[转载]Keyboard Interrupt Hook using I/O APIC

bini

Keyboard Interrupt Hook using I/O APIC(ZT)

0 B: x' [6 X+ T4 f# f$ FKeyboard Interrupt Hook using I/O APIC

+ m% D/ d  h  {0 M+ p& F% BBy: chpie
Keyboard Interrupt Hooking by manipulating the I/O APIC
0 j7 z4 Y2 o& A  @) Z# U4 }tested on the winXP, Pentium D Hyper-threading Enabled.
1 z4 `- N! a& I8 [
  H4 C9 ~4 l2 r8 @& J" I
Summary :: Using the 8259a compatible PIC to be deliver the interrupt
signal by Delivery mode of the I/O APIC to be the ExtINT,
the interrupt related by the IRQ 1 able to be not refer
+ u! k, \5 W! |6 H" X( pthe I/O APIC's Redirection Table.
6 y2 \3 D- O. o
- It is higher priority of the hooking than the direct
modification of the I/O APIC's vector.
7 {3 r0 }: Q* U+ F" v- The vector can be hidden on the thread getting the keyboard
4 q( z. `5 ^+ M0 qvector from the I/O APIC.

1 Z- @+ z  l  ]9 ]. T& c6 qFlow ::
, I" K" ~7 T* E8 f, j! k  k9 a' D
1. IRQ 1 Assert !!!
4 M9 Q2 P) w# I: d" O, Q# h2. The I/O APIC receives the signal and refers the I/O Redirection table.
  \9 @$ X, G1 O; U- |3. Sending the signal from the destination Local APIC.
4. Local APIC pass the signal to the processor for its delivery mode ExtINT
5. A processor receives the signal.
6. The processor Assert the INTA signal.
" a! N4 _& e1 A" C4 b" X6 L7 T7. The I/O APIC acknowledged.
+ @; ^4 c% F4 L& B. b6 m( G8. The processor Assert the second INTA signal.
9. The I/O APIC delivers the signal to the 8259a compatible PIC
for ExtINT to its Delivery mode.
10. 8259a compatible PIC sends 2 bytes after second INTA pulse.
6 G. l* f- r* |6 W0 Y11. The processor execute 2 bytes sended.
12. our interrupt handler executed.
! T; U  R/ ]5 e  V6 v+ N
* E+ ~5 q* |; ~% Q8 r" O
+ V) |9 u: o* f. @sourcecode and binary are available on the
http://www.rootkit.com/vault/chpie/apic_keyboard.zip