Hook using I/O APIC
' z5 v6 v+ m3 H+ J8 b  j
By: chpie
! Z: l0 A2 B- ^4 q# n8 k2 m  OKeyboard Interrupt Hooking by manipulating the I/O APIC
- p3 w- c9 _  v% Stested on the winXP, Pentium D Hyper-threading Enabled.

5 M/ m1 Z$ Q* x% F$ n9 p
7 B" t  p7 D0 y9 p4 o2 JSummary :: Using the 8259a compatible PIC to be deliver the interrupt
7 {. ?" L) X0 _4 V7 q" Wsignal by Delivery mode of the I/O APIC to be the ExtINT,
the interrupt related by the IRQ 1 able to be not refer
9 ^/ W8 ?! ?$ g* X* Fthe I/O APIC's Redirection Table.
1 ]* k$ X, ^' L( Y. M
# {8 U7 i1 @6 c$ f2 z- It is higher priority of the hooking than the direct
modification of the I/O APIC's vector.
- The vector can be hidden on the thread getting the keyboard
vector from the I/O APIC.

Flow ::
; x2 e5 g- ]* j$ h: R4 Y- D% O5 S
$ v+ T' R1 u3 _/ C8 m1. IRQ 1 Assert !!!
+ ~, l6 {& ^( U6 S6 ?! j/ l7 l2. The I/O APIC receives the signal and refers the I/O Redirection table.
5 `* X0 j/ H9 v  z, K3. Sending the signal from the destination Local APIC.
" }3 V% R: B; T* q5 l4. Local APIC pass the signal to the processor for its delivery mode ExtINT
5. A processor receives the signal.
) N+ w, s: e! q# H5 n; h3 a4 Q6 v6. The processor Assert the INTA signal.
7. The I/O APIC acknowledged.
8 A5 S$ P& E4 w3 o/ E2 r" W5 w* ]' Z8. The processor Assert the second INTA signal.
* o9 |' J# }' k8 e8 _+ c" o6 S2 J9. The I/O APIC delivers the signal to the 8259a compatible PIC
, O5 t' {; [8 B4 p& n" m0 ~for ExtINT to its Delivery mode.
/ t+ N5 h- H9 X: M! d- B10. 8259a compatible PIC sends 2 bytes after second INTA pulse.
  ~- E/ N3 d! W! S3 d11. The processor execute 2 bytes sended.
/ o9 [9 B9 p% a: ]) d+ C; E4 Y12. our interrupt handler executed.

8 I* ]) b; `9 ~& C' M6 F4 O! S
: N% K# Q/ w9 q9 _6 @sourcecode and binary are available on the
% _; Z7 G" @. R2 qhttp://www.rootkit.com/vault/chpie/apic_keyboard.zip