title: Intercepting a system call
body: <p>I have been trying to intercept the system call at the kernel level. I got the basic idea from this <a href="https://stackoverflow.com/questions/2103315/linux-kernel-system-call-hooking-example">question</a> . The system call I was trying to intercept was the <strong>fork()</strong>. So I found out the address of the <strong>sys_fork()</strong> from System.map and it turned out to be 0xc1010e0c.Now I wrote the module as below.</p>
  
  <pre><code>#include&lt;linux/kernel.h&gt;
  #include&lt;linux/module.h&gt;
  #include&lt;linux/unistd.h&gt;
  #include&lt;linux/semaphore.h&gt;
  #include&lt;asm/cacheflush.h&gt;
  MODULE_LICENSE("GPL");
  void **sys_call_table;
  asmlinkage int (*original_call)(struct pt_regs);
  asmlinkage int our_call(struct pt_regs regs)
  {
      printk("Intercepted sys_fork");
      return original_call(regs);
  } 
  static int __init p_entry(void)
  {
      printk(KERN_ALERT "Module Intercept inserted");
      sys_call_table=(void *)0xc1010e0c;
      original_call=sys_call_table[__NR_open];
      set_memory_rw((long unsigned int)sys_call_table,1);
      sys_call_table[__NR_open]=our_call;
      return 0;
  }
  static void __exit p_exit(void)
  {
      sys_call_table[__NR_open]=original_call;
      set_memory_ro((long unsigned int)sys_call_table,1);
      printk(KERN_ALERT "Module Intercept removed");
  }
  module_init(p_entry);
  module_exit(p_exit);
  </code></pre>
  
  <p>However , after compiling the module and when I tried to insert it to the kernel, I got the following from the dmesg output.
  <img src="https://i.stack.imgur.com/Hck1f.png" alt="enter image description here">
  <img src="https://i.stack.imgur.com/eFxB0.png" alt="enter image description here"></p>
  
  <p>Of course its not intercepting the system call.Can you help me figure out the problem? I am using <strong>3.2.0-4-686</strong> version of Linux kernel.</p>