事先聲明，本人菜鳥一枚，文中如有不正確之處，敬請大俠指正
.
(本文中舉例均以4.5版本的x86_64的linux內核為例)
字符驅動算是linux驅動裡面比較簡單的一種。說白了，就是可以對內存讀哇寫哇什麼的。既然是對內存讀寫，那為什麼還要驅動呢？簡單的
int a; a = 10;不就是對內存寫嗎？干嘛還要搞個驅動，這麼麻煩?
。
閒話扯到這，上代碼吧：
#include不好意思，注釋不多，但應該也不難讀懂#include #include #include #include #include #include #include #include #include #include MODULE_LICENSE("GPL"); MODULE_AUTHOR("GAO"); MODULE_DESCRIPTION("HELLO"); dev_t dev; extern struct task_struct init_task; static inline unsigned long size_inside_page(unsigned long start, unsigned long size) { unsigned long sz; sz = PAGE_SIZE - (start & (PAGE_SIZE - 1)); return min(sz, size); } static loff_t my_chr_dev_seek(struct file *file, loff_t offset, int orig) { loff_t ret; mutex_lock(&file_inode(file)->i_mutex); switch (orig) { case SEEK_CUR: offset += file->f_pos; case SEEK_SET: /* to avoid userland mistaking f_pos=-9 as -EBADF=-9 */ if (IS_ERR_VALUE((unsigned long long)offset)) { ret = -EOVERFLOW; break; } file->f_pos = offset; ret = file->f_pos; force_successful_syscall_return(); break; default: ret = -EINVAL; } mutex_unlock(&file_inode(file)->i_mutex); return ret; } static ssize_t do_write_kmem(unsigned long p, const char __user *buf, size_t count, loff_t *ppos) { ssize_t written, sz; unsigned long copied; written = 0; while (count > 0) { char *ptr; sz = size_inside_page(p, count); /* * On ia64 if a page has been mapped somewhere as uncached, then * it must also be accessed uncached by the kernel or data * corruption may occur. */ ptr = xlate_dev_kmem_ptr((char *)p); copied = copy_from_user(ptr, buf, sz); if (copied) { written += sz - copied; if (written) break; return -EFAULT; } buf += sz; p += sz; count -= sz; written += sz; } *ppos += written; return written; } static ssize_t my_chr_dev_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos) { unsigned long p = *ppos; ssize_t wrote = 0; ssize_t virtr = 0; char *kbuf; int err = 0; /* if (!capable(CAP_COMPROMISE_KERNEL)) return -EPERM; */ if (p < (unsigned long) high_memory) { unsigned long to_write = min_t(unsigned long, count, (unsigned long)high_memory - p); wrote = do_write_kmem(p, buf, to_write, ppos); if (wrote != to_write) return wrote; p += wrote; buf += wrote; count -= wrote; } if (count > 0) { kbuf = (char *)__get_free_page(GFP_KERNEL); if (!kbuf) return wrote ? wrote : -ENOMEM; while (count > 0) { unsigned long sz = size_inside_page(p, count); unsigned long n; /* if (!is_vmalloc_or_module_addr((void *)p)) { err = -ENXIO; break; } */ n = copy_from_user(kbuf, buf, sz); if (n) { err = -EFAULT; break; } memcpy((char *)p, kbuf, sz); /* vwrite(kbuf, (char *)p, sz); */ count -= sz; buf += sz; virtr += sz; p += sz; } free_page((unsigned long)kbuf); } *ppos = p; return virtr + wrote ? : err; } static ssize_t my_chr_dev_read(struct file *file, char __user *buf, size_t count, loff_t *ppos) { unsigned long p = *ppos; ssize_t low_count, read, sz; char *kbuf; int err = 0; read = 0; if (p < (unsigned long) high_memory) { low_count = count; if (count > (unsigned long)high_memory - p) low_count = (unsigned long)high_memory - p; while (low_count > 0) { sz = size_inside_page(p, low_count); /* * On ia64 if a page has been mapped somewhere as * uncached, then it must also be accessed uncached * by the kernel or data corruption may occur */ kbuf = xlate_dev_kmem_ptr((char *)p); if (copy_to_user(buf, kbuf, sz)) return -EFAULT; buf += sz; p += sz; read += sz; low_count -= sz; count -= sz; } } if (count > 0) { kbuf = (char *)__get_free_page(GFP_KERNEL); if (!kbuf) return -ENOMEM; while (count > 0) { sz = size_inside_page(p, count); memcpy(kbuf, (char *)p, sz); /* sz = vread(kbuf, (char *)p, sz); if (!sz) break; */ if (copy_to_user(buf, kbuf, sz)) { err = -EFAULT; break; } count -= sz; buf += sz; read += sz; p += sz; } free_page((unsigned long)kbuf); } *ppos = p; return read ? read : err; } static int my_chr_dev_open(struct inode *inode, struct file *filp) { filp->f_mode |= FMODE_UNSIGNED_OFFSET; return 0; } static const struct file_operations my_chr_dev_fops = { .llseek = my_chr_dev_seek, .read = my_chr_dev_read, .write = my_chr_dev_write, .open = my_chr_dev_open, .owner = THIS_MODULE, }; struct cdev my_chrdev; static int my_chrdev_init(void) { int ret; ret = alloc_chrdev_region(&dev, 0, 1, "my_chr_dev"); if (ret != 0) { printk(KERN_ALERT "error allocating device number\n"); return ret; } cdev_init(&my_chrdev, &my_chr_dev_fops); my_chrdev.owner = THIS_MODULE; ret = cdev_add(&my_chrdev, dev, 1); if (ret < 0) { printk(KERN_ALERT "adding charactor device failed\n"); unregister_chrdev_region(dev, 1); return ret; } printk(KERN_ALERT "hello, I'm coming\n"); printk(KERN_ALERT "init_task addr: %lx\n", (long *)(&init_task)); printk(KERN_ALERT "tasks list head offset: %lx\n", (long *)(&init_task.tasks)); printk(KERN_ALERT "pid offset: %lx\n", (long *)(&init_task.pid)); printk(KERN_ALERT "real_cred offset: %lx\n", (long *)(&init_task.real_cred)); return 0; } static void my_chrdev_exit(void) { unregister_chrdev_region(dev, 1); cdev_del(&my_chrdev); printk(KERN_ALERT "goodbye, dear world\n"); } module_init(my_chrdev_init); module_exit(my_chrdev_exit);
。每個進程的相關數據結構都由一個 struct task_struct 結構體維護（在include/linux/sched.h中定義，linux源碼可在lxr上去翻，關於lxr，問度娘。。。）。在這個結構體中，我們對其中三個成員變量比較感興趣：
struct list_head tasks; const struct cred __rcu *real_cred; pid_t pid;其中 const struct cred __rcu *real_cred 就是指向當前進程相關權限的數據結構的指針。pid就是進程id，tasks是個雙向鏈表頭，linux內核就是靠這個把所有的進程的 task_struct 結構鏈起來，也就是說，只要找到某一個進程的 task_struct 結構的地址，通過這個雙向鏈表就可以遍歷所有進程的task_struct結構了。現在我們需要做的就是遍歷所有進程的task_struct結構，取出進程id，看看是不是我們感興趣的那個進程，如果是的話，將 real_cred 指針指向的結構體裡面對應的權限改成 root 權限（其實就是把uid改成root的uid，root的uid其實就是0），就一切大功告成啦，哈哈。等等，剛才說要遍歷所有進程，得先知道某一個進程的task_struct結構體的地址，這茫茫人海，怎麼找啊
。幸好linux提供了一個 叫做 init_task 的task_struct 結構體。好像就是0號進程的task_struct結構體吧，反正這個結構體一開機就已經在內核空間存在了的。那就找下這個 init_task 變量的位置吧。以前利用
題外話，如果有興趣可以試著改改中斷向量表，肯定更刺激
