Listing 1 Printing the addresses of some commonly attacked system calls

#define __KERNEL__

#define MODULE
#define MODVERSIONS
#include <linux/module.h>
#include <linux/modversions.h>
#include <linux/kernel.h>
#include <linux/sched.h>
#include <linux/init.h>
#include <asm/unistd.h>

MODULE_LICENSE("GPL");

struct {
    ushort  limit;
    ulong   base;
} __attribute__ ((packed)) idtr;

struct {
     ushort  off1;
     ushort  sel;
     unsigned char   none, flags;
     ushort  off2;
} __attribute__ ((packed)) idt;


void sys_mapper(char **sys_call_table) {
    printk("sys_exit       %x\n",sys_call_table[__NR_exit]);
    printk("sys_fork       %x\n",sys_call_table[__NR_fork]);
    printk("sys_read       %x\n",sys_call_table[__NR_read]);
    printk("sys_write      %x\n",sys_call_table[__NR_write]);
    printk("sys_open       %x\n",sys_call_table[__NR_open]);
    printk("sys_close      %x\n",sys_call_table[__NR_close]);
    printk("sys_creat      %x\n",sys_call_table[__NR_creat]);
    printk("sys_link       %x\n",sys_call_table[__NR_link]);
    printk("sys_unlink     %x\n",sys_call_table[__NR_unlink]);
    printk("sys_execve     %x\n",sys_call_table[__NR_execve]);
    printk("sys_chdir      %x\n",sys_call_table[__NR_chdir]);
    printk("sys_setuid     %x\n",sys_call_table[__NR_setuid]);
    printk("sys_mkdir      %x\n",sys_call_table[__NR_mkdir]);
    printk("sys_rmdir      %x\n",sys_call_table[__NR_rmdir]);
    printk("sys_stat       %x\n",sys_call_table[__NR_stat]);
    printk("sys_stat64     %x\n",sys_call_table[__NR_stat64]);
    printk("sys_getdents   %x\n",sys_call_table[__NR_getdents]);
    printk("sys_getdents64 %x\n",sys_call_table[__NR_getdents64]);
}

int init_module(void) {
    unsigned char code[512];
    unsigned long int80;
    char *p,*sct;
    int i;

    asm("sidt %0" : "=m" (idtr));
    memcpy(&idt,idtr.base+0x80*(sizeof(idt)),sizeof(idt));
    int80 = idt.off1 | (idt.off2 << 16);    
    memcpy(&code,int80,sizeof(code));

    p = (void *)int80;
    for (i=0;i<50;i++) {
        if ((p[0] == '\xff') && (p[1] == '\x14') && (p[2] == '\x85')) {
            sct = *(unsigned long *)(p+3);
            break;
        }
        ++p;
    }    
    sys_mapper((char *)sct);
    return 0;
}

void cleanup_module(void) {
}