[转载]Keyboard Interrupt Hook using I/O APIC

bini

Keyboard Interrupt Hook using I/O APIC(ZT)

* n/ k& f- g; J5 P7 Q+ ?Keyboard Interrupt Hook using I/O APIC

- H! m) T$ `4 V0 G6 m  hBy: chpie
, j, L1 E: Z6 G$ b9 Y( \5 I+ pKeyboard Interrupt Hooking by manipulating the I/O APIC
# m; M5 N9 q/ m' e4 p, ~0 ]4 |tested on the winXP, Pentium D Hyper-threading Enabled.

7 J  M' o3 J1 X
Summary :: Using the 8259a compatible PIC to be deliver the interrupt
9 u+ g( v3 d! [+ ?+ T# c% x2 Vsignal by Delivery mode of the I/O APIC to be the ExtINT,
" C5 W. S8 }4 k9 [$ ]the interrupt related by the IRQ 1 able to be not refer
5 t, B0 W! w8 D% }% Ythe I/O APIC's Redirection Table.
+ _9 v: W: }6 M0 r. K' E
- It is higher priority of the hooking than the direct
# w8 e* c) J7 L6 t/ Y. F- @modification of the I/O APIC's vector.
- The vector can be hidden on the thread getting the keyboard
vector from the I/O APIC.

Flow ::
# H6 c' d% \' m* T; E& V
1. IRQ 1 Assert !!!
( w4 s) i% H. R  m2. The I/O APIC receives the signal and refers the I/O Redirection table.
3. Sending the signal from the destination Local APIC.
4. Local APIC pass the signal to the processor for its delivery mode ExtINT
* y, i$ c, G4 w6 ^5. A processor receives the signal.
) B$ G3 V2 B/ e! l* G0 B, K$ d6. The processor Assert the INTA signal.
3 ]1 A4 f. r* x; U! K7. The I/O APIC acknowledged.
8. The processor Assert the second INTA signal.
- x! R5 ]* d- ]& U. z  {9 _, l9. The I/O APIC delivers the signal to the 8259a compatible PIC
for ExtINT to its Delivery mode.
, L9 d7 Q. k8 z  a, e6 s0 p# u10. 8259a compatible PIC sends 2 bytes after second INTA pulse.
11. The processor execute 2 bytes sended.
12. our interrupt handler executed.


sourcecode and binary are available on the
- _  K! C8 D& z; n8 V# Bhttp://www.rootkit.com/vault/chpie/apic_keyboard.zip