root cannot write to Linux RAM


 
Thread Tools Search this Thread
Special Forums Cybersecurity root cannot write to Linux RAM
# 8  
Old 12-21-2011
My code doesn't print anything at all, actually. What did you actually do? It looks like you're printing your own stack and environment space.

Stuff read raw out of arbitrary memory is very unlikely to be sensibly printable.
# 9  
Old 12-21-2011
Code:
void main() {

char buf[16384];
int fd=open("/dev/kmem", 'r');
read(fd, buf, 16384); // first 16KB of kernel mem
int x;
for(x =0;;x++) {

printf("%c", buf[x]);

}


}

This is the modified code.



Apologies for writing to you again. But, my purpose of this code is to write 'Alux' to RAM, then read it back again. In the kernel. I used to do similar things on the Commodore 64. There was a 'poke' command.

Code:
void main() {

char buf[16384];
int fd=open("/dev/kmem", 'r');
int x, y;
int *test;
for (y = 0; y < 18446744073709551615; y++) {
read(fd, buf, 16384); // first 16KB of kernel mem
test = fd;
for(x =0;x < 16384;x++) {

printf("%c", test[x]);

}

}
close(fd);
}


Last edited by Alux; 12-21-2011 at 03:34 PM..
# 10  
Old 12-21-2011
Quote:
Originally Posted by Alux
Apologies for writing to you again. But, my purpose of this code is to write 'Alux' to RAM, then read it back again.
Done.

Code:
int main(void)
{
        char buf[16];
        strcpy(buf, "Alux");
        printf("%s\n", buf);
}

Quote:
...In the kernel.
What for? Putting 'Alux' in some random spot of kernel memory would crash the machine.
Quote:
I used to do similar things on the Commodore 64. There was a 'poke' command.
The commodore 64 had no memory management, few to no sensible programming languages, and no kernel, just a BIOS. You could get away with poke-ing random things, and frequently had to to get around language and BIOS limitations.

Linux has proper memory management, which makes poke kind of pointless. It also has a kernel, which gives you much, much better ways to do what you want than poke. Nobody has to poke anymore, there's no point.

Modern I/O is a lot more complicated than that, anyway. There's not a lot to be accomplished by poking random addresses.

Last edited by Corona688; 12-21-2011 at 03:49 PM..
# 11  
Old 12-21-2011
Dear Corona,

The Poke command is very useful in testing ASM scripts. Also, there should be an ability to access RAM. Especially Kernel RAM. That'd be cool! Imagine!

Where is the FSF?

Oh, and what about the ability to write a program to floppy, and let Linux boot the raw binary.

Last edited by Alux; 12-21-2011 at 04:06 PM..
# 12  
Old 12-21-2011
I should clear something up, here. This program, written in C:

Code:
int main(void)
{
        char buf[16];
        strcpy(buf, "Alux");
        printf("%s\n", buf);
}

...is translated directly into assembly language, to wit:
Code:
        .file   "alux.c"
        .section        .rodata
.LC0:
        .string "Alux"
        .text
.globl main
        .type   main, @function
main:
        pushl   %ebp
        movl    %esp, %ebp
        andl    $-16, %esp
        subl    $32, %esp
        movl    $5, 8(%esp)
        movl    $.LC0, 4(%esp)
        leal    16(%esp), %eax
        movl    %eax, (%esp)
        call    memcpy
        leal    16(%esp), %eax
        movl    %eax, (%esp)
        call    puts
        leave
        ret
        .size   main, .-main
        .ident  "GCC: (Gentoo 4.4.4-r2 p1.2, pie-0.4.5) 4.4.4"
        .section        .note.GNU-stack,"",@progbits

Variables in C already are real, physical memory used as directly as it gets. Declaring a variable in C just instructs the compiler how you want the memory arranged, and follows your instructions when it creates the program in assembly. So this program does in fact write "Alux" into a given spot of memory, directly.

When programming in C you're programming far more directly than you ever did in Commodore BASIC, poke or no.

---------- Post updated at 02:13 PM ---------- Previous update was at 02:02 PM ----------

Quote:
Originally Posted by Alux
Dear Corona,

The Poke command is very useful in testing ASM scripts.
Not really. In a machine with virtual memory, you don't know where anything is anymore, and devices are probably already in use. It's like keeping a great big TSR around that keeps stomping on everything.

If you wanted to play with registers, ram, and I/O in that manner, try freedos.

---------- Post updated at 03:08 PM ---------- Previous update was at 02:13 PM ----------

You can still read kernel memory though.

Code:
#include <unistd.h>
#include <sys/types.h>
#include <fcntl.h>
#include <string.h>

int main(void)
{
        char buf[16384];
        memset(buf, 0, sizeof(buf));
        int fd=open("/dev/kmem", O_RDONLY); // Must be O_RDONLY
        read(fd, buf, 16384);
        write(1, buf, 16384);
}

---------- Post updated at 03:16 PM ---------- Previous update was at 03:08 PM ----------

You also sound like the sort of programmer who might appreciate A Whirlwind Tutorial on Creating Really Teensy ELF Executables for Linux. Quite a lot has changed since the Commodore 64 days, and a good demonstration of what's happening at the assembly level might help complete your picture.
# 13  
Old 12-21-2011
OK, I want my code above to work with Linux. I'm an out of work systems hacker and this seems like a fun way of passing the time.

Some questions;

1.Do Linux Device Drivers operate at Ring 0?

2. Would the ability to read and update Kernel memory require writing a device driver or changing the Memory Management of Linux?

My main concern is the 'freeing' of the Linux kernel. So that the safety comes off, and the ability to make live updates without server downtime are possible.

Plus, such a feature would be fun! *smiles*

Corona, you hinted at a /dev/kmem file. I'm new to Linux systems programming, but have a couple of books on writing device drivers for Linux.

My ideas at this point are double;

1. /dev/kmem returns a raw dump of memory without formatting

2. /dev/kmem returns a formatted hexidecimal / Intel ASM output of the RAM in columns sided with RAM Addresses

My paths are thus;

1. Access the Global descriptor table task state segment of the kernel to obtain RAM values for access at a later point in the device driver. (Is that possible?)

2. Access the Process Table in Linux for a list of processes and start/stop address blocks. (Unsafe?)

So many questions at this point in time, not sure where to go for guidance on Linux systems programming.

Oh, if anyone when reading this post suddenly has a website link they think would be useful, or a book to purchase to help, any resources actually, I'd be happy to read up on the subject to make this idea possible.

Basically, what I want is to do the following in C;

Code:
void main() {

fd = open("/dev/kmem", 'rw');

// fd opens to beginning of kernel space in RAM

poke_ram(fd, $var);

seek(fd);

read(fd, buf...);

process(fd);

close(fd);

}
}

Rather simple idea? But how to make this code work with Linux?

Thank you for taking the time to read about my new idea.

I'm currently working on my own OS. It runs only in ring 0, and has full access to the RAM and kernel code. Never enters ring 4. Have you heard about self-modifying code? That is a passion of mine. The OS currently only is in text mode, protected mode with segmentation, and has a blue sky with white stars signifying the beginning of the end.

Last edited by Alux; 12-22-2011 at 02:18 AM..
# 14  
Old 12-22-2011
Remember that this is an open-source operating system. There's bound to have been people who've wanted to do the same things you have, and they've been building these features right into the kernel for going on 19 years.

Process tables are directly available including their memory layout, statistics, environment, file and stack and anonymous mappings, open files and sockets, process limits and priority, page maps, user id's, and raw memory contents, via the special /proc/ folder, for each and every process in the system.

Global information is also available under /proc/ on interrupts, DMA, CPU or CPUs, system memory I/O maps, I/O ports, and loaded device drivers.

Low and high-level access to disk, optical, terminal, keyboard, mouse, serial, video input, video output, audio I/O and audio mixing, some CPU features like high-precision timers, and more are available in /dev/.

Comprehensive, detailed, live, and sometimes even writable information on devices, buses, CPUs and CPU features, power saving features, sleep states, power saving states, device drivers, individual options for device drivers, hardware monitoring devices, information on board and CPU firmware, and many more things I don't have any idea what they do yet are are available under /sys/.

They've done things I didn't even think were possible, like kernel debuggers.

Documentation on these things is available in the Documentation folder of the linux kernel source code.

Whatever you want to do, there's almost certainly better ways to do it than poke-ing RAM. And if there isn't, someone would probably thank you for making a device driver for it so they don't have to poke RAM anymore.

Quote:
Code:
void main() {

fd = open("/dev/kmem", 'rw');

// fd opens to beginning of kernel space in RAM

poke_ram(fd, $var);

seek(fd);

read(fd, buf...);

process(fd);

close(fd);
}

Rather simple idea? But how to make this code work with Linux?
I've already given you an outline which isn't pseudocode, but if you're wanting me to explain the entire C language to you that's going to take a long time. Start reading the manual pages for these commands to understand how to use them in other ways. 'man 2 open' for instance shows you what headers to include, what flags work with it(O_RDONLY, O_RDWR, and so forth), how it responds to errors, what errors might occur, and a syllabus of related system calls like the 'lseek' you were looking for. If you don't have manual pages available on your system, you can use the 'man pages' link above to find manuals for linux and a variety of other systems right on unix.com.

There's more fundamental problems. How do you know poking is going to do anything? This isn't a Commodore. Memory context isn't always the same even inside the kernel, writing to the correct address often isn't enough. The right context to do so may only be available inside the kernel, and even then, only when you ask for it first.

Why bother running an operating system when you won't let it do its job?
Quote:
Originally Posted by Alux
1.Do Linux Device Drivers operate at Ring 0?
I believe so.
Quote:
2. Would the ability to read and update Kernel memory require writing a device driver or changing the Memory Management of Linux?
It'd be done more sensibly inside a kernel driver than poking from the outside. You wouldn't have to chart out memory and pick addresses and hope they never change behind your back, just use variables and get what you asked for.
Quote:
My main concern is the 'freeing' of the Linux kernel. So that the safety comes off, and the ability to make live updates without server downtime are possible.
Linux already does this with modules. Device drivers can be loaded, unloaded, replaced, and reloaded at runtime. Really quite a lot of the kernel can be made as modules now, not just device drivers but entire feature sets. Even your disk drivers -- you can get around the catch-22 of loading disk drivers from disk by using an initramfs system, a tiny preloaded ramdrive that the bootloader sets up for you.

When modules won't do, linux already has the new kexec feature to load a new kernel without rebooting. kexec is also handy to load completely different OSes without the hassle of going through POST again.
Quote:
My ideas at this point are double;

1. /dev/kmem returns a raw dump of memory without formatting

2. /dev/kmem returns a formatted hexidecimal / Intel ASM output of the RAM in columns sided with RAM Addresses
Your first guess is the more correct one, I think.
Quote:
1. Access the Global descriptor table task state segment of the kernel to obtain RAM values for access at a later point in the device driver. (Is that possible?)
This isn't your commodore, memory can move. How do you know values you grab now are going to make any sense later? How do you know what you ask for is even going to be in memory and not in swap?
Quote:
2. Access the Process Table in Linux for a list of processes and start/stop address blocks. (Unsafe?)
This is what I've been telling you. You don't need poke. The process table and comprehensive information on processes is already available via the special /proc/ folder.
Quote:
So many questions at this point in time, not sure where to go for guidance on Linux systems programming.
Quote:
Have you heard about self-modifying code? That is a passion of mine.
How about self-modifying code which saves itself to file, so next time you run it, the changes are still there? Possible in UNIX with mmap() and mprotect() -- map a memory area in from a file, set it readable, writable, and executable, then go to town. Any changes you make to it will be saved to file without any more intervention on your part.

Much easier when you use an operating system instead of fighting it.

Last edited by Corona688; 12-22-2011 at 12:48 PM..
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Linux

Need assistance to enable more that 4GB RAM on Linux 32Bit OS.

How to enable more than 4GB RAM support on Linux 32bit OS? OS: CentOS release 5.4 (Final) Kernel version: 2.6.18-53.el5 Arch: 32Bit I got solution at Innovationframes.com &bull; View topic - How to enable more than 4GB RAM support on Linux 32bit OS? but my question is the steps given... (5 Replies)
Discussion started by: chandranjoy
5 Replies

2. Linux Benchmarks

AMD Phenom(tm) 9950 Quad-Core Processor, Ram: 3.6 GB, Foxconn 7da-s and Linux 2.6.26-2-amd64

CPU/Speed: AMD Phenom(tm) 9950 Quad-Core Processor Ram: 3.6 GB Motherboard: Foxconn 7da-s Bus: Cache: Controller: Disk: Load: Kernel: Linux 2.6.26-2-amd64 Kernel ELF?: pgms: ============================================================== BYTE UNIX Benchmarks (Version... (0 Replies)
Discussion started by: migracho
0 Replies

3. Red Hat

red hat Linux 5.0 is detecting 3gb ram but physical ram is 16gb

Hi, On server 64bit Hw Arch , Linux 5.0(32bit) is installed it is showing only 3gb of ram though physical is 16gb can u give me idea why? (4 Replies)
Discussion started by: manoj.solaris
4 Replies

4. Linux

Installation of Linux in 300 MHz with 128 MB ram

Hi I am very new to Linux, but very keen to learn it. I am having a desktop of 300 MHz with 128 MB RAM and 30 GB hard drive with Windows XP. My first question is - Is there any version/flavour of Linux available that can be installed on above system especially Fedora with less compromise... (6 Replies)
Discussion started by: sanjay1979
6 Replies

5. Shell Programming and Scripting

To find the RAM size for an Linux server.

Hi Gurus, Can someone let me know how to find the RAM size,ROM size and Number of processors for a linux server. Version :Linux 2.4.9-e.57smp Also what does "e.57smp" stands for? Thanks in advance gurus..... cheers. (3 Replies)
Discussion started by: navojit dutta
3 Replies

6. UNIX for Dummies Questions & Answers

Linux for Pentium @ 150 Mhz and 98Mb in RAM?

I don't know a lot of the world of Linux, but i want to start with an old machine; did someone knows if i can install Linux in a computer with a processor Pentium (not celeron) @ 133 Mhz, 98Mb in RAM (PC100) and 3Gb Hard Drive? a friend tell me about Ubuntu and openSUSE, but I don't know if... (5 Replies)
Discussion started by: Omega
5 Replies

7. Debian

what is the best linux ver for p100 16 ram

Hello all i own p100 16ram laptop , i would like to run linux on it i need it for gcc compilation and shell scripting , no gui. what version of linux should i install , i dont mind to install old one . tnx allot (5 Replies)
Discussion started by: umen
5 Replies

8. UNIX for Dummies Questions & Answers

How do i access (mount, read & write) a floppy disk from the console, not being root?

welll, the title quite explains what i want to do thanks for your time! (4 Replies)
Discussion started by: kfaday
4 Replies

9. UNIX for Dummies Questions & Answers

How much RAM does RH Linux need?

I wish to install Red Hat linux 7.1 on a machine with 16mb of EDO Ram. When I enter the instalation process I am told 'You do not have enough memory'. Is there a way to install RHL with only the 16? Or will I have to upgrade and buy some very expensive EDO. ~ Paul (3 Replies)
Discussion started by: KrazyGuyPaul
3 Replies

10. UNIX for Dummies Questions & Answers

Athlon XP + Linux/Unix? and RAM Question

Has anyone had any experience with this new processor and its compatability with Linux/Unix? How did it preform comared to regular Athlons and P4's? I also have one other question. I plan on buying a new dell and fiddling left and right with it. Which type of RAM is better, RDRAM or... (3 Replies)
Discussion started by: KyPeN
3 Replies
Login or Register to Ask a Question