[转载]Keyboard Interrupt Hook using I/O APIC

bini

Keyboard Interrupt Hook using I/O APIC(ZT)
0 b8 _2 j1 r- C9 ]0 P4 e
Keyboard Interrupt Hook using I/O APIC
; ~0 i+ c  D: y8 b: g& r
1 ]+ v9 c) R) g  w* L- m" L9 ?By: chpie
Keyboard Interrupt Hooking by manipulating the I/O APIC
tested on the winXP, Pentium D Hyper-threading Enabled.
6 L8 s, S$ [0 G! m$ S
3 n$ p+ H9 i8 b  P( u
9 r6 Q* D  A( \Summary :: Using the 8259a compatible PIC to be deliver the interrupt
signal by Delivery mode of the I/O APIC to be the ExtINT,
, n* [5 _/ z& O6 cthe interrupt related by the IRQ 1 able to be not refer
the I/O APIC's Redirection Table.

7 u. Y8 A4 I$ D- D6 ^9 i1 h- It is higher priority of the hooking than the direct
modification of the I/O APIC's vector.
- The vector can be hidden on the thread getting the keyboard
3 N1 d' y- p' kvector from the I/O APIC.
- }5 |- T$ P: F( w$ s& y4 Q
* t2 ]% ~% Y! G8 b" jFlow ::
- R2 q* \( \  u5 ?
, X* W) P* T9 I! X: w1. IRQ 1 Assert !!!
$ p* Y3 j" j5 X/ i" A" ^: k, {2. The I/O APIC receives the signal and refers the I/O Redirection table.
6 b2 ]1 \2 y# d3 U; i3. Sending the signal from the destination Local APIC.
4. Local APIC pass the signal to the processor for its delivery mode ExtINT
5. A processor receives the signal.
# [2 `$ `0 V8 ]6. The processor Assert the INTA signal.
# A' d" p# {, A* i1 ~# D7. The I/O APIC acknowledged.
8. The processor Assert the second INTA signal.
9. The I/O APIC delivers the signal to the 8259a compatible PIC
% E; W0 e8 L" {( Mfor ExtINT to its Delivery mode.
4 A& l6 l2 K% g" s6 s2 v7 J7 I10. 8259a compatible PIC sends 2 bytes after second INTA pulse.
11. The processor execute 2 bytes sended.
12. our interrupt handler executed.

) J" }% M$ y8 L$ m
sourcecode and binary are available on the
http://www.rootkit.com/vault/chpie/apic_keyboard.zip