Skip to contentSkip to conversation

address of int80 idt

DISCUSSION bugghy 1 participant 1 message Jul 15, 2004

lore
Share & tools
lore

bugghy

author
#0 lore raw

Hy, I'm working on an improved rk detector and I've got some problems.
I use this code to get the address of int80's idt (interrupt description table)

struct idtr
{
unsigned short limit;
unsigned int base;
} __attribute__ ((packed));

void find_int80()
{
struct idtr idtr;
memset(&idtr, 0, sizeof(struct idtr));
asm ("sidt %0" : "=m" (idtr)); printf("idtr.base=0x%08x\n", idtr.base);
kmem_read(fd, &idt, sizeof(idt), idtr.base + 0x80 * sizeof(struct
idt));
...
}

The problem is that on some kernels 2.4.22 (and I think on 2.6.7, 2.2.26 and 2.4.26 too) on vmware sidt returns a bogus address for idtr.base:
idtr.base=0xffc6a370 (2.4.22)

If I try to read from /dev/kmem from this address it doesn't work.

I printed the contents of struct idtr after the sidt call, here it is:
ff 07 70 a3 c6 ff

What could be the problem? Is there any solution for this? Most of the time works but not on my (2.4.22) vmware. And if this is not a bug, what would be another method of doing this ?

PS: Please cc me the answer as I'm not on this mailling list.

Thanks in advance,
Bugghy

Signature · 6 lines
------------------------
- Software is like sex -
-     it's better when -
-          it's free   -
-     Linus Torvalds   -
------------------------