Ciro Santilli @cirosantilli 35

Ciro Santilli 35  Updated 2025-04-05  +Created 2024-09-26

 View more

Up March 2023 web.archive.org/web/20230306090740/https://pypi.org/project/china-dictatorship/

https://raw.githubusercontent.com/cirosantilli/china-dictatorship-media/master/pypi.org_project_china-dictatorship.png

Down November 2023 web.archive.org/web/20231110041847/https://pypi.org/project/china-dictatorship/

https://raw.githubusercontent.com/cirosantilli/china-dictatorship-media/master/pypi.org_project_china-dictatorship_down.png

 Read the full article

Fan tributes by

Ciro Santilli 35  Updated 2025-04-05  +Created 2024-09-26

 View more

 -------------------------------------
|  Force of Will               3 U U  |
|  ---------------------------------  |
| |                  ////////////   | |
| |                ////() ()\////\  | |
| |               ///_\ (--) \///\  | |
| |        )      ////  \_____///\\ | |
| |       ) \      /   /   /    /   | |
| |    ) /   \     |   |  /   _/    | |
| |   ) \  (  (   /   / /   / \     | |
| |  / ) ( )  / (    )/(    )  \    | |
| |  \(_)/(_)/  /UUUU \  \\\/   |   | |
| .---------------------------------. |
| Interrupt                           |
| ,---------------------------------, |
| | You may pay 1 life and remove a | |
| | blue card in your hand from the | |
| | game instead of paying Force of | |
| | Will's casting cost.  Effects   | |
| | that prevent or redirect damage | |
| | cannot be used to counter this  | |
| | loss of life.                   | |
| | Counter target spell.           | |
| `---------------------------------` |
|                                     l
| Illus.  Terese Nelsen               |
 -------------------------------------

Code 1.

ASCII art of a Force of Will Magic: The Gathering card inscribed in the Bitcoin blockchain

 Read the full article

Bare metal! by

Ciro Santilli 35  Updated 2025-04-05  +Created 2024-09-26

 View more

baremetal/arch/aarch64/semihost_exit.S

.global main
main:
    /* 0x20026 == ADP_Stopped_ApplicationExit */
    mov x1, 0x26
    movk x1, 2, lsl 16
    str x1, [sp, 0]

    /* Exit status code. Host QEMU process exits with that status. */
    mov x0, 0
    str x0, [sp, 8]

    /* x1 contains the address of parameter block.
     * Any memory address could be used.
     */
    mov x1, sp

    /* SYS_EXIT */
    mov w0, 0x18

    /* Do the semihosting call on A64. */
    hlt 0xf000

 Read the full article

Assembly by

Ciro Santilli 35  Updated 2025-04-05  +Created 2024-09-26

 View more

Assertions! The best way to learn assembly.

userland/arch/x86_64/add.S

#include <lkmc.h>

LKMC_PROLOGUE
    /* Register immediate. */
    mov $1, %rax
    add $2, %rax
    LKMC_ASSERT_EQ(%rax, $3)
LKMC_EPILOGUE

 Read the full article

Kernel modules by

Ciro Santilli 35  Updated 2025-04-05  +Created 2024-09-26

 View more

kernel_modules/hello.c

#include <linux/module.h>
#include <linux/kernel.h>

static int myinit(void)
{
	pr_info("hello init\n");
	/* 0 for success, any negative value means failure,
	 * E* consts if you want to specify failure cause.
	 * https://www.linux.com/learn/kernel-newbie-corner-loadable-kernel-modules-coming-and-going */
	return 0;
}

static void myexit(void)
{
	pr_info("hello exit\n");
}

module_init(myinit)
module_exit(myexit)
MODULE_LICENSE("GPL");

 Read the full article

Lots of in-tree examples by

Ciro Santilli 35  Updated 2025-04-05  +Created 2024-09-26

 Read the full article

Multiple architectures supported by

Ciro Santilli 35  Updated 2025-04-05  +Created 2024-09-26

 View more

E.g., if you want aarch64 instead of the default x86_64:

./build -aA
./run -aA

That's it.

 Read the full article

Kernel GDB step debugging just works by

Ciro Santilli 35  Updated 2025-04-05  +Created 2024-09-26

 View more

Start QEMU and wait for GDB:

./run --gdb-wait

On another shell, connect GDB to QEMU and run up to a symbol that shows up at boot:

./run-gdb start_kernel

Outcome: we are GDB step debugging the Linux Kernel:

Breakpoint 1, start_kernel () at /root/lkmc/submodules/linux/init/main.c:837
837     {
loading vmlinux
(gdb) n
841             set_task_stack_end_magic(&init_task);
(gdb) l
836     asmlinkage __visible void __init __no_sanitize_address start_kernel(void)
837     {
838             char *command_line;
839             char *after_dashes;
840
841             set_task_stack_end_magic(&init_task);
842             smp_setup_processor_id();
843             debug_objects_early_init();
844
845             cgroup_init_early();
(gdb) p &init_task
$1 = (struct task_struct *) 0xffffffff82012840 <init_task>
(gdb) bt
#0  start_kernel () at /root/lkmc/submodules/linux/init/main.c:841
#1  0xffffffff8215145c in x86_64_start_reservations (real_mode_data=<optimized out>) at /root/lkmc/submodules/linux/arch/x86/kernel/head64.c:490
#2  0xffffffff821514e3 in x86_64_start_kernel (real_mode_data=0x138d0 <bts_ctx+2256> <error: Cannot access memory at address 0x138d0>) at /root/lkmc/submodules/linux/arch/x86/kernel/head64.c:471
#3  0xffffffff810000e6 in secondary_startup_64 () at /root/lkmc/submodules/linux/arch/x86/kernel/head_64.S:243
#4  0x0000000000000000 in ?? ()
(gdb) up
#1  0xffffffff8215145c in x86_64_start_reservations (real_mode_data=<optimized out>) at /root/lkmc/submodules/linux/arch/x86/kernel/head64.c:490
490             start_kernel();
(gdb) l
485                     break;
486             default:
487                     break;
488             }
489
490             start_kernel();
491     }

 Read the full article

Everything is built from source and easily modifiable, powered by Buildroot by

Ciro Santilli 35  Updated 2025-04-05  +Created 2024-09-26

 View more

The following are stored in submodules:

submodules/binutils-gdb/
submodules/buildroot/
submodules/gcc/
submodules/glibc/
submodules/linux/
submodules/qemu/

So you can modify source, rebuild and that's it, its in the VM.

E.g., let's hack the linux kernel:

asmlinkage __visible void __init __no_sanitize_address start_kernel(void)
{
  pr_info("I'VE HACKED THE LINUX KERNEL!!!");

Rebuild Linux:

./build-linux

Rerun:

./run

And after boot we see:

<6>[    0.000000] I'VE HACKED THE LINUX KERNEL!!!

 Read the full article

Get a Linux terminal on QEMU by

Ciro Santilli 35  Updated 2025-04-05  +Created 2024-09-26

 View more

One time setup:

git clone https://github.com/cirosantilli/linux-kernel-module-cheat
cd linux-kernel-module-cheat
sudo apt install docker
python3 -m venv .venv
. .venv/bin/activate
./setup
./run-docker create
./run-docker sh

You are now in Docker.

Build everything from source inside docker:

./build --download-dependencies qemu-buildroot

Boot Linux and get a userland shell:

./run

Outcome:

<6>[    1.383114] NET: Registered protocol family 17
<6>[    1.383682] 9pnet: Installing 9P2000 support
<6>[    1.385473] IPI shorthand broadcast: enabled
<6>[    1.385701] sched_clock: Marking stable (1355697980, 27047205)->(1385555667, -2810482)
<6>[    1.387744] ALSA device list:
<6>[    1.387843]   No soundcards found.
<6>[    1.535981] ata2.00: ATAPI: QEMU DVD-ROM, 2.5+, max UDMA/100
<5>[    1.543470] scsi 1:0:0:0: CD-ROM            QEMU     QEMU DVD-ROM     2.5+ PQ: 0 ANSI: 5
<6>[    1.548952] EXT4-fs (vda): mounting ext2 file system using the ext4 subsystem
<6>[    1.555909] EXT4-fs (vda): mounted filesystem without journal. Opts: (null)
<6>[    1.556145] VFS: Mounted root (ext2 filesystem) on device 254:0.
<6>[    1.557451] devtmpfs: mounted
<6>[    1.605639] Freeing unused kernel image (initmem) memory: 1248K
<6>[    1.605875] Write protecting the kernel read-only data: 16384k
<6>[    1.607977] Freeing unused kernel image (text/rodata gap) memory: 2044K
<6>[    1.610190] Freeing unused kernel image (rodata/data gap) memory: 1012K
<6>[    1.610495] Run /sbin/init as init process
<6>[    1.683311] tsc: Refined TSC clocksource calibration: 3293.671 MHz
<6>[    1.683618] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x2f79f177aae, max_idle_ns: 440795226653 ns
<6>[    1.683849] clocksource: Switched to clocksource tsc
<3>[    1.694241] 9pnet_virtio: no channels available for device host_data
mount: mounting host_data on /mnt/9p/data failed: No such file or directory
qemu-system-x86_64: warning: 9p: degraded performance: a reasonable high msize should be chosen on client/guest side (chosen msize is <= 8192). See https://wiki.qemu.org/Documentation/9pset.
<3>[    1.712287] overlayfs: overlapping upperdir path
mount: mounting overlay on /mnt/overlay failed: Too many levels of symbolic links
hello S98
hello .profile
/lkmc
root@buildroot# pwd
/lkmc
/lkmc
root@buildroot#

 Read the full article

Prelude: initial reports without specific websites (2018-) by