[转载]Keyboard Interrupt Hook using I/O APIC

bini

Keyboard Interrupt Hook using I/O APIC(ZT)

  `' z# e2 `; A) y# H$ UKeyboard Interrupt Hook using I/O APIC

, L& I* a3 ^5 S" \4 y2 r$ pBy: chpie
Keyboard Interrupt Hooking by manipulating the I/O APIC
( e5 E6 R6 {* O: E( mtested on the winXP, Pentium D Hyper-threading Enabled.

/ X: l, E' B. |7 Z: L7 m, W$ {1 b
Summary :: Using the 8259a compatible PIC to be deliver the interrupt
signal by Delivery mode of the I/O APIC to be the ExtINT,
8 q0 }& L/ H7 dthe interrupt related by the IRQ 1 able to be not refer
# c8 W  E3 q: K: z0 N, K7 Cthe I/O APIC's Redirection Table.
- [2 c$ M" J$ P  x% c3 `8 d
- It is higher priority of the hooking than the direct
/ b4 Q5 n5 a; k$ P. G- Bmodification of the I/O APIC's vector.
' G9 l% L' A2 j' K- The vector can be hidden on the thread getting the keyboard
vector from the I/O APIC.

Flow ::

1. IRQ 1 Assert !!!
2. The I/O APIC receives the signal and refers the I/O Redirection table.
3. Sending the signal from the destination Local APIC.
4. Local APIC pass the signal to the processor for its delivery mode ExtINT
1 f; \0 O. G0 _5. A processor receives the signal.
- ?: W! }4 {% |4 g6 s% l3 \4 t6. The processor Assert the INTA signal.
  A& O2 n  i. I$ ~2 D4 e5 P7. The I/O APIC acknowledged.
8. The processor Assert the second INTA signal.
9. The I/O APIC delivers the signal to the 8259a compatible PIC
$ j% {/ S# D4 H9 Rfor ExtINT to its Delivery mode.
% r/ z4 D2 o/ D0 `$ z/ g3 i10. 8259a compatible PIC sends 2 bytes after second INTA pulse.
11. The processor execute 2 bytes sended.
+ t7 @& A' R  r$ ?12. our interrupt handler executed.
# `2 f; }' o. ~/ ?/ _- U5 r  F. e
5 C7 {5 \/ W; m4 j: A2 m* [) C: P
sourcecode and binary are available on the
7 s: V/ O4 N7 n$ f( P3 C8 m! chttp://www.rootkit.com/vault/chpie/apic_keyboard.zip