📄 lkmlecture.html
字号:
<HTML>
<HEAD>
<TITLE>Loadable Kernel Modules [LKM] Lecture</TITLE>
</HEAD>
<BODY>
<br>
<CENTER>
<HR SIZE=1 NOSHADE WIDTH="45%">
Loadable Kernel Modules [LKM] Lecture<br>
By <a href="mailto:the__unknown_@hotmail.com">Unknown</a><br>
HTML by <a href="mailto:rammal81@hotmail.com">Mikkkeee</a><br>
For <A HREF="http://blacksun.box.sk">Blacksun Research Facility
[BSRF]</A><br>
<A HREF="http://blacksun.box.sk">http://blacksun.box.sk</A><br>
<HR SIZE=1 NOSHADE WIDTH="61%"><br></center>
<P><B>LKM file can be downloaded from <A HREF="http://blacksun.box.sk/mirror/LKM.zip">http://blacksun.box.sk/mirror/LKM.zip</A></B>
<P><sts|> a zip ???
<BR><Mikkkeee> guys the lecture started?
<BR><Hijack> 5k
<BR><mezzano> it's mikkkeee sup man told you I wouldn't miss this one
;)
<BR><SpiderMan> around 5k
<BR><SpiderMan> not large at all
<BR><Syrup> anyone know how juno password algorithm works?
<BR><Phr3k> small
<BR><Mikkkeee> guys the lecture started?
<BR><SpiderMan> not yet Mikkkeee
<BR><SpiderMan> just told everyone to download the file
<BR>*** Mikkkeee sets mode: +v unknown
<BR><unknown> No it starts now
<BR><Revelant-Angel> i can read anything all messages are flying passed
me
<BR>*** Retrieving #bsrf info...
<BR>*** Revelant-Angel has quit IRC (Quit:)
<BR><feds> what is it???
<BR><Syrup> yay lecture
<BR>*** DarkneSs has joined #bsrf
<BR><Mikkkeee> its a zip unknown set up
<BR>*** bulgarinche has joined #bsrf
<BR><Mikkkeee> http://blacksun.box.sk/mirror/LKM.zip
<BR><Phr3k> i dunno what LKM even is
<BR><Mikkkeee> loadable kernel modules
<BR><unknown> I will explain every thing
<BR><freakOVER> don't get excited kids!
<BR><freakOVER> :)
<BR><feds> hey
<BR><feds> me 2!
<BR><Mikkkeee> well someone log this too
<BR><}{exadecimal> LKM = Loadable Kernel Module
<BR>*** optimum has quit IRC (Quit: )
<BR><Phr3k> is this lecture aplicable to even beginners
<BR>* freakOVER is loggin
<BR><freakOVER> ;)
<BR><}{exadecimal> i'm logging Mikkkeee
<BR><Phr3k> i'm a beginner beginner
<BR><Dustin> obviously
<BR>*** wascy has joined #bsrf
<BR><Mikkkeee> ---------beginning of lecture---------------
<BR><feds> any other celeb like u
<BR>*** Mikkkeee sets mode: +m
<BR><Mikkkeee> if anyone wants voice msg an op
<BR>*** Mikkkeee sets mode: -m
<BR><unknown> OK lets start
<BR><ControlC> SWEET
<BR>*** _jacs- is now known as jacs
<BR><D|GiTaLM0nKe3> k
<BR><wascy> me, pls.
<BR><Mikkkeee> wait who wants voice
<BR><}{exadecimal> do we need a c compiler? theres a c file in that
zip
<BR><sts|> wich kernelversion?
<BR><sts|> 2.2 2.4?
<BR><Dustin> i owuld like voice
<BR><D|GiTaLM0nKe3> I do
<BR><twix> me
<BR><Phr3k> i want voice
<BR><|StYxX|> no one talk for a sec
<BR><wascy> i'd like. thx.
<BR><freakOVER> ouch
<BR><snider> }{exadecimal: If you use linux you have gcc, if you don't
use linux the LKM won't compile anyways
<BR>*** Mikkkeee sets mode: +v Phr3k
<BR>*** Mikkkeee sets mode: +m
<BR><unknown> you need GCC
<BR><Mikkkeee> unknown you can begin
<BR><unknown> LKM(loadable kernel modules) are used to increase
<BR><unknown> the kernel's functionality on run time.
<BR>*** Mikkkeee sets mode: +v mezzano
<BR><unknown> which means you dont have to recompile the entire kernel
to
<BR><unknown> use load it.
<BR><unknown> This is why it is used for many device drivers.
<BR><unknown> Because LKM are used as part of the kernel it
<BR><unknown> give us endless ways to use it for our benifits :)
<BR>*** SpiderMan has quit IRC (Ping timeout: 180 seconds)
<BR><freakOVER> are LKMs slower to load?
<BR>*** SpiderMan has joined #bsrf
<BR>*** ChanServ sets mode: +o SpiderMan
<BR><unknown> Every LKM contains 2 main functions
<BR>*** h4x0r3d has joined #bsrf
<BR><unknown> int init_module(void) and cleanup_module
<BR>*** jacs has joined #bsrf
<BR>*** _sokrates- has quit IRC (Quit: Leaving)
<BR><unknown> init_module is called when the module is loaded and cleanup_module
<BR><unknown> is called when you remove it. init_module should return
0
<BR><unknown> to signal that everything is OK.
<BR><unknown> e also must define MODULE and include linux/module.h for
<BR><unknown> module configurations,definitions,macros etc.
<BR>*** Phish has joined #bsrf
<BR><unknown> o now we can code our first helloworld LKM
<BR><unknown> look at helloworld.c see of you understand everything.
<BR><unknown> (it should be easy).
<BR><unknown> If u wonder why i used printk and not printf its
<BR><unknown> because we are running in kernel mode which
<BR><unknown> means we can use restricted set of functions
<BR><unknown> A list of useful funcs is in func_list.txt.
<BR>*** D|GiTaLM0nKe3 has left #bsrf
<BR><unknown> questions ?
<BR>*** snider sets mode: -m
<BR><mezzano> that was deep ;)
<BR><freakOVER> ya
<BR><freakOVER> are LKMs slower to load up than if u just compiled the
kernel with them?
<BR><freakOVER> hey it's just a question :P
<BR><unknown> You load it into lernel space in run-time
<BR><snider> feds: i'll send the files
<BR><sts|> you load them.. then they run like they were compiled into
the kernel
<BR><freakOVER> ah ok
<BR><feds> i have them
<BR><Hijack> passwords can be captured using the LKM
<BR><unknown> Yes
<BR><Hijack> have them sent through e-mail
<BR><unknown> you can do almost everything using LKM
<BR><}{exadecimal> so how do we use the lkm?
<BR><unknown> OK
<BR><feds> it says it can't find DEVCPP.exe
<BR><unknown> So let continue
<BR><suspect> lol
<BR><Mikkkeee> unknown would these files run as vxd files?
<BR><Dustin> unknown: but they would need to RUN your lkm first to steal
passes?
<BR><SpiderMan> feds: just open it up in notepad for now
<BR><unknown> So lets continue
<BR>*** snider sets mode: +m
<BR><freakOVER> feds: open it using notepad
<BR><unknown> You can also hack the sever and load it yourself
<BR><unknown> It almost like VxD but in linux
<BR><Mikkkeee> are you going to give us an example in real time?
<BR><unknown> Yes
<BR><Mikkkeee> man vxd hacking is hot
<BR>*** Dustin has left #bsrf
<BR><unknown> So compile helloworld.c with gcc -O3 -c helloworld.c
<BR>*** pitpat has joined #bsrf
<BR><unknown> This will create helloworld.o
<BR>*** Syrup has quit IRC (Quit:)
<BR><unknown> to insert the LKM do "insmod helloworld.o"
<BR>*** dg-2 has quit IRC (Quit: )
<BR><unknown> Now do lsmod
<BR><unknown> this will list the modules loaded into the kernel
<BR><unknown> Later we will see how to make our LKM
<BR><unknown> Unremovabe & invisible
<BR><unknown> to remove it do "rmmod helloworld"
<BR><unknown> questions?
<BR>*** DG-2 has joined #bsrf
<BR><unknown> questions?
<BR><mezzano> nope seems pretty intuitive ;)
<BR><unknown> KO
<BR><unknown> OK
<BR>*** SpiderMan sets mode: -m
<BR><Hijack> so is there any solutions for removing it if i were a system
admin
<BR><}{exadecimal> no voice
<BR><Hijack> ?
<BR><unknown> OK now because our LKM is running in kernel space
<BR><unknown> we cant access user space memory.
<BR><unknown> So lets say one of our functions gets as
<BR><unknown> an argument a pointer to user space
<BR><unknown> we must move it to kernel space before we try
<BR><unknown> to use data it points to.
<BR><_miketr0nix-> hello
<BR>*** SpiderMan sets mode: +m
<BR><unknown> to use data it points to.
<BR><unknown> He can remove it on run-time he can restart the box
<BR><unknown> so the module will not be loaded
<BR>*** Mikkkeee sets mode: +o unknown
<BR>*** ChanServ sets mode: -o unknown
<BR><Mikkkeee> shit
<BR><unknown> but first he has to find it
<BR>* mezzano thinks mikkkeee needs to pimp-slap chanserv ;)
<BR><unknown> If you what you can put some script to insmod it when
the box starts
<BR><unknown> In order to move user data to ke rnel data we have several
functions
<BR>*** ControlC has quit IRC (Quit: )
<BR><unknown> get_user(kernel_dest,user_pointer) - gets the value user_pointer
points to
<BR><unknown> and put it in kernel_dest(old kernels use dest=get_user(src)).
<BR><unknown> put_user(kernel_src,user_pointer) - note that kernel_src
<BR><unknown> is not a pointer)
<BR><unknown> copy_from_user(kernel_dest_ptr,src_ptr,size)
<BR><unknown> copy_to_user(user_dest_ptr,src_ptr,size)
<BR>*** DG-2 has quit IRC (Quit: Leaving)
<BR>*** pitpat has quit IRC (Quit: )
<BR>*** Mikkkeee sets mode: +o unknown
<BR>*** optimum has joined #bsrf
<BR><unknown> For example look at _h_lkm.c at line 78
<BR>*** suspect has quit IRC (Ping timeout: 180 seconds)
<BR><unknown> this function copies string from user
<BR>*** Dustin has joined #bsrf
<BR><unknown> (GET_U is a macro for get_user())
<BR><unknown> questions ?
<BR>*** [phRoZen] has joined #BSRF
<BR>*** SpiderMan sets mode: -m
<BR><Hijack> none at the moment
<BR>*** optimum is now known as optimum[d
<BR><Neophyte> im fine
<BR><}{exadecimal> yeah
<BR>*** zaxil has joined #bsrf
<BR><zaxil> hey everyone
<BR><}{exadecimal> why do we keep losing our voices?
<BR>*** bulgarinche has quit IRC (Ping timeout: 180 seconds)
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -