[转载]Keyboard Interrupt Hook using I/O APIC

bini

Keyboard Interrupt Hook using I/O APIC(ZT)
2 K; E& I  I- _  O& I) I) p
1 U$ h( Z1 b2 o% U3 FKeyboard Interrupt Hook using I/O APIC
- ?: Y8 C& O: E8 c+ g
By: chpie
# p# z, I- Z6 r+ oKeyboard Interrupt Hooking by manipulating the I/O APIC
tested on the winXP, Pentium D Hyper-threading Enabled.


Summary :: Using the 8259a compatible PIC to be deliver the interrupt
signal by Delivery mode of the I/O APIC to be the ExtINT,
4 q- t" [4 G! ]; e& A1 h/ Jthe interrupt related by the IRQ 1 able to be not refer
the I/O APIC's Redirection Table.
3 r% ?1 }6 y# S8 l! O7 @& j0 p
- It is higher priority of the hooking than the direct
modification of the I/O APIC's vector.
- The vector can be hidden on the thread getting the keyboard
0 x: t# m" ~, ~* @) cvector from the I/O APIC.

Flow ::

/ @/ @4 F* T4 u" X0 s0 T# B1. IRQ 1 Assert !!!
0 U" r$ N- H- u1 N7 |5 g/ c2. The I/O APIC receives the signal and refers the I/O Redirection table.
3. Sending the signal from the destination Local APIC.
+ S. {+ T3 `4 S4. Local APIC pass the signal to the processor for its delivery mode ExtINT
5. A processor receives the signal.
3 o6 t. a! P2 i9 x& k( o& e* e6. The processor Assert the INTA signal.
5 e) C1 k9 l: P) m2 h0 v: a7. The I/O APIC acknowledged.
8. The processor Assert the second INTA signal.
9. The I/O APIC delivers the signal to the 8259a compatible PIC
/ m. b5 ^; n" F, B& b- H8 zfor ExtINT to its Delivery mode.
8 S% W2 E% }0 t" g& @; d10. 8259a compatible PIC sends 2 bytes after second INTA pulse.
. g/ G6 D7 g: M8 o$ ^1 k11. The processor execute 2 bytes sended.
4 ]3 D( q2 R9 I6 q  U9 C7 t12. our interrupt handler executed.

$ q6 f+ Y4 ~$ F6 g/ X, P
sourcecode and binary are available on the
7 g. b- E7 D% Y9 z# x! _http://www.rootkit.com/vault/chpie/apic_keyboard.zip