int get_syscalltable_int80() { struct { unsigned short limit; unsigned int base; } __attribute__ ((packed)) idtr; struct { unsigned short off1; unsigned short sel; unsigned char none,flags; unsigned short off2; } __attribute__ ((packed)) idt; int ret, i; unsigned int scall, sys_call_off; char *s, sig[3] = {'\xFF', '\x14', '\x85'}; ret = -1; asm ("sidt %0" : "=m" (idtr)); memcpy(&idt, idtr.base + 8 * 0x80, sizeof(idt)); sys_call_off = (idt.off2 << 16) | idt.off1; s = (char *)sys_call_off; printk("syscall_enter at %X\n", (unsigned int)s); for(i = 0; i < 512; i++) { if(!memcmp(s, sig, 3)) break; s++; } if(i == 512) { printk(KERN_WARNING "lorax: failed to find syscall address\n"); return -1; } s += 3; sys_call_table = *(unsigned int*)s; printk(KERN_WARNING "lorax: found syscall at %X, sys_call_table at %X\n", (unsigned int)s, sys_call_table); return 0; }