[转载]Keyboard Interrupt Hook using I/O APIC

bini

Keyboard Interrupt Hook using I/O APIC(ZT)
& h! m. J9 n" E5 @, f! x4 c( a7 P
Keyboard Interrupt Hook using I/O APIC

By: chpie
$ ~9 ?; K: E* y* V  `/ wKeyboard Interrupt Hooking by manipulating the I/O APIC
- h! T! ^( K0 W6 k2 gtested on the winXP, Pentium D Hyper-threading Enabled.


; ^- M% K) T. O' M& ?0 b$ @Summary :: Using the 8259a compatible PIC to be deliver the interrupt
3 p. C- b- c, h9 i0 H0 i: Usignal by Delivery mode of the I/O APIC to be the ExtINT,
& X5 d0 j3 k1 j5 X. m( d$ zthe interrupt related by the IRQ 1 able to be not refer
the I/O APIC's Redirection Table.
5 O9 v/ [3 ]4 m0 O% G. q
4 |; c% }0 z4 R" Z- D: W- It is higher priority of the hooking than the direct
& p' l' P- e. e; }1 Umodification of the I/O APIC's vector.
- The vector can be hidden on the thread getting the keyboard
$ e( Q, E& U: E2 G/ ]0 X% H' h% P8 Tvector from the I/O APIC.
8 g5 V1 c2 W7 t  Y2 L2 y+ e9 ^
Flow ::
6 b& u: G5 r) H2 y1 L5 n4 i
1. IRQ 1 Assert !!!
0 l, b1 U0 M( r: i2 a. _; c2. The I/O APIC receives the signal and refers the I/O Redirection table.
! a( W% h; g$ A5 c/ K$ y3. Sending the signal from the destination Local APIC.
. e: H% M9 k5 j' ]/ u4. Local APIC pass the signal to the processor for its delivery mode ExtINT
: G+ g+ B! k' g* s8 o8 t# N4 z5. A processor receives the signal.
5 f. y3 K$ I+ l% I) Q" c6. The processor Assert the INTA signal.
7. The I/O APIC acknowledged.
6 ?7 s/ }  u1 |5 b* Z4 ]. ?8. The processor Assert the second INTA signal.
9. The I/O APIC delivers the signal to the 8259a compatible PIC
for ExtINT to its Delivery mode.
. V! J3 x0 X2 V  B10. 8259a compatible PIC sends 2 bytes after second INTA pulse.
6 {4 L" z0 f0 z" h9 S6 q0 j11. The processor execute 2 bytes sended.
3 L/ i$ \+ w; N. H12. our interrupt handler executed.
: k9 G1 k' R1 ?8 r3 k0 {

: E3 L  \" m% P0 Psourcecode and binary are available on the
0 Q3 |" m& h- A. G& Phttp://www.rootkit.com/vault/chpie/apic_keyboard.zip