dynlib_patch.c

// Patch sys_dynlib_dlsym: Allow from anywhere
int kpayload_dynlib_patch(struct thread *td, struct kpayload_firmware_args *args) {
  UNUSED(td);
  UNUSED(args);

  void *kernel_base;
  uint8_t *kernel_ptr;

  uint8_t *kmem;
  uint8_t *dynlib_patch_1;
  uint8_t *dynlib_patch_2;

  kernel_base = &((uint8_t *)__readmsr(0xC0000082))[-0x000001C0];
  kernel_ptr = (uint8_t *)kernel_base;
  dynlib_patch_1 = &kernel_ptr[0x004523C4];
  dynlib_patch_2 = &kernel_ptr[0x00029A30];

  uint64_t cr0 = readCr0();
  writeCr0(cr0 & ~X86_CR0_WP);

  kmem = (uint8_t *)dynlib_patch_1;
  kmem[0] = 0x90;
  kmem[1] = 0xE9;

  kmem = (uint8_t *)dynlib_patch_2;
  kmem[0] = 0x48;
  kmem[1] = 0x31;
  kmem[2] = 0xC0;
  kmem[3] = 0xC3;

  writeCr0(cr0);

  return 0;
}

int dynlib_patch() {
  struct kpayload_firmware_info kpayload_firmware_info;
  kpayload_firmware_info.fw_version = 0;
  return kexec(&kpayload_dynlib_patch, &kpayload_firmware_info);
}