Exemplo n.º 1
0
void copy_and_fixup_insn(struct insn *src_insn, void *dest,
                         const struct kernsym *func)
{

    u32 *to_fixup;
    unsigned long addr;
    BUG_ON(src_insn->length == 0);

    memcpy((void *)dest, (const void *)src_insn->kaddr,
           src_insn->length);

    if(src_insn->opcode.bytes[0] == OP_CALL_REL32 ||
            src_insn->opcode.bytes[0] == OP_JMP_REL32)
    {

        addr = (unsigned long)CODE_ADDR_FROM_OFFSET(
                   src_insn->kaddr,
                   src_insn->length,
                   src_insn->immediate.value);

        if(addr >= (unsigned long)func->addr &&
                addr < (unsigned long)func->addr + func->size)
            return;

        to_fixup = (u32 *)((unsigned long)dest +
                           insn_offset_immediate(src_insn));
        *to_fixup = CODE_OFFSET_FROM_ADDR(dest, src_insn->length,
                                          (void *)addr);
        return;
    }

#ifdef CONFIG_X86_64
    if(!tpe_insn_rip_relative(src_insn))
        return;

    addr = (unsigned long)CODE_ADDR_FROM_OFFSET(
               src_insn->kaddr,
               src_insn->length,
               src_insn->displacement.value);

    if(addr >= (unsigned long)func->addr &&
            addr < (unsigned long)func->addr + func->size)
        return;

    to_fixup = (u32 *)((unsigned long)dest +
                       insn_offset_displacement(src_insn));
    *to_fixup = CODE_OFFSET_FROM_ADDR(dest, src_insn->length,
                                      (void *)addr);
#endif
    return;
}
Exemplo n.º 2
0
int symbol_hijack(struct kernsym *sym, const char *symbol_name, unsigned long *code) {

	int ret;
	unsigned long orig_addr;
	unsigned long dest_addr;
	unsigned long end_addr;
	u32 *poffset;
	struct insn insn;
	bool pte_ro;
	
	ret = find_symbol_address(sym, symbol_name);

	if (IN_ERR(ret))
		return ret;

	if (*(u8 *)sym->addr == OP_JMP_REL32) {
		printk(PKPRE "error: %s already appears to be hijacked\n", symbol_name);
		return -EFAULT;
	}

	sym->new_addr = malloc(sym->size);

	if (sym->new_addr == NULL) {
		printk(PKPRE
			"Failed to allocate buffer of size %lu for %s\n",
			sym->size, sym->name);
		return -ENOMEM;
	}

	memset(sym->new_addr, 0, (size_t)sym->size);

	if (sym->size < OP_JMP_SIZE) {
		ret = -EFAULT;
		goto out_error;
	}
	
	orig_addr = (unsigned long)sym->addr;
	dest_addr = (unsigned long)sym->new_addr;
	
	end_addr = orig_addr + sym->size;
	while (end_addr > orig_addr && *(u8 *)(end_addr - 1) == '\0')
		--end_addr;
	
	if (orig_addr == end_addr) {
		printk(PKPRE
			"A spurious symbol \"%s\" (address: %p) seems to contain only zeros\n",
			sym->name,
			sym->addr);
		ret = -EILSEQ;
		goto out_error;
	}
	
	while (orig_addr < end_addr) {
		tpe_insn_init(&insn, (void *)orig_addr);
		tpe_insn_get_length(&insn);
		if (insn.length == 0) {
			printk(PKPRE
				"Failed to decode instruction at %p (%s+0x%lx)\n",
				(const void *)orig_addr,
				sym->name,
				orig_addr - (unsigned long)sym->addr);
			ret = -EILSEQ;
			goto out_error;
		}
		
		copy_and_fixup_insn(&insn, (void *)dest_addr, sym);
		
		orig_addr += insn.length;
		dest_addr += insn.length;
	}
	
	sym->new_size = dest_addr - (unsigned long)sym->new_addr;

	sym->run = sym->new_addr;

	set_addr_rw((unsigned long) sym->addr, &pte_ro);

	memcpy(&sym->orig_start_bytes[0], sym->addr, OP_JMP_SIZE);

	*(u8 *)sym->addr = OP_JMP_REL32;
	poffset = (u32 *)((unsigned long)sym->addr + 1);
	*poffset = CODE_OFFSET_FROM_ADDR((unsigned long)sym->addr, 
		OP_JMP_SIZE, (unsigned long)code);

	set_addr_ro((unsigned long) sym->addr, pte_ro);

	sym->hijacked = true;

	return 0;

out_error:
	malloc_free(sym->new_addr);

	return ret;
}