[转载]Keyboard Interrupt Hook using I/O APIC

bini

Keyboard Interrupt Hook using I/O APIC(ZT)

Keyboard Interrupt Hook using I/O APIC
) U6 Y. {! C1 N4 J8 D/ h
By: chpie
Keyboard Interrupt Hooking by manipulating the I/O APIC
( P. `1 [, @+ j( n( Ztested on the winXP, Pentium D Hyper-threading Enabled.
; X  x9 r2 j- W" h7 x+ m2 P5 b- k6 e
$ \8 T- |1 c3 u' z% g
( e# B* B; T: n4 O: gSummary :: Using the 8259a compatible PIC to be deliver the interrupt
# }6 e4 {, e+ d+ Isignal by Delivery mode of the I/O APIC to be the ExtINT,
the interrupt related by the IRQ 1 able to be not refer
  Z5 P& ]5 q6 L9 I: D! hthe I/O APIC's Redirection Table.

" R, e7 l( Y  @6 D- It is higher priority of the hooking than the direct
modification of the I/O APIC's vector.
- The vector can be hidden on the thread getting the keyboard
vector from the I/O APIC.
, k8 ^* F) U4 {  ]
" f1 O4 g9 K3 q; M9 g+ `Flow ::
# Q1 Y9 M& v3 p& t
1. IRQ 1 Assert !!!
% v. v" O8 g. d3 |( a2. The I/O APIC receives the signal and refers the I/O Redirection table.
2 R' t6 i" X; g* O2 C/ x3. Sending the signal from the destination Local APIC.
4. Local APIC pass the signal to the processor for its delivery mode ExtINT
5. A processor receives the signal.
8 y7 {) u+ i; m0 x( D6. The processor Assert the INTA signal.
7. The I/O APIC acknowledged.
% P& J5 d* ]  t# q' h7 U8. The processor Assert the second INTA signal.
& L" k3 U0 f) @- q5 _9. The I/O APIC delivers the signal to the 8259a compatible PIC
8 U9 Q' H. f8 ^& a( Xfor ExtINT to its Delivery mode.
10. 8259a compatible PIC sends 2 bytes after second INTA pulse.
11. The processor execute 2 bytes sended.
) y7 {7 g: G5 Z. f& P1 I7 S12. our interrupt handler executed.

) _- `7 _6 Y- X( j9 a/ H
( L  x/ D- G8 N' k5 F3 psourcecode and binary are available on the
$ J! {. a& C2 D4 shttp://www.rootkit.com/vault/chpie/apic_keyboard.zip