[转载]Keyboard Interrupt Hook using I/O APIC

bini

Keyboard Interrupt Hook using I/O APIC(ZT)
" t1 R, M  Q% e8 O9 s8 z
" l! D8 A/ t3 LKeyboard Interrupt Hook using I/O APIC
+ F& _9 W- S3 N, g
By: chpie
) `2 |. |; E+ F6 BKeyboard Interrupt Hooking by manipulating the I/O APIC
tested on the winXP, Pentium D Hyper-threading Enabled.
) J: v! v' f9 `& v7 f- j* a0 _

1 O$ R& W; T; r: i8 p! U* dSummary :: Using the 8259a compatible PIC to be deliver the interrupt
signal by Delivery mode of the I/O APIC to be the ExtINT,
7 D/ R) h' Y  r& Tthe interrupt related by the IRQ 1 able to be not refer
the I/O APIC's Redirection Table.

- It is higher priority of the hooking than the direct
modification of the I/O APIC's vector.
- The vector can be hidden on the thread getting the keyboard
vector from the I/O APIC.
) L" G$ _' l$ D2 u4 D
/ `7 x, {9 j% j6 m; i! zFlow ::
3 G% @0 n8 x+ h- }
4 r$ Z/ h1 m* t4 j: a( ^# r1. IRQ 1 Assert !!!
+ Z! `0 F, W# N7 i& R7 Y1 b- x( T2. The I/O APIC receives the signal and refers the I/O Redirection table.
# u1 B: U5 \4 j% p6 D. r) B3. Sending the signal from the destination Local APIC.
$ A) V: Q9 H* y5 ?# ^! A( u$ Z4. Local APIC pass the signal to the processor for its delivery mode ExtINT
- a2 F9 k1 D/ m5 D/ m8 q5. A processor receives the signal.
3 t" l* s# I6 `! @* _# @" T: m6 S6. The processor Assert the INTA signal.
7. The I/O APIC acknowledged.
* G& B2 j5 y, M9 L. R8. The processor Assert the second INTA signal.
9. The I/O APIC delivers the signal to the 8259a compatible PIC
for ExtINT to its Delivery mode.
10. 8259a compatible PIC sends 2 bytes after second INTA pulse.
0 ?. j) {9 E! X/ a( F11. The processor execute 2 bytes sended.
6 i: H% Z# m1 q2 c/ w3 S+ T12. our interrupt handler executed.

- E$ K8 O( e4 M$ g! b1 h) x3 \1 @
) y4 z2 \% c' _# qsourcecode and binary are available on the
: `$ F* l) R6 G) H# t% t$ {http://www.rootkit.com/vault/chpie/apic_keyboard.zip