I am trying to reprogram the old-as-behemoth kernel interception (described in this Phrack question ).
The code to replace the call to a 32-bit function is as follows:
#define SYSMAPADDR 0x12345678
#define CODESIZE 7
static char acct_code[7] = "\xb8\x00\x00\x00\x00"
"\xff\xe0";
*(long*)&acct_code[1] = (long)my_hijacking_function;
memcpy(SYSMAPADDR, acct_code, CODESIZE);
But the 64-bit address of the original function is 0xffffffff12345678 (the kernel is located in small memory).
So will the (long) new function pointer match only 4 \ x00 bytes of the movl command?
Btw, please link to Can I replace the Linux kernel function with a module? and Overriding functionality with modules in the Linux kernel , the hacker method described above is more flexible (it can intercept non-extern functions => there is no need to recompile the kernel).