One time setup:
git clone https://github.com/cirosantilli/linux-kernel-module-cheat
cd linux-kernel-module-cheat
sudo apt install docker
python3 -m venv .venv
. .venv/bin/activate
./setup
./run-docker create
./run-docker shYou are now in Docker.
Build everything from source inside docker:
./build --download-dependencies qemu-buildrootBoot Linux and get a userland shell:
./runOutcome:
<6>[ 1.383114] NET: Registered protocol family 17
<6>[ 1.383682] 9pnet: Installing 9P2000 support
<6>[ 1.385473] IPI shorthand broadcast: enabled
<6>[ 1.385701] sched_clock: Marking stable (1355697980, 27047205)->(1385555667, -2810482)
<6>[ 1.387744] ALSA device list:
<6>[ 1.387843] No soundcards found.
<6>[ 1.535981] ata2.00: ATAPI: QEMU DVD-ROM, 2.5+, max UDMA/100
<5>[ 1.543470] scsi 1:0:0:0: CD-ROM QEMU QEMU DVD-ROM 2.5+ PQ: 0 ANSI: 5
<6>[ 1.548952] EXT4-fs (vda): mounting ext2 file system using the ext4 subsystem
<6>[ 1.555909] EXT4-fs (vda): mounted filesystem without journal. Opts: (null)
<6>[ 1.556145] VFS: Mounted root (ext2 filesystem) on device 254:0.
<6>[ 1.557451] devtmpfs: mounted
<6>[ 1.605639] Freeing unused kernel image (initmem) memory: 1248K
<6>[ 1.605875] Write protecting the kernel read-only data: 16384k
<6>[ 1.607977] Freeing unused kernel image (text/rodata gap) memory: 2044K
<6>[ 1.610190] Freeing unused kernel image (rodata/data gap) memory: 1012K
<6>[ 1.610495] Run /sbin/init as init process
<6>[ 1.683311] tsc: Refined TSC clocksource calibration: 3293.671 MHz
<6>[ 1.683618] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x2f79f177aae, max_idle_ns: 440795226653 ns
<6>[ 1.683849] clocksource: Switched to clocksource tsc
<3>[ 1.694241] 9pnet_virtio: no channels available for device host_data
mount: mounting host_data on /mnt/9p/data failed: No such file or directory
qemu-system-x86_64: warning: 9p: degraded performance: a reasonable high msize should be chosen on client/guest side (chosen msize is <= 8192). See https://wiki.qemu.org/Documentation/9pset.
<3>[ 1.712287] overlayfs: overlapping upperdir path
mount: mounting overlay on /mnt/overlay failed: Too many levels of symbolic links
hello S98
hello .profile
/lkmc
root@buildroot# pwd
/lkmc
/lkmc
root@buildroot#
The following are stored in submodules:
submodules/binutils-gdb/
submodules/buildroot/
submodules/gcc/
submodules/glibc/
submodules/linux/
submodules/qemu/So you can modify source, rebuild and that's it, its in the VM.
E.g., let's hack the linux kernel:
asmlinkage __visible void __init __no_sanitize_address start_kernel(void)
{
pr_info("I'VE HACKED THE LINUX KERNEL!!!");Rebuild Linux:
./build-linuxRerun:
./runAnd after boot we see:
<6>[ 0.000000] I'VE HACKED THE LINUX KERNEL!!!Start QEMU and wait for GDB:
./run --gdb-waitOn another shell, connect GDB to QEMU and run up to a symbol that shows up at boot:
./run-gdb start_kernelOutcome: we are GDB step debugging the Linux Kernel:
Breakpoint 1, start_kernel () at /root/lkmc/submodules/linux/init/main.c:837
837 {
loading vmlinux
(gdb) n
841 set_task_stack_end_magic(&init_task);
(gdb) l
836 asmlinkage __visible void __init __no_sanitize_address start_kernel(void)
837 {
838 char *command_line;
839 char *after_dashes;
840
841 set_task_stack_end_magic(&init_task);
842 smp_setup_processor_id();
843 debug_objects_early_init();
844
845 cgroup_init_early();
(gdb) p &init_task
$1 = (struct task_struct *) 0xffffffff82012840 <init_task>
(gdb) bt
#0 start_kernel () at /root/lkmc/submodules/linux/init/main.c:841
#1 0xffffffff8215145c in x86_64_start_reservations (real_mode_data=<optimized out>) at /root/lkmc/submodules/linux/arch/x86/kernel/head64.c:490
#2 0xffffffff821514e3 in x86_64_start_kernel (real_mode_data=0x138d0 <bts_ctx+2256> <error: Cannot access memory at address 0x138d0>) at /root/lkmc/submodules/linux/arch/x86/kernel/head64.c:471
#3 0xffffffff810000e6 in secondary_startup_64 () at /root/lkmc/submodules/linux/arch/x86/kernel/head_64.S:243
#4 0x0000000000000000 in ?? ()
(gdb) up
#1 0xffffffff8215145c in x86_64_start_reservations (real_mode_data=<optimized out>) at /root/lkmc/submodules/linux/arch/x86/kernel/head64.c:490
490 start_kernel();
(gdb) l
485 break;
486 default:
487 break;
488 }
489
490 start_kernel();
491 }E.g., if you want aarch64 instead of the default x86_64:
./build -aA
./run -aAThat's it.
#include <linux/module.h>
#include <linux/kernel.h>
static int myinit(void)
{
pr_info("hello init\n");
/* 0 for success, any negative value means failure,
* E* consts if you want to specify failure cause.
* https://www.linux.com/learn/kernel-newbie-corner-loadable-kernel-modules-coming-and-going */
return 0;
}
static void myexit(void)
{
pr_info("hello exit\n");
}
module_init(myinit)
module_exit(myexit)
MODULE_LICENSE("GPL");Assertions! The best way to learn assembly.
#include <lkmc.h>
LKMC_PROLOGUE
/* Register immediate. */
mov $1, %rax
add $2, %rax
LKMC_ASSERT_EQ(%rax, $3)
LKMC_EPILOGUEPowered by crosstool-NG:
.global main
main:
/* 0x20026 == ADP_Stopped_ApplicationExit */
mov x1, 0x26
movk x1, 2, lsl 16
str x1, [sp, 0]
/* Exit status code. Host QEMU process exits with that status. */
mov x0, 0
str x0, [sp, 8]
/* x1 contains the address of parameter block.
* Any memory address could be used.
*/
mov x1, sp
/* SYS_EXIT */
mov w0, 0x18
/* Do the semihosting call on A64. */
hlt 0xf000Articles by others on the same topic
There are currently no matching articles.