Sunday, June 29, 2008

Kernel Extension, Interrupts and Hooks

----------------------------------Kernel Extension, Interrupts and Hooks--------------


Kernel Extension

This is just a DLL. Why we need to call it as Kernel Extension? What is the difference between Kernel extension and Device Drivers?

-----User application can load the device drivers and unload, but Kernel extension is not like that. User cannot load or unload it. Once kernel is loaded into memory then Kernel will responsible to load the kernel extensions into memory, Extensions are permanently resides in memory along with kernel, but user cannot call the kernel extension(it is possible but need to give interrupt framework or something like that). But user can load, call & unload device drivers dynamically


How can I write a Kernel Extension?

----- Writing Kernel extension is very simple we need to add a macro in our source file. The macro is


DECLARE_STANDARD_EXTENSION ()
{
// Create Object for your extension class
//return the object
}

The above macro will be replaced by preprocessor like,


#define DECLARE_STANDARD_EXTENSION()
GLREF_C TInt InitExtension();
TInt KernelModuleEntry(TInt aReason)
{
if (aReason==KModuleEntryReasonExtensionInit0)
return KErrNone;
if (aReason!=KModuleEntryReasonExtensionInit1)
return KErrArgument;
return InitExtension();
}
GLDEF_C TInt InitExtension()


-----Inside this InitExtension function we need to create object for our class. This function will be called by kernel once kernel is in upstate. Now kernel extension is ready. How to use the kernel extension?


Kernel Extension code example:


Example obj;
void newISRMain()
{
Obj->newISR();
}
Class Example
{
Public:
Example();
void newISR();
};
void Example::newISR()
{

}
Example::Example()
{
Kern::setNewISR();
}
DECLARE_STATDARD_EXTENSION()
{
Obj = new Example();
}


This is the layout of kernel extension.


-----This Kernel extension is in Kernel space, how can we use this kernel extension? This is the place Kernel HOOKs coming into picture. Before going to discuss about HOOK, we need to revise DOS operating system’s interrupt handling.


About TSR:


https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi0YhvHC_VlIbnlmx7j3weyJBm7dw51qC62SaC2ywgNe5MqsOEnJyfm3TJm4gr6VQ5TCRRX-K2MfcEqf_66TvyervWVPE9mmTJsXybNIpoc9BziUkdjngboj_gEJ82ftjS_d0CtTSsulr09/s1600-h/Slide36.GIF


TSR Concepts:


https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh63O_Wz1bNwGK8_q6-ZRnOcwLEzCuQM66g9deSuQBuHMCBkVQy_ZPXKtOKKPbwxzZXJqNai2vwC3UJAb9xMegJUIXFvCz58lKMGJ30q3iFCmOBI2RkAjoXEqp2u68PWQkJq5tph9JsiqzW/s1600-h/Slide37.GIF


Interrupt Vector Table:


https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjrNdq8yFQcm1pr0iyWUWkI_O3phLxh6Iz_ZmSmAKHldL2h3GehbkR9Lk1CGp0RAn4qp8v_RIQDvWYBEuWJ3dqBnWcC7W_QZFs5oOOFoxPiXoZ7-7mbhxZRUxzZo0IebruuQPqy0oqA7WUd/s1600-h/Slide40.GIF


Simple Example Program for setting UP New ISR and removing old one


https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi4v88v78HATTartJC2sQ9xa1wX1p9Sbv-MMcPFqom_-n01WR02gu9aDRywAfFFzl8b6Q9RX7qv2irs57wBTyNgR4S75GzdV40s2YPMmVOy0eXTtjiA4FBq3v5WBwmH1HiGZRsT1-OrC9o1/s1600-h/Slide41.GIF



----- If you would have read the above last two links, you will understand this. IVT table is the place to store all ISR address. Whenever interrupt occurs, interrupt number will be multiplied by 4 and then control will go to that location, that will contain the corresponding ISR’s address, through that pointer we can call the ISR.


For example:


----- 0x33 is mouse interrupt number. Whenever you move or click the mouse cursor, interrupt 0x33 will be generated and this interrupt number multiplied by 4 so the result is CC (51(0x33) * 4 = 204(CC)). Control will go to this (CC) location, this location contains the ISR's function of mouse. We got the address of the mouse's ISR and we can call the ISR. (Open the third link for understanding this example).
----- If you want to add a new ISR into IVT table, we need to find out the Empty space in IVT table, there we can place our own ISR, This is the way to create new ISR in DOS operating system, and we can remove the address from one IVT’s cell, after that we can place our own ISR's address there. If we like we can also take backup of the previous one.


In Symbian


----- Symbian Kernel HOOKs is equivalent to IVT in DOS and WINDOWS Operating system. Instead of calling IVT, here we are calling it as Kernel HOOKs. We can also set our own function into Kernel Hooks. There is a table of function pointer maintained by Symbian OS called KernelHook. There we need to add the new cell for our ISR.
----- If you have ready met address of the function, then you can set the address in this Kernel hook function pointer array otherwise, you can use the sethook() function to set the function pointer dynamically. Its like TSR program in Turboc compiler


#include
void interrupt (*prev)();
main()
{
Prev = getvect(0x33);
Setvect(0x33, fun);
Keep(0,500);
}
Void interrupt fun()
{
//do your stuff
}


In symbian we will use like


TKernelHookFn SetHook(TKernelHookType, TKernelHookFn, TBool);


TKernelHookType This one tells the cell address need to replace with the new function address.
TKernelHookFn This the actual function pointer.
TBool tells weather it is over rid able or not.

Steps to remember:


1. Create a Kernel extension
-----Just write a C++ class and add the declaration “DECLARE_STANDARD_EXTENSION() , In the constructor of your class call a kernel utility function to set up the kernel hook table.


2. Before that you need to add a kernel utility function in Kern’s class. Use this function in -------your kernel extension’s constructor for setting up the kernel hook function handler.


3. If user application wants to access this function, then we can give a framework like interrupt to access this function from user side.


4. How to add a new interrupt?

How to access Kernel extension via Interrupt (coming soon)... :-)

No comments: