Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix getkcore.c when KASLR is enabled #767

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

v14dz
Copy link

@v14dz v14dz commented Dec 14, 2020

The getkcore.c PoC didn't work with KASLR enabled, this commit fixes the bug. It finds the RAM regions in kcore by using program header's physical addresses instead of using the hard-coded base address 0xffff880000000000.

Without KASLR (kernel booted with the nokaslr option):

# readelf -aW /proc/kcore
  Type           Offset   VirtAddr           PhysAddr           FileSiz  MemSiz   Flg Align
[...]
  LOAD           0x88000003000 0xffff888000001000 0x0000000000001000 0x09e000 0x09e000 RWE 0x1000
  LOAD           0x88000102000 0xffff888000100000 0x0000000000100000 0x3fef0000 0x3fef0000 RWE 0x1000

With KASLR, virtAddr are randomized, the hard-coded value can't be used:

  Type           Offset   VirtAddr           PhysAddr           FileSiz  MemSiz   Flg Align
  LOAD           0x168e00003000 0xffff968e00001000 0x0000000000001000 0x09e000 0x09e000 RWE 0x1000
  LOAD           0x168e00102000 0xffff968e00100000 0x0000000000100000 0x3fef0000 0x3fef0000 RWE 0x1000

The getkcore.c PoC didn't work with KASLR enabled, this commit fixes the
bug.  It finds the RAM regions in kcore by using program header's physical
addresses instead of using the hard-coded base address 0xffff880000000000.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant