1. Linux Project 中央大學資工系 碩士二年級 江瑞敏

2. Outline How to compile linux kernel How to add a new system call Some Projects Example and Way to Solve it – System Call Hooking by Module – Project about Memory – Project about Process

3. Download Link wget https://kernel.org/pub/linux/kernel/linux-2.6.18.tar.bz2https://kernel.org/pub/linux/kernel/linux-2.6.18.tar.bz2 tar xvf linux-2.6.18.tar.bz2

4. The Beginning of everything

5. Compile Linux Kernel

6. It is Hard?

7. No, If you understand the concept

8. The Basic Process 0. make mrproper 1. make oldconfig 2. make –j[n] 3. make modules_install 4. make install 5. reboot

9. Do You Know What It Means?

10. make mrproer Clean up the environment Will Remove almost everything, except….

11. make clean Almost the same as make mrproper.

12. make oldconfig Use the configuration file the current kernel is using. Some other alternative options. – Make menuconfig – …

13. Is config File Important?

14. Config file Determine which kind of kernel you are compiling Determine which modules you want the kernel to compile. Misconfiguration will lead to kernel crash.

15. make –j[n] Compile the whole source code according to your configuration

16. make modules_install Install the modules into the necessary folder. – /lib/modules/`uname –r`/

17. make install Install the image into the boot directory. Sometimes, update grub is necessary.

18. What Is System Call

19. It’s a Bridge

20. Between User Device

21. Why System Call

22. Pop Quiz : Write A Program To Print “Hello World”

24. What You May Write

25. What Actually Happened ….

26. User Application Kernel Code System Call System Call libc.so Printf Device Driver IO Device

27. What If There Is No System Call

28. Everything Will Be x86 instruction in and out

29. Let’s Focus On … User Application Kernel Code System Call System Call libc.so Printf Device Driver IO Device

30. Magic int 0x80

31. Before We Talk Further, Let’s Talk About X86 Architecture

32. X86 Architecture Is Interrupt Driven

33. CPU 8259 PIC Kernel Device User Application Device Device Driver

35. How The CPU Find The Address of The Device Driver Code

36. Callback Mechanism

37. CPU 8259 PIC Device Device Driver … … Interrupt Descriptor Table ….. Kernel Physical Device

38. How About System Call

39. Magic int 0x80

40. CPU 8259 PIC Device Physical Device syscall_table Interrupt Descriptor Table ….. 0x80 ….. System Call Handler int 0x80

41. CPU Kernel User Application int 0x80 cs ds ss esp eip … … … … Stack cpu

42. CPU User Application int 0x80 GDT Get TSS TSS cs ds ss esp eip … … … … Stack cpu

43. CPU User Application int 0x80 GDT Get TSS TSS cs ds ss esp eip … … … … Stack cpu

44. CPU User Application int 0x80 IDT Get IDT cs ds ss esp eip … … … … Stack 0x80 ENTRY(system_call) cpu sys_call_table

45. CPU User Application int 0x80 IDT Get IDT cs ds ss esp eip … … … … Stack 0x80 ENTRY(system_call) cpu sys_call_table

46. CPU User Application int 0x80 IDT Get IDT cs ds ss esp eip … … ss esp eflags cs eip … … Stack 0x80 ENTRY(system_call) sys_call_table cpu

47. How To Add A System Call

48. Add a System Call 1. cd $kernel_src 2. cd arch/i386/kernel/syscall_table.S 3. …..long sys_tee /* 315 */.long sys_vmsplice.long sys_move_pages.long sys_project /* 318 */ Kernel.org/pub/linux/kernel

49. Add a System Call cd linux/include/asm-i386/unistd.h #define __NR_vmsplice 316 #define __NR_move_pages 317 #define __NR_project 318 #ifdef __KERNEL__ #define NR_syscalls 319

50. Add a System Call cd linux/include/linux/syscalls.h asmlinkage long sys_set_robust_list(struct robust_list_head __user *head, size_t len); asmlinkage long sys_project( int i ); #endif

51. Add a System Call cd linux/kernel touch project.c Makefile obj-y = project.o sched.o fork.o exec_domain.o panic.o printk.o profile.o

52. Add a System Call Project.c #include #include asmlinkage long sys_project( int i ){ printk( "Success!! -- %d\n", i ); return 0; }

53. Add a System Call Recompile linux kernel Reboot Create a new file “test.c” #include int main(){ syscall( 318, 2 ); return 0; }

54. Add a System call http://in1.csie.ncu.edu.tw/~hsufh/COURSES/F ALL2007/syscall.html http://in1.csie.ncu.edu.tw/~hsufh/COURSES/F ALL2007/syscall.html

55. About 64 bits The Idea is the same There are many online references Therefore, I will not cover in this ppt.

56. System Call Hooking by Module

57. System Call Hooking 57 … sys_call_table 正常的 execve 程式碼 Usermode 程式呼叫 系統呼叫 NR_execve

58. System Call Hooking 58 … sys_call_table 正常的 execve 程式碼 Usermode 程式呼叫 系統呼叫 NR_execve Hooking Code

59. System Call Hooking 59 … sys_call_table Usermode 程式呼叫 系統呼叫 NR_execve Hooking Code 正常的 execve 程式碼 Modified execve

60. Source code links http://pastebin.com/rShUxvB5 http://pastebin.com/KEJxgLGq

61. Project about Memory

62. Level 1: Dump the virtual address of a process

63. Some Question U may Ask

64. Where to Start?

65. Maybe Add a New System Call

66. 1. How to find the process you want?

67. Process List task_struct for_each_process() If u pay attention in class, these two are not stranger.

68. 2. How about Virtual Address that is being used by the current process?

69. The Data Structure mm_struct vm_area_struct lxr.linux.no

70. How it looks like

71. The rest is some basic programming skill

73. Too easy, Let’s make it a little bit harder

74. Level 2: Dump the physical frame that is associate with the virtual address.

75. New Problem, New question

76. How to transfer Virtual Address to Physical Address?

77. Some Reminder and Hints

79. Where is CR3?

82. Now We Have CR3, Then?

84. Calculate By Yourself or

85. Something Smarter

86. follow_page()

88. Push Yourself More

89. Level 3: Log these information to a file

90. Ok, let’s type

91. dmesg || grep “myproject” >> log.txt

92. Dude Are you… Dude Are you…

93. …. From Kernel of course

94. Can We Do That???

95. How to write file in User Mode

96. fd = open(filename, “w”); write(ptr, string, strlen(string)); close(fd);

97. How about Kernel Mode

98. open -> do_sys_open

99. Write -> sys_write()

100. Close -> sys_close()

101. Is that all?

102. The magic __user

104. It tell kernel that the parameter should pass from user mode

105. It’s a protection mechanism

107. Final Step About this Project

108. Level 4: Modify The PTE r/w flag from read/write to read

109. http://in1.csie.ncu.edu.tw/~hsufh/COURSES/FAL L2012/linux_project1.html

110. Structures of Page Directories And Page Tables Entries

111. Wow, Looks Simple :D

112. Basic Idea

113. 1. loop through the translation table of a process according to the virtual address. 2. After finding the pte, change the read/write flag 3. Done

114. pte_wrprotect() Code Implement

115. for(loop_count = addr; loop_count < end; loop_count+=PAGE_SIZE){ pgd = pgd_offset(mm, loop_count); if (pgd_none(*pgd)){ printk("pgd none happened\n"); continue; } pud = pud_offset(pgd, loop_count); pmd = pmd_offset(pud, loop_count); pte = pte_offset_map_lock(mm, pmd, loop_count, &ptl); if(operation == 1){ *pte = pte_mkwrite(*pte); } else{ *pte = pte_wrprotect(*pte); } Code Implement(Cont. )

116. Result

118. What!?

119. Use Printk to Verify

120. Printk Tell Us Two Things

121. 1. we have change the pte r/w flag

122. 2. only one entry being change back, other didn’t in most cases.

123. Magic Happened ?

124. Now, Imagine you are CPU

126. What will happened when some process try to access a read only area

127. Page Fault Happened

128. The Question Becomes, How Linux Handle Page Fault

129. U might Ask, What is Page Fault

130. From CPU point of view

131. 1. present flag of pgd or pte is clear. 2. code running in user mode attempts to write to a read only page. – More detailed check intel programmer manual.

132. From Kernel Point of View

133. 1. present flag is clear: A. Access the first time. B. Page is being swap out. 2. write to a read only page: A. is a process really write to a read only page B. is a page-fault optimization such as copy on write.

134. How Does Linux Kernel Determine These Kind of Difference

135. Well, First….

136. And This

137. Then This

138. What The FxxK…….

139. This Time Let’s Look Closer

143. Now We Know An Important Thing

144. Linux Kernel Will Compare The vm_flag

145. Some Useful Knowledge

146. How Linux Implement COW

147. Cow?? Moo ?

148. 1. COW refer to copy on write 2. google and wiki are your friend 3. how linux implement copy on write. – A. pte r/w flag disable – B. vm_flag & VM_WRITE == true

149. Our project accidently match the above conditions!

150. 1. same page table entry of parent and child process point to the same pfn 2. set r/w flag of both pte to read only 3. when page fault happened, page fault handler will check the vm_flag of the current virtual address. 4. if vm_flag has VM_WRITE, page fault handler will refer this situation as a COW condition. 5. assign a new pfn with r/w flag enable if there are two pte point to it.

151. Copy on Write linux implement parent child Task_struct pte Physical address Pfn N Pfn (N+1) Pfn (N+2) pgd

152. A New Idea of The Project

153. 1. Change PTE r/w flag as we just did

154. 2. Change the vm_flag as well

155. down_write(&current->mm->mmap_sem); vma = find_vma(mm, addr); vm_start = vma->vm_start; vm_end = vma->vm_end; mask = VM_READ|VM_WRITE|VM_EXEC|VM_SHARED; new_flags = VM_READ; old_flags = vma->vm_flags; if(old_flags&VM_WRITE){ old_flags &= ~(VM_WRITE); new_flags |= old_flags; } else{ new_flags |= old_flags; } prot = protection_map[new_flags & mask]; vma->vm_flags = new_flags; vma->vm_page_prot = prot; up_write(&current->mm->mmap_sem); addr &= PAGE_MASK; change_pte(addr, end, operation); Code Implementation

156. Result

157. Where is the “press enter to continue” ?

158. It’s time to use GDB

159. Set a break point before syscall happened Seems like this time printf cause the error

160. Here is the problem.

161. Think Slowly

162. Calling printf will need to push some parameters

163. Recall From The Last Code

164. we have changed vm_flag for the whole vm_area_struct which means the entire block of linear address. Address of the array is not always align to 4kb.

165. Consider The following Conditions

166. Start address align End address align

168. Start Address Align End Address Not Align

169. Start addr End addrTotal need 3 pages Area problem may occur Test_array low high

170. Start Address Not Align End Address Align

171. Start addr End addr Total need 3 pages Area problem may occur low high Test array

172. Start Address Not Align End Address Not Align

173. Start addr End addr Area problem may occur Total need 4 pages Test_array low high

174. Our case The parameter is right here Since the page is RO. low high Assembly code: ….. Call syscall; Push $string; Call printf; Assembly code: ….. Call syscall; Push $string; Call printf;

175. Rewrite the user mode program. This time use malloc instead of local variable.(Heap instead of stack) Char *test_array; Test_array = (char *)malloc(ARRAY_SIZE) Verify Our Thoughts (Test case 1)

176. Test Case 1 Result

178. Char test1[0x2000]; Char test_array[ARRAY_SIZE]; Char test2[0x2000]; This can also bypass the conditions that I just mentioned. Verify Our Thoughts (Test case 2)

179. Test Case 2 Result Also work~~

181. 1. basically, the idea is the same. – A. change vm_flag – B. change pte r/w flag 2. Some hints: – A. Strongly recommend reading Text Book Chapter 8: Memory Management Chapter 9: Process Address Space – B. code to change vma_flag is in mprotect_fixup().mprotect_fixup() – C. the code to loop through the translation table starts from change_protection(….) -> change_pud(….) -> change_pmd(…..) -> change_pte_range(…..) How About Mprotect.c

182. Full Source Level 1 and 2 : http://pastebin.com/wEVLaQyg http://pastebin.com/wEVLaQyg Level 3: http://pastebin.com/HFW8WTN5 http://pastebin.com/HFW8WTN5