Modifying The System Calls Dispatch Table

Here is some code that "hijacks" the 'unlink' system call. Assume that 'versioned_string' takes a symbol name, and turns it into a versioned symbol. We'll explain its "magic" later.

 /* this is our 'fake' unlink system call. */
 asmlinkage fake_sys_unlink(const char* path)
 {
         kprint("No 'unlink' for you!\n");
         return -ENOSYS;
 }

 int init_module(void)
 {
         /* locate 'sys_call_table' in memory.     */
         /* this code is for 32-bit architectures. */
        unsigned long* sys_call_table_addr = (unsigned long*)
                 get_module_symbol(NULL,
                         versioned_string(sys_call_table));
         if (sys_call_table_addr) {
                 sys_call_table_addr[10] =
                         (unsigned long)fake_sys_unlink;
         }
 }