[转载]Keyboard Interrupt Hook using I/O APIC

bini

Keyboard Interrupt Hook using I/O APIC(ZT)

Keyboard Interrupt Hook using I/O APIC
0 R- p& d8 D% c5 B) [
By: chpie
( h* [. r9 W( L) n4 E% n2 E, N# U6 iKeyboard Interrupt Hooking by manipulating the I/O APIC
" i5 {( I4 ]/ O) i7 d, _5 z( _# qtested on the winXP, Pentium D Hyper-threading Enabled.

& |6 Z5 \( i0 ?) \! z! m
Summary :: Using the 8259a compatible PIC to be deliver the interrupt
" }# X, x8 [, C( K& y/ P* fsignal by Delivery mode of the I/O APIC to be the ExtINT,
: Z6 H' M- q. g( v# ^2 M0 Fthe interrupt related by the IRQ 1 able to be not refer
% g2 Z* T3 o$ g- j2 wthe I/O APIC's Redirection Table.

6 ^1 D& F: t. M8 m- It is higher priority of the hooking than the direct
, }) t4 e0 g, c3 H) c: p4 bmodification of the I/O APIC's vector.
- The vector can be hidden on the thread getting the keyboard
vector from the I/O APIC.

9 h+ h" O5 W6 T$ u, R" f/ u2 X  xFlow ::

1. IRQ 1 Assert !!!
2. The I/O APIC receives the signal and refers the I/O Redirection table.
7 y* P) M# m9 I) I3. Sending the signal from the destination Local APIC.
4. Local APIC pass the signal to the processor for its delivery mode ExtINT
1 a( b% o  r2 \0 M1 A5. A processor receives the signal.
  J5 B- b7 P$ F( ^5 x; \6. The processor Assert the INTA signal.
7. The I/O APIC acknowledged.
$ H( E9 d3 S* v$ ?8. The processor Assert the second INTA signal.
$ i, t( Z# c2 C$ D! u6 X9. The I/O APIC delivers the signal to the 8259a compatible PIC
- {1 ]: z5 j: `# T2 u9 ufor ExtINT to its Delivery mode.
' B" i& }! T& Q; Z  O10. 8259a compatible PIC sends 2 bytes after second INTA pulse.
11. The processor execute 2 bytes sended.
12. our interrupt handler executed.

! p8 s3 s+ g3 m% g+ X6 ]4 H1 a
sourcecode and binary are available on the
: t$ a2 c: U- M: [! Dhttp://www.rootkit.com/vault/chpie/apic_keyboard.zip