kernel_castle

(aka eminus,metaizm və s. :D)


birinci sizə şeir deyəcəm gözləyin ...///

`Sən yarımın qasidisən Əyləş sənə çay demişəm,
Xəyalini göndəribdir bəs ki, mən ax-vay demişəm,
Ax gecələr yatmamışam mən sənə lay-lay demişəm,
Sən yatalı mən gözumə ulduzları say demişəm.`


#yazdigimiz_yeni_kernel_implementasiya_edeceyimiz_procedur

linux redhat kernel hand by debugging ? :)--
-
Linux 3.19.000000 #1 date ? $_$ -15:00:00 EST 20** i686 i386 GNU/Linux

32-bit official kernel source baxaq )
snippet source - ) kernel based stackprotector.h
%gs segment register üzərində 20 byte offset-ə sahibdir və %gs stack canary shared edir.
%gs userland TLS istifadə edir (THREAD LOCAL STORAGE). Stack canary üçün 24 byte read only segment initialize edilir.

TLS section ELF prosesinde

(An initialized thread-local variable is allocated in a .tbss, or .tdata section.)
ELF handling for TLS handling dokumentasiyasında qeyd edildiyi kimi (.tdata section-da yerləşir)


= http://people.redhat.com/mpolacek/src/devconf2012.pdf =


=>   [18] .tdata            PROGBITS        08049f00 000f00 000008 00 WAT  0   0  4
  [19] .tbss             NOBITS          08049f08 000f08 000008 00 WAT  0   0  4


Field
sh_name			.tbss						.tdata
sh_type			SHT NOBITS					SHT PROGBITS
sh_flags		SHF ALLOC +SHF WRITE + SHF TLS			SHF ALLOC +SHF WRITE + SHF TLS
sh_addr			virtual address of section			virtual address of section
sh_offset		0						file offset of initialization image
sh_size			size of section					size of section
sh_link			SHN UNDEF					SHN UNDEF
sh_info			0						0
sh_addralign		alignment of section				alignment of section
sh_entsize		0						0


elf TLS reference: www.akkadia.org/drepper/tls.pdf

linux initialize stack canary:


 50 #define GDT_STACK_CANARY_INIT                                           \
 51         [GDT_ENTRY_STACK_CANARY] = { { { 0x00000018, 0x00409000 } } },


TLS-dən istənilən value GDT(global descriptor table) entry dəyərinə görə fetch edilə bilir.

GDT index = ) mov %gs:20,%eax (vvith ATM syntax)


|-------------|
|İndex : 2    |
|-------------|
|Start: 0x0066| =========== ) |MEMORY|
|-------------|
| len: 0xfff  |
|-------------|
      GDT


qaçaraq marşşşşşşşşşşşş

first step TLS support
 21 void check_host_supports_tls(int *supports_tls, int *tls_min)
 22 {
 23         /* Values for x86 and x86_64.*/
 24         int val[] = {GDT_ENTRY_TLS_MIN_I386, GDT_ENTRY_TLS_MIN_X86_64};
 25         int i;
 26
 27         for (i = 0; i < ARRAY_SIZE(val); i++) {
 28                 user_desc_t info;
 29                 info.entry_number = val[i];
 30
 31                 if (syscall(__NR_get_thread_area, &info) == 0) {
 32                         *tls_min = val[i];
 33                         *supports_tls = 1;
 34                         return;
 35                 } else {
 36                         if (errno == EINVAL)
 37                                 continue;
 38                         else if (errno == ENOSYS)
 39                                 *supports_tls = 0;
 40                                 return;
 41                 }
 42         }
 43
 44         *supports_tls = 0;
 45 }

defined file http://lxr.free-electrons.com/source/arch/x86/um/shared/sysdep/tls.h#L35

 34 #ifdef __i386__
 35 #define GDT_ENTRY_TLS_MIN_I386 6 ((
 36 #define GDT_ENTRY_TLS_MIN_X86_64 12
 37 #endif
						32 bit maşında

binary (ABI) based
file: http://lxr.free-electrons.com/source/arch/x86/um/os-Linux/tls.c#L58

 47 int os_set_thread_area(user_desc_t *info, int pid)
 48 {
 49         int ret;
 50
 51         ret = ptrace(PTRACE_SET_THREAD_AREA, pid, info->entry_number,
 52                      (unsigned long) info);
 53         if (ret < 0)
 54                 ret = -errno;
 55         return ret;
 56 }


kernel based

generasiya prosesi:

 59 static __always_inline void boot_init_stack_canary(void)
 60 {
 61         u64 canary;
 62         u64 tsc;
 63
 64 #ifdef CONFIG_X86_64
 65         BUILD_BUG_ON(offsetof(union irq_stack_union, stack_canary) != 40);
 66 #endif
 67         /*
 68          * We both use the random pool and the current TSC as a source
 69          * of randomness. The TSC only matters for very early init,
 70          * there it already has some randomness on most systems. Later
 71          * on during the bootup the random pool has true entropy too.
 72          */
 73         get_random_bytes(&canary, sizeof(canary));
 74         tsc = __native_read_tsc();
 75         canary += tsc + (tsc << 32UL);
 76
 77         current->stack_canary = canary;
 78 #ifdef CONFIG_X86_64
 79         percpu_write(irq_stack_union.stack_canary, canary);
 80 #else
 81         percpu_write(stack_canary.canary, canary);
 82 #endif
 83 }



 85 static inline void setup_stack_canary_segment(int cpu)
 86 {
 87 #ifdef CONFIG_X86_32
 88         unsigned long canary = (unsigned long)&per_cpu(stack_canary, cpu);
 89         struct desc_struct *gdt_table = get_cpu_gdt_table(cpu);
 90         struct desc_struct desc;
 91
 92         desc = gdt_table[GDT_ENTRY_STACK_CANARY];
 93         desc.base0 = canary & 0xffff;
 94         desc.base1 = (canary >> 16) & 0xff;
 95         desc.base2 = (canary >> 24) & 0xff;
 96         write_gdt_entry(gdt_table, GDT_ENTRY_STACK_CANARY, &desc, DESCTYPE_S);
 97 #endif
 98 }


SNiPPET asm code

	================= ) xorl %gs:20, %edx


	 |-----------------------------------|
	 | function param		     |
	 |-----------------------------------|
	 |  (RET)			     |
	 |-----------------------------------|
	 | canary (get_rand_byte :D )        | === ) canary says: məni spavvn etsən xuy gedərsən yuxarı (pushhhhhhhhh)


	 |-----------------------------------|
	 | frame pointer 	             |
	 |-----------------------------------|
	 | vars		                     |
	 |-----------------------------------|


 73 void __stack_chk_guard_setup(void)
 74 {
 75         __stack_chk_guard = 0x000a0dff;
 76 }
 77