[转载]Keyboard Interrupt Hook using I/O APIC

bini

Keyboard Interrupt Hook using I/O APIC(ZT)

2 U+ l. h- t# ^3 E6 vKeyboard Interrupt Hook using I/O APIC

By: chpie
Keyboard Interrupt Hooking by manipulating the I/O APIC
' v0 m0 g4 J) T+ e# d# A1 htested on the winXP, Pentium D Hyper-threading Enabled.


) k/ ^3 w2 P4 LSummary :: Using the 8259a compatible PIC to be deliver the interrupt
; d$ L8 }# F8 z! }$ a1 n+ g, Rsignal by Delivery mode of the I/O APIC to be the ExtINT,
8 N- Y/ a* L$ u! J1 ^the interrupt related by the IRQ 1 able to be not refer
4 S- `) [$ B& H+ `0 h' Qthe I/O APIC's Redirection Table.

- It is higher priority of the hooking than the direct
modification of the I/O APIC's vector.
- The vector can be hidden on the thread getting the keyboard
vector from the I/O APIC.
0 m2 N+ o& U. I1 `4 C. H5 ?
3 f) n1 b1 Q4 G$ K! |3 yFlow ::
, a2 V$ j4 k% ^, \( e" ^
* U  F5 T/ H0 I, F5 }1. IRQ 1 Assert !!!
! n6 c% W" B4 E2 v5 p( C6 l2. The I/O APIC receives the signal and refers the I/O Redirection table.
- b' T* s/ G* ^9 A# @6 O  Y3. Sending the signal from the destination Local APIC.
9 F- v6 m3 @* X' [7 y; a4. Local APIC pass the signal to the processor for its delivery mode ExtINT
5. A processor receives the signal.
6. The processor Assert the INTA signal.
2 ?0 r; V; N9 v; Q5 ^, r7. The I/O APIC acknowledged.
# N; D6 g; A9 }! R- G  i8. The processor Assert the second INTA signal.
' ?  l; v& y' C8 H, Y1 g9. The I/O APIC delivers the signal to the 8259a compatible PIC
for ExtINT to its Delivery mode.
  f+ E1 N7 P9 a/ t; b; Z10. 8259a compatible PIC sends 2 bytes after second INTA pulse.
: Y% m! E' T% t- F% L6 v11. The processor execute 2 bytes sended.
6 _) i8 i! ^  @1 d% X4 c12. our interrupt handler executed.
, |7 M3 h; M. a7 {

/ E' O% X/ j" s- a, i1 ?sourcecode and binary are available on the
http://www.rootkit.com/vault/chpie/apic_keyboard.zip